Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
290 results · page 2 of 6
Apr 4, 2025A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplieCVE-2025-2244 · Other software · Bitdefender · reported by cve-requests@bitdefender.comCritical 9.5
A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplied input without validation. By crafting a malicious serialized payload, an attacker can trigger PHP object injection, perform a file write, and gain arbitrary command execution on the host system.
- Product
- GravityZone Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading characteCVE-2025-2243 · Other software · Bitdefender · reported by cve-requests@bitdefender.comMedium 6.9
A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading characters in DNS requests. Paired with other potential vulnerabilities, this bypass could be used for execution of third party code. This issue affects GravityZone Console: before 6.41.2.1.
- Product
- GravityZone Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2025Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and CVE-2024-13872 · Other software · Bitdefender · reported by cve-requests@bitdefender.comCritical 9.4
Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and detection rules on the devices. Updates can be remotely triggered through the /set_temp_token API method. Then, an unauthenticated and network-adjacent attacker can use man-in-the-middle (MITM) techniques to return malicious responses. Restarted daemons that use malicious assets can then be exploited for remote code execution on the device.
- Product
- BOX v1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2025A command injection vulnerability exists in the /check_image_and_trigger_recovery API endpoint of Bitdefender Box 1 (firmware version 1.3.11.490).CVE-2024-13871 · Other software · Bitdefender · reported by cve-requests@bitdefender.comCritical 9.4
A command injection vulnerability exists in the /check_image_and_trigger_recovery API endpoint of Bitdefender Box 1 (firmware version 1.3.11.490). This flaw allows an unauthenticated, network-adjacent attacker to execute arbitrary commands on the device, potentially leading to full remote code execution (RCE).
- Product
- BOX v1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2025An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgradCVE-2024-13870 · Other software · Bitdefender · reported by cve-requests@bitdefender.comLow 1.8
An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, potentially vulnerable version of a Bitdefender-signed firmware. The attack requires Bitdefender BOX to be booted in Recovery Mode and that the attacker be present within the WiFi range of the BOX unit.
- Product
- BOX v1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2025In OPSWAT MetaDefender Kiosk before 4.7.0, arbitrary code execution can be performed by an attacker via the MD Kiosk Unlock Device feature for software encrypteCVE-2024-52925 · Other software · OPSWAT · reported by MITREMedium 6.8
In OPSWAT MetaDefender Kiosk before 4.7.0, arbitrary code execution can be performed by an attacker via the MD Kiosk Unlock Device feature for software encrypted USB drives.
- Product
- MetaDefender Kiosk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2025Improper input validation in AMD Crash Defender could allow an attacker to provide the Windows® system process ID to a kernel-mode driver, resulting in an operaCVE-2024-21971 · Other software · AMD · reported by psirt@amd.comMedium 5.5
Improper input validation in AMD Crash Defender could allow an attacker to provide the Windows® system process ID to a kernel-mode driver, resulting in an operating system crash, potentially leading to denial of service.
- Product
- AMD Ryzen™ 5000 Series Desktop Processors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI could allow a remote attacker to obtain sensitive information, caused by sending netwCVE-2024-38325 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI could allow a remote attacker to obtain sensitive information, caused by sending network requests over an insecure channel. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
- Product
- Storage Defender - Resiliency Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2025An untrusted search path vulnerability in testinitsigs.exe as used in Bitdefender Antivirus Free 2020 allows a low-privilege attacker to execute code as SYSTEM CVE-2020-8094 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.8
An untrusted search path vulnerability in testinitsigs.exe as used in Bitdefender Antivirus Free 2020 allows a low-privilege attacker to execute code as SYSTEM via a specially crafted DLL file.
