Vendor
Bitdefender
82 known vulnerabilities.
Products
82 results · Feed
-
Medium 5.3
Server-Side Request Forgery in EPPUpdateService remote config file (VA-9825)
A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService of Bitdefender Endpoint Security Tools allows an attacker to use the Endpoint Protection relay as a proxy for any remote host. This issue affects: Bitdefender Endpoint Security Tools v…
-
Critical 9.0
Improper Access Control vulnerability in the patchesUpdate API
Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects: Bitdefender Endpoi…
-
Medium 5.3
Insufficient validation on regular expression in EPPUpdateService config file (VA-9825)
A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay server. This issue affects: Bitdefender Endpoint Security Tools versions prior to 6.6…
-
Medium 6.1
Improper Link Resolution Before File Access in Bitdefender GravityZone (VA-9921)
Improper Link Resolution Before File Access ('Link Following') vulnerability in the EPAG component of Bitdefender Endpoint Security Tools for Windows allows a local attacker to cause a denial of service. This issue affects: Bitdefender GravityZone version 7.1…
-
High 7.1
Path traversal vulnerability in Bitdefender GravitZone Update Server in relay mode
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects: Bitdefender Gravity…
-
High 7.8
Privilege escalation via SeImpersonatePrivilege
Execution with Unnecessary Privileges vulnerability in Bitdefender Endpoint Security Tools, Total Security allows a local attacker to elevate to 'NT AUTHORITY\System. Impersonation enables the server thread to perform actions on behalf of the client but withi…
-
High 7.8
Incorrect Default Permissions vulnerability in bdservicehost.exe and Vulnerability.Scan.exe
Incorrect Default Permissions vulnerability in the bdservicehost.exe and Vulnerability.Scan.exe components as used in Bitdefender Endpoint Security Tools for Windows, Total Security allows a local attacker to elevate privileges to NT AUTHORITY\SYSTEM This iss…
-
Medium 6.5
Improper Certificate Validation vulnerability in the Online Threat Prevention module as used in Bitdefender Total Secur…
-
Medium 6.4
Improper Input Validation in Bitdefender Endpoint Security Tools for Linux
An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution. This issue…
-
High 7.8
Privilege escalation in Bitdefender GravityZone Business Security
Uncontrolled Search Path Element vulnerability in the openssl component as used in Bitdefender GravityZone Business Security allows an attacker to load a third party DLL to elevate privileges. This issue affects Bitdefender GravityZone Business Security versi…
-
Medium 5.5
Same-origin policy vulnerability in Bitdefender Safepay
An Origin Validation Error vulnerability in Bitdefender Safepay allows an attacker to manipulate the browser's file upload capability into accessing other files in the same directory or sub-directories. This issue affects: Bitdefender Safepay versions prior t…
-
Medium 6.1
Memory corruption in Bitdefender Hypervisor Introspection (VA-9336)
Memory corruption in IntLixCrashDumpDmesg, IntLixTaskFetchCmdLine, IntLixFileReadDentry and IntLixFileGetPath due to insufficient guest-data input validation may lead to denial of service conditions.
-
High 7.8
Compiler Optimization Removal or Modification of Security-Critical Code vulnerability in Bitdefender Hypervisor Introspection (VA-9339)
Compiler Optimization Removal or Modification of Security-critical Code vulnerability in IntPeParseUnwindData() results in multiple dereferences to the same pointer. If the pointer is located in memory-mapped from the guest space, this may cause a race-condit…
-
Medium 5.5
Lack of validation on data read from guest memory in Bitdefender HVI (VA-9333)
Lack of validation on data read from guest memory in IntPeGetDirectory, IntPeParseUnwindData, IntLogExceptionRecord, IntKsymExpandSymbol and IntLixTaskDumpTree may lead to out-of-bounds read or it could cause DoS due to integer-overflor (IntPeGetDirectory), T…
-
Medium 6.5
URL Spoofing Vulnerability in Bitdefender SafePay (VA-8958)
An Origin Validation Error vulnerability in the SafePay component of Bitdefender Antivirus Plus allows a web resource to misrepresent itself in the URL bar. This issue affects: Bitdefender Antivirus Plus versions prior to 25.0.7.29.
