PT-2023-21465 · Bitwarden · Bitwarden

Name of the Vulnerable Software and Affected Versions: Bitwarden versions through 2023.2.1 Description: The issue allows password auto-fill when the second-level domain matches. For example, a password stored for an example.com hosting provider will be auto-filled when visiting...

Bitwarden 安全漏洞

Bitwarden is an open source password manager from Bitwarden Inc. in the United States. A security vulnerability exists in Bitwarden version 2023.2.1 and prior versions, which stems from providing password autofill when matching on a secondary domain...

CVE-2018-25081

CVE-2018-25081 concerns Bitwarden up to version 2023.2.1, where password auto-fill can occur within a cross-domain IFRAME element. The issue is described across multiple records as a cross-domain auto-fill risk, with the vendor noting legitimate use cases (e.g., apple.com in an icloud.com IFRAME)...

CVE-2023-27974: Undefined Security Weakness

Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain matches, e.g., a password stored for an example.com hosting provider when customer-website.example.com is visited. NOTE: the vendor's position is that "Auto-fill on page load" is not enabled by default...

CVE-2023-27974

Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain matches, e.g., a password stored for an example.com hosting provider when customer-website.example.com is visited. NOTE: the vendor's position is that "Auto-fill on page load" is not enabled by default...

CVE-2023-27974

Bitwarden (versions up to 2023.2.1) is affected by a domain-matching password autofill issue: when visiting a subdomain like customer-website.example.com, a stored password for example.com may be auto-filled due to second-level domain matching. The vendor notes that “Auto-fill on page load” is no...

CVE-2023-27974

Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain matches, e.g., a password stored for an example.com hosting provider when customer-website.example.com is visited. NOTE: the vendor's position is that "Auto-fill on page load" is not enabled by default...

Bitwarden: Biometric key is stored in Windows Credential Manager, accessible to other local unprivileged processes

A vulnerability in Bitwarden Desktop for Windows allowed a local attacker to access the biometric master key used for unlocking the vault through Windows Hello. The key was stored in plaintext in the Windows Credential Manager, accessible to any local unprivileged process. This allowed an attacke...

MAL-2022-1599 Malicious code in bitwarden-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75d973d875982986eb99ad1eeecd1b5f9684d77f50ba4f8e42a77b68b02fc30c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bitwarden-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75d973d875982986eb99ad1eeecd1b5f9684d77f50ba4f8e42a77b68b02fc30c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Bitwarden: When uploading attachments, unencrypted file names are made available to the server

Certain Bitwarden clients were inadvertently posting raw filenames to the server when saving new attachments. The server was discarding this value and properly storing the encrypted filename, however, a malicious server could glean some information from the filename if it were inclined. The issue...

Bitwarden: Rate limits too low for email 2FA

NO RATE LIMIT ON 2FA CAN LEAD TO ACCOUNT COMPROMISE! 1. Create account on vault.bitwarden.com if you don't have. 2.Setup 2FA via email 3.Logout and log in again. This time along with password you have to fill the 2fa code which is sent to the email. 4.Type Any Random number, intercept request wit...

Bitwarden Server Code Issue Vulnerability

Bitwarden is a U.S. Bitwarden company's open source password manager. Bitwarden server is Bitwarden's core infrastructure back-end server. A code issue vulnerability exists in Bitwarden Server version 1.35.1. A remote attacker can exploit this vulnerability to obtain sensitive data with the help ...

CVE-2020-15879

Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses ones beginning with fc, fd, fe, or ff, and the :: address and certain IPv4 addresses 0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16...

CVE-2020-15879

Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses ones beginning with fc, fd, fe, or ff, and the :: address and certain IPv4 addresses 0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16...

Server side request forgery (ssrf)

Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses ones beginning with fc, fd, fe, or ff, and the :: address and certain IPv4 addresses 0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16...

CVE-2020-15879

Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses ones beginning with fc, fd, fe, or ff, and the :: address and certain IPv4 addresses 0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16...

CVE-2020-15879

Bitwarden Server 1.35.1 is affected by CVE-2020-15879: it allows SSRF because it does not consider certain IPv6 addresses (fc*/fd*/fe*/ff* and the :: address) and certain IPv4 addresses (0.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16). The connected sources confirm a SSRF issue in Bitwarden Server, but e...

CVE-2020-15879: Server-Side Request Forgery (SSRF)

Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses ones beginning with fc, fd, fe, or ff, and the :: address and certain IPv4 addresses 0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16...

Bitwarden: Blind HTTP GET SSRF via website icon fetch (bypass of pull#812)

After a credential has been added to vault.bitwarden.com or any self-hosted installation, if the settings allow website icons to be fetched https://bitwarden.com/help/article/website-icons/, the Bitwarden server will try to fetch the icon image. The relevant source code is...