- Product
- Antivirus Free 2020
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025A vulnerability in the BitdefenderVirusScanner binary as used in Bitdefender Virus Scanner for MacOS may allow .dynamic library injection (DYLD injection) withoCVE-2024-11128 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.4
A vulnerability in the BitdefenderVirusScanner binary as used in Bitdefender Virus Scanner for MacOS may allow .dynamic library injection (DYLD injection) without being blocked by AppleMobileFileIntegrity (AMFI). This issue is caused by the absence of Hardened Runtime or Library Validation signing. This issue affects Bitdefender Virus Scanner versions before 3.18.
- Product
- Virus Scanner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 stores user credentials in plain text which can be read by an authenticated user with access CVE-2024-52361 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.7
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 stores user credentials in plain text which can be read by an authenticated user with access to the pod.
- Product
- Storage Defender - Resiliency Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 does not properly validate a certificate which could allow an attacker to spoof a trusted entity bCVE-2024-47119 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 does not properly validate a certificate which could allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client.
- Product
- Storage Defender - Resiliency Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 could allow a privileged user to obtain highly sensitive user credentials from secret keys that CVE-2023-50956 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.4
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9 could allow a privileged user to obtain highly sensitive user credentials from secret keys that are stored in clear text.
- Product
- Storage Defender - Resiliency Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Improper authorization of an index that contains sensitive information from a Global Files search in Windows Defender allows an authorized attacker to disclose CVE-2024-49071 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Improper authorization of an index that contains sensitive information from a Global Files search in Windows Defender allows an authorized attacker to disclose information over a network.
- Product
- Microsoft Defender for Endpoint for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2024Microsoft Defender for Endpoint on Android Spoofing VulnerabilityCVE-2024-49057 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Microsoft Defender for Endpoint on Android Spoofing Vulnerability
- Product
- Microsoft Defender for Endpoint for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2024Windows Defender Application Control (WDAC) Security Feature Bypass VulnerabilityCVE-2024-43645 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.7
Windows Defender Application Control (WDAC) Security Feature Bypass Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024Defender Security: Missing AuthorizationCVE-2024-37444 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Defender Security defender-security.This issue affects Defender Security: from n/a through <= 4.7.1.
- Product
- Defender Security
- Affected
- up to 4.7.1
- What to do
- Affects up to 4.7.1. Update Defender Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 18, 2024A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that CVE-2023-49570 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.6
A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that isn't authorized to issue certificates. This occurs when the "Basic Constraints" extension in the certificate indicates that it is meant to be an "End Entity”. This flaw could allow an attacker to perform a Man-in-the-Middle (MITM) attack, intercepting and potentially altering communications between the user and the website.
- Product
- Total Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024A vulnerability has been identified in Bitdefender Safepay's handling of HTTPS connections.CVE-2023-6058 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.6
A vulnerability has been identified in Bitdefender Safepay's handling of HTTPS connections. The issue arises when the product blocks a connection due to an untrusted server certificate but allows the user to add the site to exceptions, resulting in the product trusting the certificate for subsequent HTTPS scans. This vulnerability allows an attacker to perform a Man-in-the-Middle (MITM) attack by using a self-signed certificate, which the product will trust after the site has been added to exceptions. This can lead to the interception and potential alteration of secure communications.
- Product
- Total Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of certificates issued using tCVE-2023-6057 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.6
A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of certificates issued using the DSA signature algorithm. The product does not properly check the certificate chain, allowing an attacker to establish MITM SSL connections to arbitrary sites using a DSA-signed certificate.
- Product
- Total Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of self-signed certificates.CVE-2023-6056 · Other software · BItdefender · reported by cve-requests@bitdefender.comHigh 8.6
A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of self-signed certificates. The product is found to trust certificates signed with the RIPEMD-160 hashing algorithm without proper validation, allowing an attacker to establish MITM SSL connections to arbitrary sites.
- Product
- Total Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software fails to properly validate website certificateCVE-2023-6055 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.6
A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software fails to properly validate website certificates. Specifically, if a site certificate lacks the "Server Authentication" specification in the Extended Key Usage extension, the product does not verify the certificate's compliance with the site, deeming such certificates as valid. This flaw could allow an attacker to perform a Man-in-the-Middle (MITM) attack, intercepting and potentially altering communications between the user and the website.
