https://vulnogram.org/ Most recent CVEs assigned by Bitdefender (bitdefender). https://vulnogram.org/seaview/icons/bitdefender.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-6851 https://vulnogram.org/CVE-2026-6851 An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a r… High Tue, 14 Jul 2026 07:11:50 GMT https://vulnogram.org/CVE-2026-10047 https://vulnogram.org/CVE-2026-10047 The Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the real-mode hook handler, implemented in napoca/kernel/handler.c. The handler uses a guest-controlled SS:SP-derived offset as an index into the 1MB RealMo… High Unsupported When Assigned Tue, 02 Jun 2026 14:17:15 GMT https://vulnogram.org/CVE-2026-10046 https://vulnogram.org/CVE-2026-10046 Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS INT 0x15 / E820 memory map handler, implemented in napoca/guests/bios_handlers.c. The handler computes a destination offset into the guest RealModeMemo… High Unsupported When Assigned Tue, 02 Jun 2026 14:16:21 GMT https://vulnogram.org/CVE-2025-7073 https://vulnogram.org/CVE-2025-7073 A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable directory (C:\Pr… High Wed, 10 Dec 2025 09:46:40 GMT https://vulnogram.org/CVE-2025-5317 https://vulnogram.org/CVE-2025-5317 An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users with administrative privileges to bypass the configured uninstall password protection. An unauthorized user with… Medium Tue, 11 Nov 2025 08:02:22 GMT https://vulnogram.org/CVE-2025-1987 https://vulnogram.org/CVE-2025-1987 A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries.… Critical Network Exploitable Sat, 21 Jun 2025 21:35:06 GMT https://vulnogram.org/CVE-2025-2245 https://vulnogram.org/CVE-2025-2245 A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component on port 7074 uses a domain allowlist to restrict outbound requests, but fails to properly sa… Medium Network Exploitable Fri, 04 Apr 2025 09:54:03 GMT https://vulnogram.org/CVE-2025-2243 https://vulnogram.org/CVE-2025-2243 A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading characters in DNS requests. Paired with other potential vulnerabilities, this bypass could be used… Medium Network Exploitable Fri, 04 Apr 2025 09:53:25 GMT https://vulnogram.org/CVE-2025-2244 https://vulnogram.org/CVE-2025-2244 A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplied input without validation. By crafting a malicious serialized payload, an attacker can tri… Critical Network Exploitable Fri, 04 Apr 2025 09:52:48 GMT https://vulnogram.org/CVE-2024-13870 https://vulnogram.org/CVE-2024-13870 An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, potentially vulnerable version of a Bitdefender-signe… Low Unsupported When Assigned Wed, 12 Mar 2025 11:48:35 GMT https://vulnogram.org/CVE-2024-13871 https://vulnogram.org/CVE-2024-13871 A command injection vulnerability exists in the /check_image_and_trigger_recovery API endpoint of Bitdefender Box 1 (firmware version 1.3.11.490). This flaw allows an unauthenticated, network-adjacent attacker to execute arbitrary commands on the dev… Critical Unsupported When Assigned Wed, 12 Mar 2025 11:48:20 GMT https://vulnogram.org/CVE-2024-13872 https://vulnogram.org/CVE-2024-13872 Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and detection rules on the devices. Updates can be remotely triggered through the /set_temp_to… Critical Unsupported When Assigned Wed, 12 Mar 2025 11:47:46 GMT https://vulnogram.org/CVE-2020-8094 https://vulnogram.org/CVE-2020-8094 An untrusted search path vulnerability in testinitsigs.exe as used in Bitdefender Antivirus Free 2020 allows a low-privilege attacker to execute code as SYSTEM via a specially crafted DLL file. High Wed, 15 Jan 2025 16:12:35 GMT https://vulnogram.org/CVE-2024-11128 https://vulnogram.org/CVE-2024-11128 A vulnerability in the BitdefenderVirusScanner binary as used in Bitdefender Virus Scanner for MacOS may allow .dynamic library injection (DYLD injection) without being blocked by AppleMobileFileIntegrity (AMFI). This issue is caused by the absence o… High Mon, 13 Jan 2025 21:49:30 GMT https://vulnogram.org/CVE-2023-49570 https://vulnogram.org/CVE-2023-49570 A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that isn't authorized to issue certificates. This occurs when the "Basic Constraints" extension… High Fri, 18 Oct 2024 08:07:18 GMT https://vulnogram.org/CVE-2023-49567 https://vulnogram.org/CVE-2023-49567 A vulnerability has been identified in the Bitdefender Total Security HTTPS scanning functionality where the product incorrectly checks the site's certificate, which allows an attacker to make MITM SSL connections to an arbitrary site. The product tr… High Fri, 18 Oct 2024 07:59:02 GMT https://vulnogram.org/CVE-2023-6058 https://vulnogram.org/CVE-2023-6058 A vulnerability has been identified in Bitdefender Safepay's handling of HTTPS connections. The issue arises when the