Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 112

Export CSV
CVE-2021-3576

Privilege escalation via SeImpersonatePrivilege

Execution with Unnecessary Privileges vulnerability in Bitdefender Endpoint Security Tools, Total Security allows a local attacker to elevate to 'NT AUTHORITY\System. Impersonation enables the server thread to perform actions on behalf of the client but within the limits of the client's security context. This issue affects: Bitdefender Endpoint Security Tools versions prior to 7.2.1.65. Bitdefender Total Security versions prior to 25.0.26.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Bitdefender
Products
Endpoint Security Tools Total Security
CVE-2021-3554

Improper Access Control vulnerability in the patchesUpdate API

Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.

CVSS 3.1 · 9 Critical EPSS 2.1% KEV · Not listed
Vendors
Bitdefender
Products
Endpoint Security Tools Gravityzone
CVE-2021-3553

Server-Side Request Forgery in EPPUpdateService remote config file (VA-9825)

A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService of Bitdefender Endpoint Security Tools allows an attacker to use the Endpoint Protection relay as a proxy for any remote host. This issue affects: Bitdefender Endpoint Security Tools versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint for Linux versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.

CVSS 3.1 · 5.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Bitdefender
Products
Endpoint Security Tools Gravityzone
CVE-2021-3552

Insufficient validation on regular expression in EPPUpdateService config file (VA-9825)

A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay server. This issue affects: Bitdefender Endpoint Security Tools versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender GravityZone 6.24.1-1.

CVSS 3.1 · 5.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Bitdefender
Products
Endpoint Security Tools Gravityzone
CVE-2021-3485

Improper Input Validation in Bitdefender Endpoint Security Tools for Linux

An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.155.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Bitdefender
Products
Endpoint Security Tools
CVE-2021-3423

Privilege escalation in Bitdefender GravityZone Business Security

Uncontrolled Search Path Element vulnerability in the openssl component as used in Bitdefender GravityZone Business Security allows an attacker to load a third party DLL to elevate privileges. This issue affects Bitdefender GravityZone Business Security versions prior to 6.6.23.329.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Bitdefender
Products
Gravityzone Business Security
CVE-2020-8110

Bitdefender ceva_emu.cvd module denial-of-service (VA-8766)

A vulnerability has been discovered in the ceva_emu.cvd module that results from a lack of proper validation of user-supplied data, which can result in a pointer that is fetched from uninitialized memory. This can lead to denial-of-service. This issue affects: Bitdefender Engines version 7.84897 and prior versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Bitdefender
Products
Engines
CVE-2020-8109

Bitdefender ace.xmd parser out-of-bounds write (VA-8772)

A vulnerability has been discovered in the ace.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. This can result in denial-of-service. This issue affects: Bitdefender Engines version 7.84892 and prior versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Bitdefender
Products
Engines
CVE-2020-8108

Insufficient client validation in Bitdefender Endpoint Security for Mac (VA-8759)

Improper Authentication vulnerability in Bitdefender Endpoint Security for Mac allows an unprivileged process to restart the main service and potentially inject third-party code into a trusted process. This issue affects: Bitdefender Endpoint Security for Mac versions prior to 4.12.80.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Bitdefender
Products
Endpoint Security
CVE-2020-8107

Process Control vulnerability in Bitdefender Antivirus Plus

A Process Control vulnerability in ProductAgentUI.exe as used in Bitdefender Antivirus Plus allows an attacker to tamper with product settings via a specially crafted DLL file. This issue affects: Bitdefender Antivirus Plus versions prior to 24.0.26.136. Bitdefender Internet Security versions prior to 24.0.26.136. Bitdefender Total Security versions prior to 24.0.26.136.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Bitdefender
Products
Antivirus Plus Internet Security Total Security
CVE-2020-8103

Link Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8604)

