CVE Browser

Improper link resolution before file access in Bitdefender Total Security via Link Following (VA-13681)

Out-of-bounds write in Napoca real-mode hook handler via guest-controlled SS:SP (VA-13905)

Out-of-bounds write in Napoca BIOS INT 0x15 E820 memory map handler (VA-13905)

Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security

Improper access restriction to critical folder in Bitdefender Endpoint Security Tools for Mac

Stored XSS in Psono-Client via Malicious Vault Entry URLs

Server Side Request Forgery in GravityZone Update Server Using Null Bytes (VA-12646)

SSRF in GravityZone Console via DNS Truncation (VA-12634)

Insecure PHP deserialization issue in GravityZone Console (VA-12634)

Unauthenticated Firmware Downgrade in Bitdefender Box v1

Unauthenticated Command Injection in Bitdefender BOX v1

Bitdefender Box Insecure Update Mechanism Vulnerability in libboxhermes.so

Untrusted Search Path Vulnerability in Bitdefender Antivirus Free 2020 (VA-8422)

Insufficient Hardened Runtime or Library Validation signing in Bitdefender Virus Scanner for macOS

Insecure Trust of Basic Constraints certificate in Bitdefender Total Security HTTPS Scanning (VA-11210)

Insecure Trust of certificates using collision hash functions in Bitdefender Total Security HTTPS Scanning (VA-11239)

HTTPS Certificate Validation Issue in Bitdefender Safepay (VA-11167)

Insecure Trust of DSA-Signed Certificates in Bitdefender Total Security HTTPS Scanning (VA-11166)

Insecure Trust of Self-Signed Certificates in Bitdefender Total Security HTTPS Scanning (VA-11164)

Improper Certificate Validation in Bitdefender Total Security HTTPS Scanning (VA-11158)

Verbose error handling issue in GravityZone Update Server proxy service

Host whitelist parser issue in GravityZone Console On-Premise (VA-11554)

Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-11466)

Incorrect Regular Expression in GravityZone Update Server (VA-11465)

Local privilege escalation in Bitdefender Total Security (VA-11168)