CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-18059
https://notcve.org/view.php?id=CVE-2018-18059
An issue was discovered in Bitdefender Engines before 7.76675. A vulnerability has been discovered in the rar.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. Paired with other vulnerabilities, this can result in denial-of-service. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. Fue encontrado un problema en Bitdefender Engines en versiones anteriores a la 7.76675. • https://www.bitdefender.com https://www.bitdefender.com/support/security-advisories/bitdefender-rar-xmd-rar-parsing-bounds-read-vulnerability • CWE-125: Out-of-bounds Read •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-18060
https://notcve.org/view.php?id=CVE-2018-18060
An issue was discovered in Bitdefender Engines before 7.76808. A vulnerability has been discovered in the dalvik.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. Paired with other vulnerabilities, this can result in denial-of-service. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. Fue encontrado un problema en Bitdefender Engines en versiones anteriores a la 7.76808. • https://www.bitdefender.com https://www.bitdefender.com/support/security-advisories/bitdefender-dalvik-xmd-apk-parsing-bounds-read-vulnerability • CWE-125: Out-of-bounds Read •
CVSS: 8.8EPSS: 2%CPEs: 1EXPL: 0CVE-2019-6736 – Bitdefender SafePay exec Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-6736
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of tiscript. When processing the System.Exec method the application does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://www.bitdefender.com/support/security-advisories/bitdefender-safepay-exec-command-injection-remote-code-execution-vulnerability https://www.zerodayinitiative.com/advisories/ZDI-19-157 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-356: Product UI does not Warn User of Unsafe Actions •
CVSS: 8.8EPSS: 3%CPEs: 1EXPL: 0CVE-2019-6737 – Bitdefender SafePay openFile Arbitrary File Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-6737
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of TIScript. The issue lies in the handling of the openFile method, which allows for an arbitrary file write with attacker controlled data. An attacker can leverage this vulnerability execute code in the context of the current process. • https://www.bitdefender.com/support/security-advisories/bitdefender-safepay-openfile-arbitrary-file-write-remote-code-execution-vulnerability https://www.zerodayinitiative.com/advisories/ZDI-19-158 • CWE-356: Product UI does not Warn User of Unsafe Actions •
CVSS: 8.8EPSS: 2%CPEs: 1EXPL: 0CVE-2019-6738 – Bitdefender SafePay launch Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-6738
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of TIScript. When processing the launch method the application does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability execute code in the context of the current process. • https://www.bitdefender.com/support/security-advisories/bitdefender-safepay-launch-remote-code-execution-vulnerability https://www.zerodayinitiative.com/advisories/ZDI-19-159 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-356: Product UI does not Warn User of Unsafe Actions •