Skip to content
OpenAdvisories

Vendor

Bitdefender

82 known vulnerabilities.

Products

Total Security 16 Internet Security 8 Antivirus Plus 8 GravityZone 7 pybddisasm 5 SafePay 4 Bitdefender Engines 4 Bitdefender Internet Security 4 Endpoint Security Tools 4 Endpoint Security Tools for Linux 3 GravityZone Update Server 3 BOX v1 3 Hypervisor Introspection 3 Bitdefender BOX 2 3 ENdpoint Security Tools for Windows 3 GravityZone Console On-Premise 2 Antivirus Free 2 GravityZone Console 2 Engines 2 GravityZone Control Center (On Premises) 2 Endpoint Security for Windows 2 Endpoint Security for Linux 2 Napoca bare-metal hypervisor 2 Bitdefender Antivirus for Mac 2 Bitdefender Total Security 2020 2 Unified Endpoint 1 Bitdefender Antivirus Free 1 Endpoint Security for Mac 1 Antivirus Free 2020 1 Endpoinit Security Tools for Windows 1 Endpoint Security SDK 1 Update Server 1 Virus Scanner 1 EPSecurityService.exe 1 Bitdefender Update Server 1 Bitdefender AV for Mac 1 bdserviceshost.exe 1 GravityZone Cloud Console 1 Endpoint Security Tools for Mac 1 SecurePass 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.3
    CVE-2025-1987

    Stored XSS in Psono-Client via Malicious Vault Entry URLs

    A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries. As a res…

    Bitdefender Psono SecurePass Psono-client
  • Critical 9.5
    CVE-2025-2244

    Insecure PHP deserialization issue in GravityZone Console (VA-12634)

    A vulnerability in the sendMailFromRemoteSource method in Emails.php  as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplied input without validation. By crafting a malicious serialized payload, an attacker can trigger PHP…

    Bitdefender GravityZone Console
  • Critical 9.4
    CVE-2024-13871

    Unauthenticated Command Injection in Bitdefender BOX v1

    A command injection vulnerability exists in the /check_image_and_trigger_recovery API endpoint of Bitdefender Box 1 (firmware version 1.3.11.490). This flaw allows an unauthenticated, network-adjacent attacker to execute arbitrary commands on the device, pote…

    Bitdefender BOX v1
  • Critical 9.4
    CVE-2024-13872

    Bitdefender Box Insecure Update Mechanism Vulnerability in libboxhermes.so

    Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and detection rules on the devices. Updates can be remotely triggered through the /set_temp_token API m…

    Bitdefender BOX v1
  • Critical 9.2
    CVE-2024-6980

    Verbose error handling issue in GravityZone Update Server proxy service

    A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-5 running only on premise.

    Bitdefender GravityZone Update Server
  • Critical 9.0
    CVE-2021-3554

    Improper Access Control vulnerability in the patchesUpdate API

    Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects: Bitdefender Endpoi…

    Bitdefender GravityZone Endpoint Security Tools for Linux Unified Endpoint Linux
  • Critical 9.0
    CVE-2020-8100

    Incomplete validation in detection code in Bitdefender Engines (VA-8589)

    Improper Input Validation vulnerability in the cevakrnl.rv0 module as used in the Bitdefender Engines allows an attacker to trigger a denial of service while scanning a specially-crafted sample. This issue affects: Bitdefender Bitdefender Engines versions pri…

    Bitdefender Bitdefender Engines
  • Critical 9.0
    CVE-2019-17096

    Bitdefender BOX 2 bootstrap get_image_size command injection vulnerability

    A OS Command Injection vulnerability in the bootstrap stage of Bitdefender BOX 2 allows the manipulation of the `get_image_url()` function in special circumstances to inject a system command.

    Bitdefender Bitdefender BOX 2