- Product
- Total Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2024A vulnerability has been identified in the Bitdefender Total Security HTTPS scanning functionality where the product incorrectly checks the site's certificate, CVE-2023-49567 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.6
A vulnerability has been identified in the Bitdefender Total Security HTTPS scanning functionality where the product incorrectly checks the site's certificate, which allows an attacker to make MITM SSL connections to an arbitrary site. The product trusts certificates that are issued using the MD5 and SHA1 collision hash functions which allow attackers to create rogue certificates that appear legitimate.
- Product
- Total Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2024Relative path traversal in Microsoft Defender for Endpoint allows an authorized attacker to perform spoofing locally.CVE-2024-43614 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Relative path traversal in Microsoft Defender for Endpoint allows an authorized attacker to perform spoofing locally.
- Product
- Microsoft Defender for Endpoint for Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2024IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI does not validate server name during registration and unregistration operations which cCVE-2024-38324 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.9
IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI does not validate server name during registration and unregistration operations which could expose sensitive information to an attacker with access to the system.
- Product
- Storage Defender - Resiliency Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery.CVE-2024-6980 · Other software · Bitdefender · reported by cve-requests@bitdefender.comCritical 9.2
A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-5 running only on premise.
- Product
- GravityZone Update Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Microsoft Defender for IoT Elevation of Privilege VulnerabilityCVE-2024-38089 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.1
Microsoft Defender for IoT Elevation of Privilege Vulnerability
- Product
- Microsoft Defender for IoT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Jun 28, 2024IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration.CVE-2024-38322 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: 294869.
- Product
- Storage Defender - Resiliency Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 28, 2024IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 uses an inadequate account lockout setting that could allow an attacker on the network to brute foCVE-2024-25031 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 uses an inadequate account lockout setting that could allow an attacker on the network to brute force account credentials. IBM X-Force ID: 281678.
- Product
- Storage Defender - Resiliency Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jun 6, 2024A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery.CVE-2024-4177 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.1
A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-2 that are running only on premise.
- Product
- GravityZone Console On-Premise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.comcve.org
Jun 4, 2024Defender Security: Improper AuthenticationCVE-2023-47189 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Improper Authentication vulnerability in WPMU DEV Defender Security allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Defender Security: from n/a through 4.2.0.
- Product
- Defender Security
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update Defender Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 3, 2024Incorrect access control in the fingerprint authentication mechanism of Bitdefender Mobile Security v4.11.3-gms allows attackers to bypass fingerprint authenticCVE-2024-31684 · Other software · reported by MITRELow 3.5
Incorrect access control in the fingerprint authentication mechanism of Bitdefender Mobile Security v4.11.3-gms allows attackers to bypass fingerprint authentication due to the use of a deprecated API.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordplay.google.comzzzxiin.github.io
May 17, 2024Defender Security: Authentication Bypass by SpoofingCVE-2024-25595 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authentication Bypass by Spoofing vulnerability in WPMU DEV Defender Security allows Functionality Bypass.This issue affects Defender Security: from n/a through 4.4.1.
- Product
- Defender Security
- Affected
- up to 4.4.1
- What to do
- Affects up to 4.4.1. Update Defender Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 17, 2024Defender Security: Insecure Storage of Sensitive InformationCVE-2022-44581 · WordPress plugins & themes · reported by PatchstackMedium 5
Insecure Storage of Sensitive Information vulnerability in WPMU DEV Defender Security allows : Screen Temporary Files for Sensitive Information.This issue affects Defender Security: from n/a through 3.3.2.
