Bitdefender vulnerabilities
105 vulnerabilities
Known vulnerabilities in Bitdefender products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 61 products.
Products
50 of 61- Total Security20 vulnerabilities
- Gravityzone16 vulnerabilities
- Endpoint Security Tools13 vulnerabilities
- Internet Security11 vulnerabilities
- Antivirus Plus10 vulnerabilities
- Bitdefender8 vulnerabilities
- Antivirus7 vulnerabilities
- Engines6 vulnerabilities
- Box5 vulnerabilities
- Endpoint Security5 vulnerabilities
- Antivirus 20204 vulnerabilities
- Bitdefender Engines4 vulnerabilities
- Bitdefender Internet Security4 vulnerabilities
- Internet Security 20184 vulnerabilities
- Safepay4 vulnerabilities
- Bitdefender BOX 23 vulnerabilities
- Box 23 vulnerabilities
- BOX V13 vulnerabilities
- Endpoint Security Tools For Linux3 vulnerabilities
- Endpoint Security Tools For Windows3 vulnerabilities
- Gravityzone Update Server3 vulnerabilities
- Hypervisor Introspection3 vulnerabilities
- Scan Engines3 vulnerabilities
- Total Security 20203 vulnerabilities
- Antivirus Free2 vulnerabilities
- Bitdefender Antivirus For Mac2 vulnerabilities
- Bitdefender Total Security 20202 vulnerabilities
- Endpoint Security For Linux2 vulnerabilities
- Endpoint Security For Windows2 vulnerabilities
- Gravityzone Console2 vulnerabilities
- Gravityzone Console On Premise2 vulnerabilities
- Gravityzone Control Center2 vulnerabilities
- Gravityzone Control Center (On Premises)2 vulnerabilities
- Napoca Bare Metal Hypervisor2 vulnerabilities
- Update Server2 vulnerabilities
- Antimalware Software Development Kit1 vulnerabilities
- Antivirus Free 20201 vulnerabilities
- Bdserviceshost.Exe1 vulnerabilities
- Bitdefender Antivirus1 vulnerabilities
- Bitdefender Antivirus Free1 vulnerabilities
- Bitdefender AV For Mac1 vulnerabilities
- Bitdefender Client1 vulnerabilities
- Bitdefender Total Security 20101 vulnerabilities
- Bitdefender Update Server1 vulnerabilities
- Central1 vulnerabilities
- Endpoinit Security Tools For Windows1 vulnerabilities
- Endpoint Security For Mac1 vulnerabilities
- Endpoint Security SDK1 vulnerabilities
- Endpoint Security Tool1 vulnerabilities
- Endpoint Security Tools For Mac1 vulnerabilities
CVE-2018-18058bitdefenderscan_engines
EPSS score0.93%
An issue was discovered in Bitdefender Engines before 7.76662. A vulnerability has been discovered in the iso.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a division-by-zero circumstance. Paired with other vulnerabilities, this can result in denial-of-service. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.CVE-2018-18060bitdefenderscan_enginesEPSS score0.97%
An issue was discovered in Bitdefender Engines before 7.76808. A vulnerability has been discovered in the dalvik.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. Paired with other vulnerabilities, this can result in denial-of-service. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.CVE-2018-18059bitdefenderscan_enginesEPSS score0.97%
An issue was discovered in Bitdefender Engines before 7.76675. A vulnerability has been discovered in the rar.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. Paired with other vulnerabilities, this can result in denial-of-service. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.CVE-2018-6183bitdefendertotal_securityEPSS score0.29%
BitDefender Total Security 2018 allows local users to gain privileges or cause a denial of service by impersonating all the pipes through a use of an "insecurely created named pipe". Ensures full access to Everyone users group.CVE-2018-8955bitdefendergravityzoneEPSS score4.26%
The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installation metadata, which allows remote attackers to execute arbitrary code by changing the filename while leaving the file's digital signature unchanged.CVE-2021-4199bitdefenderantivirus_plus+4EPSS score0.76%
Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.exe as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools for Windows allows a remote attacker to escalate local privileges to SYSTEM. This issue affects: Bitdefender Total Security versions prior to 26.0.10.45. Bitdefender Internet Security versions prior to 26.0.10.45. Bitdefender Antivirus Plus versions prior to 26.0.10.45. Bitdefender Endpoint Security Tools for Windows versions prior to 7.4.3.146.CVE-2021-4198bitdefenderantivirus_plus+4EPSS score0.55%
