Bitwarden server encryption issue vulnerability

Bitwarden is an open source password manager.Bitwarden server is the core infrastructure of Bitwarden back-end server . A cryptographic vulnerability exists in Bitwarden server version 1.32.0 and earlier versions. The vulnerability stems from a network system or product that does not properly use...

CVE-2019-19766

The Bitwarden server through 1.32.0 has a potentially unwanted KDF...

CVE-2019-19766

The Bitwarden server through 1.32.0 has a potentially unwanted KDF...

Code injection

The Bitwarden server through 1.32.0 has a potentially unwanted KDF...

CVE-2019-19766

The Bitwarden server through 1.32.0 has a potentially unwanted KDF...

CVE-2019-19766

CVE-2019-19766 affects Bitwarden server 1.32.0 and earlier, with a cryptographic issue described as a potentially unwanted KDF. Connected sources (CNVD, RH, NVD, OSV, OSV) identify Bitwarden server as the affected product and versions ≤1.32.0; the CVSS vectors indicate Confidentiality impact (per...

Bitwarden: Tracking Bitwarden firefox addon users

Firefox web extension, generate a UUID for each web-extension and is specific to a user. Unlike chrome extensions. Which means whenever the user installs Bitwarden on Firefox, it generates a different extension ID for each user. You can check the extension ID by about:debugging - under extensions...

Bitwarden: Vulnerable exported broadcast receiver

Good evening, This is actually in your code base this time. : Since the following broadcast receiver has export=true it can be exploited by 3rd parties. Vulnerability com.x8bit.bitwarden.PackageReplacedReceiver has exported set to true making the receiver vulnerable to tampering. F238236 POC I wa...

Bitwarden: Export vault feature is vulnerable to CSV injection

Hello guys I don't know if you care about this issue but it seems that the export feature in your https://vault.bitwarden.com//tools is vulnerable to CSV injection. If a CSV contains a malicious command it may have big impact Even though there is a popup notification for users before opening the...