-
High 7.1
Insufficient validation in the Bitdefender Update Server and BEST Relay components of Bitdefender Endpoint Security Too…
-
Medium 5.9
Bitdefender ceva_emu.cvd module denial-of-service (VA-8766)
A vulnerability has been discovered in the ceva_emu.cvd module that results from a lack of proper validation of user-supplied data, which can result in a pointer that is fetched from uninitialized memory. This can lead to denial-of-service. This issue affects…
-
Medium 5.9
Bitdefender ace.xmd parser out-of-bounds write (VA-8772)
A vulnerability has been discovered in the ace.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. This can result in denial-of-service. This issue affects: Bitdefend…
-
Low 3.2
Local Privilege Escalation in Bitdefender Engines (VA-8953)
An improper Input Validation vulnerability in the code handling file renaming and recovery in Bitdefender Engines allows an attacker to write an arbitrary file in a location hardcoded in a specially-crafted malicious file name. This issue affects: Bitdefender…
-
High 8.1
Improper authentication vulnerability in Bitdefender Endpoint Security Tools and Endpoint Security SDK (VA-8646)
An improper authentication vulnerability in Bitdefender Endpoint Security Tools for Windows and Bitdefender Endpoint Security SDK allows an unprivileged local attacker to escalate privileges or tamper with the product's security settings. This issue affects: …
-
High 8.2
Insufficient client validation in Bitdefender Endpoint Security for Mac (VA-8759)
Improper Authentication vulnerability in Bitdefender Endpoint Security for Mac allows an unprivileged process to restart the main service and potentially inject third-party code into a trusted process. This issue affects: Bitdefender Endpoint Security for Mac…
-
High 8.8
Insufficient URL sanitization and validation in Safepay Browser (VA-8631)
Improper Input Validation vulnerability in the Safepay browser component of Bitdefender Total Security 2020 allows an external, specially crafted web page to run remote commands inside the Safepay Utility process. This issue affects Bitdefender Total Security…
-
High 7.2CVE-2020-8103 Public exploit
Link Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8604)
A vulnerability in the improper handling of symbolic links in Bitdefender Antivirus Free can allow an unprivileged user to substitute a quarantined file, and restore it to a privileged location. This issue affects Bitdefender Antivirus Free versions prior to …
-
Critical 9.0
Incomplete validation in detection code in Bitdefender Engines (VA-8589)
Improper Input Validation vulnerability in the cevakrnl.rv0 module as used in the Bitdefender Engines allows an attacker to trigger a denial of service while scanning a specially-crafted sample. This issue affects: Bitdefender Bitdefender Engines versions pri…
-
High 7.1
Link Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8387)
A vulnerability in the improper handling of junctions in Bitdefender Antivirus Free can allow an unprivileged user to substitute a quarantined file, and restore it to a privileged location. This issue affects: Bitdefender Antivirus Free versions prior to 1.0.…
-
Medium 6.3
Untrusted Search Path Vulnerability in High-Level Antimalware SDK
Untrusted Search Path vulnerability in Bitdefender High-Level Antimalware SDK for Windows allows an attacker to load third party code from a DLL library in the search path. This issue affects: Bitdefender High-Level Antimalware SDK for Windows versions prior …
-
Medium 4.9
Bitdefender Total Security Link Resolution Denial-of-Service Vulnerability
A vulnerability in the improper handling of junctions before deletion in Bitdefender Total Security 2020 can allow an attacker to to trigger a denial of service on the affected device.
-
Medium 5.3
Code Injection into Bitdefender AV for Mac
A vulnerability in the AntivirusforMac binary as used in Bitdefender Antivirus for Mac allows an attacker to inject a library using DYLD environment variable to cause third-party code execution
-
Low 1.6
Privilege escalation in Bitdefender AV for Mac
A privilege escalation vulnerability in BDLDaemon as used in Bitdefender Antivirus for Mac allows a local attacker to obtain authentication tokens for requests submitted to the Bitdefender Cloud. This issue affects: Bitdefender Bitdefender Antivirus for Mac v…
-
Critical 9.0
Bitdefender BOX 2 bootstrap get_image_size command injection vulnerability
A OS Command Injection vulnerability in the bootstrap stage of Bitdefender BOX 2 allows the manipulation of the `get_image_url()` function in special circumstances to inject a system command.
-
Medium 5.3
Untrusted Search Path vulnerability in EPSecurityService.exe (VA-3500)
An Untrusted Search Path vulnerability in EPSecurityService.exe as used in Bitdefender Endpoint Security Tools versions prior to 6.6.11.163 allows an attacker to load an arbitrary DLL file from the search path. This issue affects: Bitdefender EPSecurityServic…
-
High 8.1
Bitdefender BOX 2 bootstrap download_image command injection vulnerability
A command injection vulnerability has been discovered in the bootstrap stage of Bitdefender BOX 2, versions 2.1.47.42 and 2.1.53.45. The API method `/api/download_image` unsafely handles the production firmware URL supplied by remote servers, leading to arbit…
-
Medium 4.9
Get-task-allow entitlement via BDLDaemon on macOS
An Incorrect Default Permissions vulnerability in the BDLDaemon component of Bitdefender AV for Mac allows an attacker to elevate permissions to read protected directories. This issue affects: Bitdefender AV for Mac versions prior to 8.0.0.
-
High 8.3
Bitdefender BOX v2 bootstrap update_setup command execution vulnerability (VA-2226)
An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method `/api/update_setup` does not perform firmware signature checks atomically, leading to an exploitable race condition (TOCTTOU…
-
Medium 5.2
Untrusted Search Path vulnerability in Bitdefender Total Security 2020 (VA-5895)
An Untrusted Search Path vulnerability in bdserviceshost.exe as used in Bitdefender Total Security 2020 allows an attacker to execute arbitrary code. This issue does not affect: Bitdefender Total Security versions prior to 24.0.12.69.
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay…
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay…
-
High 8.8
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Interne…
-
Unscored —
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Interne…