A NULL Pointer Dereference vulnerability in the messaging_ipc.dll component as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools, VPN Standalone allows an attacker to arbitrarily crash product processes and generate crashdump files. This issue affects: Bitdefender Total Security versions prior to 26.0.3.29. Bitdefender Internet Security versions prior to 26.0.3.29. Bitdefender Antivirus Plus versions prior to 26.0.3.29. Bitdefender Endpoint Security Tools versions prior to 7.2.2.92. Bitdefender VPN Standalone versions prior to 25.5.0.48.CVE-2021-3823bitdefendergravityzone+1EPSS score1.06%
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects: Bitdefender GravityZone versions prior to 3.3.8.249.CVE-2021-3959bitdefendergravityzoneEPSS score1.74%
A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay server. This issue affects: Bitdefender Bitdefender GravityZone versions prior to 3.3.8.272CVE-2021-3960bitdefendergravityzoneEPSS score0.32%
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects Bitdefender GravityZone versions prior to 3.3.8.272CVE-2021-3552bitdefenderendpoint_security_tools+1EPSS score1.34%
A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay server. This issue affects: Bitdefender Endpoint Security Tools versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender GravityZone 6.24.1-1.CVE-2021-3576bitdefenderendpoint_security_tools+1EPSS score0.92%
Execution with Unnecessary Privileges vulnerability in Bitdefender Endpoint Security Tools, Total Security allows a local attacker to elevate to 'NT AUTHORITY\System. Impersonation enables the server thread to perform actions on behalf of the client but within the limits of the client's security context. This issue affects: Bitdefender Endpoint Security Tools versions prior to 7.2.1.65. Bitdefender Total Security versions prior to 25.0.26.CVE-2021-3485bitdefenderendpoint_security_tools+1EPSS score0.88%
An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.155.CVE-2021-3579bitdefenderendpoint_security_tools+2EPSS score0.69%
Incorrect Default Permissions vulnerability in the bdservicehost.exe and Vulnerability.Scan.exe components as used in Bitdefender Endpoint Security Tools for Windows, Total Security allows a local attacker to elevate privileges to NT AUTHORITY\SYSTEM This issue affects: Bitdefender Endpoint Security Tools for Windows versions prior to 7.2.1.65. Bitdefender Total Security versions prior to 7.2.1.65.CVE-2021-3423bitdefendergravityzone_business_securityEPSS score0.21%
Uncontrolled Search Path Element vulnerability in the openssl component as used in Bitdefender GravityZone Business Security allows an attacker to load a third party DLL to elevate privileges. This issue affects Bitdefender GravityZone Business Security versions prior to 6.6.23.329.CVE-2021-3554bitdefenderendpoint_security_tools+3EPSS score2.12%
Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.CVE-2021-3641bitdefendergravityzoneEPSS score0.35%
Improper Link Resolution Before File Access ('Link Following') vulnerability in the EPAG component of Bitdefender Endpoint Security Tools for Windows allows a local attacker to cause a denial of service. This issue affects: Bitdefender GravityZone version 7.1.2.33 and prior versions.CVE-2021-3553bitdefenderendpoint_security_tools+2EPSS score1.25%
A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService of Bitdefender Endpoint Security Tools allows an attacker to use the Endpoint Protection relay as a proxy for any remote host. This issue affects: Bitdefender Endpoint Security Tools versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint for Linux versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.CVE-2007-0391bitdefenderbitdefender_clientEPSS score0.42%
Format string vulnerability in the log creation functionality of BitDefender Client Professional Plus 8.02 allows attackers to execute arbitrary code via certain scan job settings.CVE-2007-6189bitdefenderonline_anti-virus_scannerEPSS score8.08%
A certain ActiveX control in (1) OScan8.ocx and (2) Oscan81.ocx in BitDefender Online Anti-Virus Scanner 8.0 allows remote attackers to execute arbitrary code via a long argument to the InitX method that begins with a "%%" sequence, which is misinterpreted as a Unicode string and decoded twice, leading to improper memory allocation and a heap-based buffer overflow.