CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-38840
https://notcve.org/view.php?id=CVE-2023-38840
Bitwarden Desktop 2023.7.0 and below allows an attacker with local access to obtain sensitive information via the Bitwarden.exe process. Bitwarden Desktop 2023.7.0 e inferiores permiten a un atacante con acceso local obtener información sensible a través del proceso Bitwarden.exe. • https://github.com/bitwarden/clients/pull/5813 https://github.com/bitwarden/desktop/issues/476 https://github.com/markuta/bw-dump https://redmaple.tech/blogs/2023/extract-bitwarden-vault-passwords •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27706
https://notcve.org/view.php?id=CVE-2023-27706
Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other local unprivileged processes. • https://github.com/bitwarden/clients https://github.com/bitwarden/clients/blob/8b5a223ad4ca0f89b6c9bcdbddef464d1755d2c0/apps/desktop/desktop_native/src/biometric/windows.rs#L19 https://github.com/bitwarden/clients/blob/8b5a223ad4ca0f89b6c9bcdbddef464d1755d2c0/apps/desktop/desktop_native/src/password/windows.rs#L16 https://hackerone.com/reports/1874155 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27974
https://notcve.org/view.php?id=CVE-2023-27974
Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain matches, e.g., a password stored for an example.com hosting provider when customer-website.example.com is visited. NOTE: the vendor's position is that "Auto-fill on page load" is not enabled by default. • https://flashpoint.io/blog/bitwarden-password-pilfering https://github.com/bitwarden/clients/releases https://news.ycombinator.com/item?id=35075861 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-25081
https://notcve.org/view.php?id=CVE-2018-25081
Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element. NOTE: the vendor's position is that there have been important legitimate cross-domain configurations (e.g., an apple.com IFRAME element on the icloud.com website) and that "Auto-fill on page load" is not enabled by default. • https://cdn.bitwarden.net/misc/Bitwarden%20Security%20Assessment%20Report.pdf https://flashpoint.io/blog/bitwarden-password-pilfering https://github.com/bitwarden/clients/releases https://news.ycombinator.com/item?id=35075861 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-15879
https://notcve.org/view.php?id=CVE-2020-15879
Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain IPv4 addresses (0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16). Bitwarden Server versión 1.35.1, permite un ataque de tipo SSRF porque no considera determinadas direcciones IPv6 (las que comienzan con fc, fd, fe o ff, y la dirección ::) y determinadas direcciones IPv4 (0.0.0.0/8, 127.0.0.0/8 y 169.254.0.0/16) • https://github.com/bitwarden/server/pull/827 • CWE-918: Server-Side Request Forgery (SSRF) •