983 matches found
CVE-2019-17103
An Incorrect Default Permissions vulnerability in the BDLDaemon component of Bitdefender AV for Mac allows an attacker to elevate permissions to read protected directories. This issue affects: Bitdefender AV for Mac versions prior to 8.0.0...
CVE-2019-17102
An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method /api/updatesetup does not perform firmware signature checks atomically, leading to an exploitable race condition TOCTTOU that allows arbitrary execution of system...
CVE-2019-17100
An Untrusted Search Path vulnerability in bdserviceshost.exe as used in Bitdefender Total Security 2020 allows an attacker to execute arbitrary code. This issue does not affect: Bitdefender Total Security versions prior to 24.0.12.69...
CVE-2019-17102
An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method /api/updatesetup does not perform firmware signature checks atomically, leading to an exploitable race condition TOCTTOU that allows arbitrary execution of system...
CVE-2019-17100
An Untrusted Search Path vulnerability in bdserviceshost.exe as used in Bitdefender Total Security 2020 allows an attacker to execute arbitrary code. This issue does not affect: Bitdefender Total Security versions prior to 24.0.12.69...
Design/Logic Flaw
An Incorrect Default Permissions vulnerability in the BDLDaemon component of Bitdefender AV for Mac allows an attacker to elevate permissions to read protected directories. This issue affects: Bitdefender AV for Mac versions prior to 8.0.0...
Race condition
An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method /api/updatesetup does not perform firmware signature checks atomically, leading to an exploitable race condition TOCTTOU that allows arbitrary execution of system...
Design/Logic Flaw
An Untrusted Search Path vulnerability in bdserviceshost.exe as used in Bitdefender Total Security 2020 allows an attacker to execute arbitrary code. This issue does not affect: Bitdefender Total Security versions prior to 24.0.12.69...
CVE-2019-17103
CVE-2019-17103 concerns an Incorrect Default Permissions issue in the BDLDaemon component of Bitdefender AV for Mac, enabling an attacker to elevate privileges to read protected directories. Affected software: Bitdefender AV for Mac, prior to version 8.0.0. Root cause: incorrect default permissio...
CVE-2019-17103 Get-task-allow entitlement via BDLDaemon on macOS
An Incorrect Default Permissions vulnerability in the BDLDaemon component of Bitdefender AV for Mac allows an attacker to elevate permissions to read protected directories. This issue affects: Bitdefender AV for Mac versions prior to 8.0.0...
CVE-2019-17102
The CVE-2019-17102 issue affects Bitdefender BOX 2 bootstrapping. A TOCTTOU race condition arises in the update_setup flow: POST requests to /api/update_setup acquire an atomic lock, but the parallel forked update_setup runs install_full_ws after extracting a signed full_ws.tar.gz. An attacker ca...
CVE-2019-17102 Bitdefender BOX v2 bootstrap update_setup command execution vulnerability (VA-2226)
An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method /api/updatesetup does not perform firmware signature checks atomically, leading to an exploitable race condition TOCTTOU that allows arbitrary execution of system...
CVE-2019-17100 Untrusted Search Path vulnerability in Bitdefender Total Security 2020 (VA-5895)
An Untrusted Search Path vulnerability in bdserviceshost.exe as used in Bitdefender Total Security 2020 allows an attacker to execute arbitrary code. This issue does not affect: Bitdefender Total Security versions prior to 24.0.12.69...
CVE-2019-17100
The CVE-2019-17100 entry describes an Untrusted Search Path vulnerability in bdserviceshost.exe used by Bitdefender Total Security 2020 . The issue could allow an attacker to execute arbitrary code, via a local attack vector, on affected installations. The vulnerability does not affect Bitdefende...
Vulnerability Spotlight: Bitdefender BOX 2 bootstrap remote code execution vulnerabilities
Claudio Bozzato, Lilith Wyatt and Dave McDaniel of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. The Bitdefender BOX 2 contains two remote code execution vulnerabilities in its bootstrap stage. The BOX 2 is a device that protects users’ home networks from a variety of threats...
Bitdefender Command Injection Vulnerability
BitDefender is a world-renowned antivirus program. Bitdefender has a command injection vulnerability that can be exploited by an attacker to execute system commands by mimicking an infrastructure server...
Amazon Fixes Ring Video Doorbell Flaw That Leaked Wi-Fi Credentials
UPDATE Amazon has patched a vulnerability in its Ring smart doorbell device that could allow attackers to access the owner’s Wi-Fi network credentials and potentially reconfigure the device to launch an attack on the home network, researchers have found. Researchers discovered the problem in...
CVE-2019-12612
An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that allows an attacker to pass arbitrary code to the BOX appliance via the web API. In order to exploit this vulnerability, an attacker needs presence in Bitdefender BOX setup network and Bitdefender BOX be in setup...
CVE-2019-12612
An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that allows an attacker to pass arbitrary code to the BOX appliance via the web API. In order to exploit this vulnerability, an attacker needs presence in Bitdefender BOX setup network and Bitdefender BOX be in setup...
Design/Logic Flaw
An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that allows an attacker to pass arbitrary code to the BOX appliance via the web API. In order to exploit this vulnerability, an attacker needs presence in Bitdefender BOX setup network and Bitdefender BOX be in setup...