CVE-2020-10867

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) allows attackers to bypass intended access restrictions on tasks from an untrusted process, when Self Defense is enabled.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-668

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://forum.avast.com/index.php?topic=232420.0Release Notes, Vendor Advisory
https://forum.avast.com/index.php?topic=232423.0Release Notes, Vendor Advisory
https://github.com/umarfarook882/Avast_Multiple_Vulnerability_Disclosure/blob/master/README.mdExploit, Third Party Advisory
https://forum.avast.com/index.php?topic=232420.0Release Notes, Vendor Advisory
https://forum.avast.com/index.php?topic=232423.0Release Notes, Vendor Advisory
https://github.com/umarfarook882/Avast_Multiple_Vulnerability_Disclosure/blob/master/README.mdExploit, Third Party Advisory

Timeline

Published: Apr 1, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-108687.5An issue was discovered in Avast Antivirus before 20. The aswTask RPC endpoint for the TaskEx library in the Avast Service (AvastSvc.exe) al CVE-2020-10877.8An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully ex CVE-2020-108705.5Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's temporary directori CVE-2020-108715.3In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disput CVE-2020-108747.5Motorola FX9500 devices allow remote attackers to read database files.CVE-2020-108757.5Motorola FX9500 devices allow remote attackers to conduct absolute path traversal attacks, as demonstrated by PL/SQL Server Pages files such CVE-2020-108767.5The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not correctly implement its timeout on the four-dig CVE-2020-108788.6Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expressio CVE-2020-108799.8rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is pas CVE-2020-10887.8An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could CVE-2020-108819.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1 CVE-2020-108828.8This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: