Bitdefender Engines rar.xmd Parser Out-of-Bounds Read Vulnerability

Bitdefender Engines is an antivirus engine from the Romanian company Bitdefender. An out-of-bounds read vulnerability exists in the rar.xmd parser in Bitdefender Engines versions prior to 7.76675, which can be exploited by an attacker to cause a buffer overflow or heap overflow...

New GandCrab Decryptor Unlocks Files of Updated Ransomware

Yet another free decryptor is available for GandCrab ransomware victims. The tool, released Tuesday, is the third decryptor update in the past year that thwarts the prolific and fast-evolving GandCrab ransomware. Europol police announced availability of the update, which now unlocks data encrypte...

Bitdefender SafePay exec Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processi...

Bitdefender SafePay launch Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processi...

PT-2019-18297 · Bitdefender · Bitdefender Safepay

Name of the Vulnerable Software and Affected Versions: Bitdefender SafePay version 23.0.10.34 Description: This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious file...

Bitdefender SafePay openFile Arbitrary File Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processi...

Bitdefender BOX 2 bootstrap update_setup command execution vulnerability

Summary An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method /api/updatesetup does not perform firmware signature checks atomically, leading to an exploitable race condition TOCTTOU that allows arbitrary execution o...

Bitdefender BOX 2 bootstrap download_image command injection vulnerability

Summary An exploitable command injection vulnerability exists in the bootstrap stage of Bitdefender BOX 2, versions 2.1.47.42 and 2.1.53.45. The API method /api/downloadimage unsafely handles the production firmware URL supplied by remote servers, leading to arbitrary execution of system commands...

CVE-2017-8931

Bitdefender GravityZone VMware appliance before 6.2.1-35 might allow attackers to gain access with root privileges via unspecified vectors...

Design/Logic Flaw

Bitdefender GravityZone VMware appliance before 6.2.1-35 might allow attackers to gain access with root privileges via unspecified vectors...

CVE-2017-8931

The CVE-2017-8931 entry affects the Bitdefender GravityZone VMware appliance prior to version 6.2.1-35, where an attacker could gain root privileges via unspecified vectors. The NVD entry lists a CVSSv3 base score of 9.8 (CRITICAL) with network attack vector and privileges required: none. Connect...

CVE-2017-8931

Bitdefender GravityZone VMware appliance before 6.2.1-35 might allow attackers to gain access with root privileges via unspecified vectors...

bitdefendermyanmar.com XSS vulnerability

Open Bug Bounty ID: OBB-692606 Description| Value ---|--- Affected Website:| bitdefendermyanmar.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

bitdefender.com.kh XSS vulnerability

Open Bug Bounty ID: OBB-692604 Description| Value ---|--- Affected Website:| bitdefender.com.kh Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidd...

CVE-2018-8955

The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installation metadata, which allows remote attackers to execute arbitrary code by changing the filename while leaving the file's digital signature unchanged...

CVE-2018-8955

The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installation metadata, which allows remote attackers to execute arbitrary code by changing the filename while leaving the file's digital signature unchanged...

CVE-2018-8955

The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installation metadata, which allows remote attackers to execute arbitrary code by changing the filename while leaving the file's digital signature unchanged...

CVE-2018-8955

CVE-2018-8955 affects the BitDefender GravityZone installer. The root cause is that the installer relies on an encoded string in a filename to determine the URL for installation metadata, allowing a remote attacker to execute arbitrary code by changing the filename while the file’s digital signat...

Bitdefender GravityZone Arbitrary Code Execution Vulnerability

Bitdefender GravityZone is a security solution for enterprise control and protection. An arbitrary code execution vulnerability exists in Bitdefender GravityZone, which can be exploited by an attacker to execute arbitrary code...

New Android Malware Framework Turns Apps Into Powerful Spyware

Security researchers have uncovered a new, powerful Android malware framework that is being used by cybercriminals to turn legitimate apps into spyware with extensive surveillance capabilities—as part of what seems to be a targeted espionage campaign. Legitimate Android applications when bundled...