Dennis Herrmann

**Name of the Vulnerable Software and Affected Versions** Comodo Internet Security Pro (affected versions not specified) **Description** This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the update mechanism, resulting from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of SYSTEM. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** VIPRE Antivirus Plus (affected versions not specified) **Description** This issue allows local attackers to escalate privileges on affected installations of VIPRE Antivirus Plus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the Anti Malware Service. By creating a symbolic link, an attacker can abuse the service to create arbitrary files. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of SYSTEM. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** G Data Total Security (affected versions not specified) **Description** This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw exists within the G DATA Backup Service, where creating a symbolic link can be used to create arbitrary files, leading to privilege escalation and execution of arbitrary code in the context of SYSTEM. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Innovaphone versions prior to 13r2 Service Release 17 **Description** The issue allows command injection via a modified service ID during app upload. **Recommendations** For versions prior to 13r2 Service Release 17, update to 13r2 Service Release 17 or later to resolve the issue.