CVE-2025-5138

CVE-2025-5138 affects Bitwarden up to version 2.25.1. The vulnerability arises in the PDF File Handler component and enables cross-site scripting. Exploitation is possible remotely and, per linked sources, the exploit has been disclosed. Several connected sources corroborate an XSS flaw and note ...

PT-2025-22853 · Bitwarden · Bitwarden

Name of the Vulnerable Software and Affected Versions: Bitwarden versions up to 2.25.1 Description: A vulnerability was found in the PDF File Handler component of Bitwarden, leading to cross-site scripting. The attack can be launched remotely, and the exploit has been disclosed to the public. The...

Bitwarden 代码注入漏洞

Bitwarden is an open source password manager from Bitwarden Inc. in the United States. A code injection vulnerability exists in Bitwarden 2.25.1 and earlier versions, which stems from a misbehavior of the component PDF File Handler resulting in cross-site scripting...

CVE-2023-27974

Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain matches, e.g., a password stored for an example.com hosting provider when customer-website.example.com is visited. NOTE: the vendor's position is that "Auto-fill on page load" is not enabled by default...

CVE-2023-38840

Bitwarden Desktop 2023.7.0 and below allows an attacker with local access to obtain sensitive information via the Bitwarden.exe process...

CVE-2023-27706

Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other local unprivileged processes...

CVE-2020-15879

Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses ones beginning with fc, fd, fe, or ff, and the :: address and certain IPv4 addresses 0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16...

CVE-2019-19766

The Bitwarden server through 1.32.0 has a potentially unwanted KDF...

CVE-2018-25081

Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element. NOTE: the vendor's position is that there have been important legitimate cross-domain configurations e.g., an apple.com IFRAME element on the icloud.com website and that "Auto-fill on page load" is not...

[SECURITY] Fedora 41 Update: vaultwarden-1.33.2-1.fc41

Unofficial Bitwarden compatible server...

[SECURITY] Fedora 40 Update: vaultwarden-1.33.2-1.fc40

Unofficial Bitwarden compatible server...

[SECURITY] Fedora 40 Update: vaultwarden-1.33.0-1.fc40

Unofficial Bitwarden compatible server...

[SECURITY] Fedora 41 Update: vaultwarden-1.33.0-1.fc41

Unofficial Bitwarden compatible server...

[SECURITY] Fedora 40 Update: vaultwarden-1.32.7-4.fc40

Unofficial Bitwarden compatible server...

[SECURITY] Fedora 41 Update: vaultwarden-1.32.7-4.fc41

Unofficial Bitwarden compatible server...

Vaultwarden 安全漏洞

Vaultwarden is an alternative implementation of the Bitwarden server API written in Rust by Daniel García Personal Developer. A security vulnerability exists in Vaultwarden versions prior to v1.32.5. An attacker exploiting this vulnerability could impersonate a user via a specially crafted...

Facebook Malvertising Campaign Spreads Malware via Fake Bitwarden

A Facebook malvertising campaign disguised as Bitwarden updates spreads malware, targeting business accounts. Users are tricked into installing…...

OPENSUSE-SU-2024:12718-1 bitwarden-2023.2.0-1.1 on GA media

These are all security issues fixed in the bitwarden-2023.2.0-1.1 package on the GA media of openSUSE Tumbleweed...

Attacks, Vulnerabilities and Actors 25 September to 1 October 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of eight executed attacks, three instances of adversary activity, and four zero-day...

ZenRAT Targeting Windows Users Through Fake Bitwarden Installs

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary ZenRAT is a new malware distributed through fake Bitwarden password manager installers, primarily targeting Windows users. It operates as a modular remote access trojan RAT with information-stealing...