A vulnerability in the improper handling of symbolic links in Bitdefender Antivirus Free can allow an unprivileged user to substitute a quarantined file, and restore it to a privileged location. This issue affects Bitdefender Antivirus Free versions prior to 1.0.17.178.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Bitdefender
Products
Antivirus 2020
CVE-2020-8102

Insufficient URL sanitization and validation in Safepay Browser (VA-8631)

Improper Input Validation vulnerability in the Safepay browser component of Bitdefender Total Security 2020 allows an external, specially crafted web page to run remote commands inside the Safepay Utility process. This issue affects Bitdefender Total Security 2020 versions prior to 24.0.20.116.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Bitdefender
Products
Total Security 2020
CVE-2020-8100

Incomplete validation in detection code in Bitdefender Engines (VA-8589)

Improper Input Validation vulnerability in the cevakrnl.rv0 module as used in the Bitdefender Engines allows an attacker to trigger a denial of service while scanning a specially-crafted sample. This issue affects: Bitdefender Bitdefender Engines versions prior to 7.84063.

CVSS 3.1 · 9 Critical EPSS 1.0% KEV · Not listed
Vendors
Bitdefender
Products
Engines
CVE-2020-8099

Link Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8387)

A vulnerability in the improper handling of junctions in Bitdefender Antivirus Free can allow an unprivileged user to substitute a quarantined file, and restore it to a privileged location. This issue affects: Bitdefender Antivirus Free versions prior to 1.0.17.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Bitdefender
Products
Antivirus 2020
CVE-2020-8097

Improper authentication vulnerability in Bitdefender Endpoint Security Tools and Endpoint Security SDK (VA-8646)

An improper authentication vulnerability in Bitdefender Endpoint Security Tools for Windows and Bitdefender Endpoint Security SDK allows an unprivileged local attacker to escalate privileges or tamper with the product's security settings. This issue affects: Bitdefender Endpoint Security Tools for Windows versions prior to 6.6.18.261. This issue affects: Bitdefender Endpoint Security Tools for Windows versions prior to 6.6.18.261. Bitdefender Endpoint Security SDK versions prior to 6.6.18.261.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Bitdefender
Products
Endpoint Security Endpoint Security Tools
CVE-2020-8096

Untrusted Search Path Vulnerability in High-Level Antimalware SDK

Untrusted Search Path vulnerability in Bitdefender High-Level Antimalware SDK for Windows allows an attacker to load third party code from a DLL library in the search path. This issue affects: Bitdefender High-Level Antimalware SDK for Windows versions prior to 3.0.1.204 .

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bitdefender
Products
Antimalware Software Development Kit
CVE-2020-8095

Bitdefender Total Security Link Resolution Denial-of-Service Vulnerability

A vulnerability in the improper handling of junctions before deletion in Bitdefender Total Security 2020 can allow an attacker to to trigger a denial of service on the affected device.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Bitdefender
Products
Total Security 2020
CVE-2020-8093

Code Injection into Bitdefender AV for Mac

A vulnerability in the AntivirusforMac binary as used in Bitdefender Antivirus for Mac allows an attacker to inject a library using DYLD environment variable to cause third-party code execution

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bitdefender
Products
Antivirus
CVE-2020-8092

Privilege escalation in Bitdefender AV for Mac

A privilege escalation vulnerability in BDLDaemon as used in Bitdefender Antivirus for Mac allows a local attacker to obtain authentication tokens for requests submitted to the Bitdefender Cloud. This issue affects: Bitdefender Bitdefender Antivirus for Mac versions prior to 8.0.0.

CVSS 3.1 · 1.6 Low EPSS < 1% KEV · Not listed
Vendors
Bitdefender
Products
Antivirus
CVE-2020-15734

Same-origin policy vulnerability in Bitdefender Safepay

An Origin Validation Error vulnerability in Bitdefender Safepay allows an attacker to manipulate the browser's file upload capability into accessing other files in the same directory or sub-directories. This issue affects: Bitdefender Safepay versions prior to 25.0.7.29.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Bitdefender
Products
Safepay