product blocks a connection due to an untrusted server certificate but allows the user to add the site to exceptions, resulting in t… High Fri, 18 Oct 2024 07:52:08 GMT https://vulnogram.org/CVE-2023-6057 https://vulnogram.org/CVE-2023-6057 A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of certificates issued using the DSA signature algorithm. The product does not properly check the certificate chain, all… High Fri, 18 Oct 2024 07:38:23 GMT https://vulnogram.org/CVE-2023-6056 https://vulnogram.org/CVE-2023-6056 A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of self-signed certificates. The product is found to trust certificates signed with the RIPEMD-160 hashing algorithm wit… High Fri, 18 Oct 2024 07:31:23 GMT https://vulnogram.org/CVE-2023-6055 https://vulnogram.org/CVE-2023-6055 A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software fails to properly validate website certificates. Specifically, if a site certificate lacks the "Server Authentication" specification in… High Fri, 18 Oct 2024 07:17:02 GMT https://vulnogram.org/CVE-2024-6980 https://vulnogram.org/CVE-2024-6980 A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-5 running only on premise. Critical Network Exploitable Wed, 31 Jul 2024 06:58:44 GMT https://vulnogram.org/CVE-2024-3297 https://vulnogram.org/CVE-2024-3297 An issue in the Certificate Authenticated Session Establishment (CASE) protocol for establishing secure sessions between two devices, as implemented in the Matter protocol versions before Matter 1.1 allows an attacker to replay manipulated CASE Sigma… Medium Wed, 24 Jul 2024 08:02:52 GMT https://vulnogram.org/CVE-2024-3454 https://vulnogram.org/CVE-2024-3454 An implementation issue in the Connectivity Standards Alliance Matter 1.2 protocol as used in the connectedhomeip SDK allows a third party to disclose information about devices part of the same fabric (footprinting), even though the protocol is desig… Low Wed, 24 Jul 2024 07:58:40 GMT https://vulnogram.org/CVE-2024-4177 https://vulnogram.org/CVE-2024-4177 A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-2 that are running only on p… High Network Exploitable Thu, 06 Jun 2024 07:59:22 GMT https://vulnogram.org/CVE-2023-6324 https://vulnogram.org/CVE-2023-6324 ThroughTek Kalay SDK uses a predictable PSK value in the DTLS session when encountering an unexpected PSK identity High Wed, 15 May 2024 12:09:29 GMT https://vulnogram.org/CVE-2023-6323 https://vulnogram.org/CVE-2023-6323 ThroughTek Kalay SDK does not verify the authenticity of received messages, allowing an attacker to impersonate an authoritative server. Medium Wed, 15 May 2024 12:08:57 GMT https://vulnogram.org/CVE-2023-6322 https://vulnogram.org/CVE-2023-6322 A stack-based buffer overflow vulnerability exists in the message parsing functionality of the Roku Indoor Camera SE version 3.0.2.4679 and Wyze Cam v3 version 4.36.11.5859. A specially crafted message can lead to stack-based buffer overflow. An atta… High Wed, 15 May 2024 12:08:24 GMT https://vulnogram.org/CVE-2023-6321 https://vulnogram.org/CVE-2023-6321 A command injection vulnerability exists in the IOCTL that manages OTA updates. A specially crafted command can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability. High Wed, 15 May 2024 12:07:44 GMT https://vulnogram.org/CVE-2023-6320 https://vulnogram.org/CVE-2023-6320 A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6. A series of specially crafted requests can lead to command execution as the dbus user. An attacker can mak… Critical Tue, 09 Apr 2024 13:43:35 GMT https://vulnogram.org/CVE-2023-6319 https://vulnogram.org/CVE-2023-6319 A command injection vulnerability exists in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service on webOS version 4 through 7. A series of specially crafted requests can lead to command execution as the root user. An… Critical Tue, 09 Apr 2024 13:42:06 GMT https://vulnogram.org/CVE-2023-6318 https://vulnogram.org/CVE-2023-6318 A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS version 5 through 7. A series of specially crafted requests can lead to command execution as the root user. An attac… Critical Tue, 09 Apr 2024 13:41:47 GMT https://vulnogram.org/CVE-2023-6317 https://vulnogram.org/CVE-2023-6317 A prompt bypass exists in the secondscreen.gateway service running on webOS version 4 through 7. An attacker can create a privileged account without asking the user for the security PIN. Full versions and TV models affected: webOS 4.9.7 - 5.30.40 run… High Network Exploitable Tue, 09 Apr 2024 13:41:34 GMT https://vulnogram.org/CVE-2024-2224 https://vulnogram.org/CVE-2024-2224 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects the followi… High Network Exploitable Tue, 09 Apr 2024 13:01:47 GMT https://vulnogram.org/CVE-2024-2223 https://vulnogram.org/CVE-2024-2223 An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay. This issue affects the following