- Product
- Defender Security
- Affected
- up to 3.3.2
- What to do
- Affects up to 3.3.2. Update Defender Security to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Apr 12, 2024IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.2 could allow a privileged user to install a potentially dangerous tar file, which could give them aCVE-2024-27261 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.4
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.2 could allow a privileged user to install a potentially dangerous tar file, which could give them access to subsequent systems where the package was installed. IBM X-Force ID: 283986.
- Product
- Storage Defender
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Apr 9, 2024Microsoft Defender for IoT Elevation of Privilege VulnerabilityCVE-2024-29055 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Microsoft Defender for IoT Elevation of Privilege Vulnerability
- Product
- Microsoft Defender for IoT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Microsoft Defender for IoT Elevation of Privilege VulnerabilityCVE-2024-29054 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Microsoft Defender for IoT Elevation of Privilege Vulnerability
- Product
- Microsoft Defender for IoT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Microsoft Defender for IoT Remote Code Execution VulnerabilityCVE-2024-29053 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft Defender for IoT Remote Code Execution Vulnerability
- Product
- Microsoft Defender for IoT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Windows Defender Credential Guard Elevation of Privilege VulnerabilityCVE-2024-26237 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Defender Credential Guard Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Microsoft Defender for IoT Elevation of Privilege VulnerabilityCVE-2024-21324 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Microsoft Defender for IoT Elevation of Privilege Vulnerability
- Product
- Microsoft Defender for IoT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Microsoft Defender for IoT Remote Code Execution VulnerabilityCVE-2024-21323 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Microsoft Defender for IoT Remote Code Execution Vulnerability
- Product
- Microsoft Defender for IoT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Microsoft Defender for IoT Remote Code Execution VulnerabilityCVE-2024-21322 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.2
Microsoft Defender for IoT Remote Code Execution Vulnerability
- Product
- Microsoft Defender for IoT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 9, 2024Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an CVE-2024-2224 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.1
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects the following products that include the vulnerable component: Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1
- Product
- GravityZone Control Center (On Premises)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
Apr 9, 2024An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigureCVE-2024-2223 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 8.1
An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay. This issue affects the following products that include the vulnerable component: Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1
- Product
- GravityZone Control Center (On Premises)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
Apr 1, 2024A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender AntCVE-2023-6154 · Other software · Bitdefender · reported by cve-requests@bitdefender.comHigh 7.8
A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows an attacker to change the product's expected behavior and potentially load a third-party library upon execution. This issue affects Total Security: 27.0.25.114; Internet Security: 27.0.25.114; Antivirus Plus: 27.0.25.114; Antivirus Free: 27.0.25.114.
- Product
- Total Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbitdefender.combitdefender.com
Mar 27, 2024Opswat Metadefender Core before 5.2.1 does not properly defend against potential HTML injection and XSS attacks.CVE-2023-25364 · Other software · reported by MITREMedium 6.1
Opswat Metadefender Core before 5.2.1 does not properly defend against potential HTML injection and XSS attacks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.opswat.comdocs.opswat.com
Mar 12, 2024Microsoft Defender Security Feature Bypass VulnerabilityCVE-2024-20671 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Microsoft Defender Security Feature Bypass Vulnerability
- Product
- Windows Defender Antimalware Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 13, 2024Microsoft Defender for Endpoint Protection Elevation of Privilege VulnerabilityCVE-2024-21315 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Microsoft Defender for Endpoint Protection Elevation of Privilege Vulnerability
- Product
- Microsoft Defender for Endpoint for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Feb 10, 2024IBM Storage Defender - Resiliency Service 2.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authenCVE-2024-22313 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.2
IBM Storage Defender - Resiliency Service 2.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 278749.
- Product
- Storage Defender - Resiliency Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Feb 10, 2024IBM Storage Defender - Resiliency Service 2.0 stores user credentials in plain clear text which can be read by a local user.CVE-2024-22312 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.4
IBM Storage Defender - Resiliency Service 2.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 278748.
- Product
- Storage Defender - Resiliency Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.