products that include the vulnerable componen… High Network Exploitable Tue, 09 Apr 2024 13:01:34 GMT https://vulnogram.org/CVE-2023-6154 https://vulnogram.org/CVE-2023-6154 A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows an attacker to change the product's expected behavior and potentially l… High Mon, 01 Apr 2024 10:06:57 GMT https://vulnogram.org/CVE-2023-49569 https://vulnogram.org/CVE-2023-49569 A path traversal vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to create and amend files across the filesystem. In the worse case scenario, remote code execution could be achieved. Applications… Critical Network Exploitable Fri, 12 Jan 2024 10:41:00 GMT https://vulnogram.org/CVE-2023-49568 https://vulnogram.org/CVE-2023-49568 A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource ex… High Network Exploitable Fri, 12 Jan 2024 10:36:12 GMT https://vulnogram.org/CVE-2023-39424 https://vulnogram.org/CVE-2023-39424 A vulnerability in RDPngFileUpload.dll, as used in the IRM Next Generation booking system, allows a remote attacker to upload arbitrary content (such as a web shell component) to the SQL database and execute it with SYSTEM privileges. This vulnerabil… Critical Thu, 07 Sep 2023 12:25:42 GMT https://vulnogram.org/CVE-2023-39423 https://vulnogram.org/CVE-2023-39423 The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can leak the sessions table, obtain the currently valid sessions and impersonate a currently logg… High Network Exploitable Thu, 07 Sep 2023 12:24:41 GMT https://vulnogram.org/CVE-2023-39422 https://vulnogram.org/CVE-2023-39422 The /irmdata/api/ endpoints exposed by the IRM Next Generation booking engine authenticates requests using HMAC tokens. These tokens are however exposed in a JavaScript file loaded on the client side, thus rendering this extra safety mechanism useles… Medium Network Exploitable Thu, 07 Sep 2023 12:22:52 GMT https://vulnogram.org/CVE-2023-39421 https://vulnogram.org/CVE-2023-39421 The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services such as Twilio and Vonage. These keys allow unrestricted interaction with these services. High Thu, 07 Sep 2023 12:19:18 GMT https://vulnogram.org/CVE-2023-39420 https://vulnogram.org/CVE-2023-39420 The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" account and a corresponding password computed daily by a routine inside the DLL file. Once reverse-engineered, t… Critical Thu, 07 Sep 2023 12:17:09 GMT https://vulnogram.org/CVE-2023-3633 https://vulnogram.org/CVE-2023-3633 An out-of-bounds write vulnerability in Bitdefender Engines on Windows causes the engine to crash. This issue affects Bitdefender Engines version 7.94791 and lower. High Network Exploitable Fri, 14 Jul 2023 19:29:34 GMT https://vulnogram.org/CVE-2022-0357 https://vulnogram.org/CVE-2022-0357 Unquoted Search Path or Element vulnerability in the Vulnerability Scan component of Bitdefender Total Security, Bitdefender Internet Security, and Bitdefender Antivirus Plus allows an attacker to elevate privileges to SYSTEM. This issue affects: Bit… Medium Wed, 24 May 2023 07:53:32 GMT https://vulnogram.org/CVE-2023-1385 https://vulnogram.org/CVE-2023-1385 Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known value, which leads to unauthorized authentication to amzn.lightning services. This issue affects: Amazon Fire TV Stick 3rd gen versio… High Wed, 03 May 2023 12:33:31 GMT https://vulnogram.org/CVE-2023-1384 https://vulnogram.org/CVE-2023-1384 The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS vers… Medium Wed, 03 May 2023 12:10:43 GMT https://vulnogram.org/CVE-2023-1383 https://vulnogram.org/CVE-2023-1383 An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register services that are only locally accessible. This issue affects: Amazon Fire TV Stick 3rd gen v… Medium Wed, 03 May 2023 11:42:10 GMT https://vulnogram.org/CVE-2022-3369 https://vulnogram.org/CVE-2022-3369 An Improper Access Control vulnerability in the bdservicehost.exe component, as used in Bitdefender Engines for Windows, allows an attacker to delete privileged registry keys by pointing a Registry symlink to a privileged key. This issue affects: Bit… High Tue, 01 Nov 2022 07:45:19 GMT https://vulnogram.org/CVE-2022-2472 https://vulnogram.org/CVE-2022-2472 Improper Initialization vulnerability in the local server component of EZVIZ CS-C6N-A0-1C2WFR allows a local attacker to read the contents of the memory space containing the encrypted admin password. This issue affects: EZVIZ CS-C6N-A0-1C2WFR version… High Thu, 15 Sep 2022 13:20:11 GMT https://vulnogram.org/CVE-2022-2471 https://vulnogram.org/CVE-2022-2471 Stack-based Buffer Overflow vulnerability in the EZVIZ Motion Detection component as used in camera models CS-CV248, CS-C6N-A0-1C2WFR, CS-DB1C-A0-1E2W2FR, CS-C6N-B0-1G2WF, CS-C3W-A0-3H4WFRL allows a remote attacker to execute remote code on the devic… Critical Thu, 15 Sep 2022 13:15:15 GMT