Advisories · Technology
Bitdefender GravityZone.
Every CVE that names Bitdefender GravityZone among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
Improper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144)
- Bitdefender Update Server
- Bitdefender GravityZone
- CWE-130
- CVSS 7.1 High
Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-10146)
- Bitdefender GravityZone
- Path traversal
- CVSS 6.8 Medium
Server-Side Request Forgery in Bitdefender GravityZone Update Server in Relay Mode (VA-10145)
- Bitdefender GravityZone
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
Server-Side Request Forgery in EPPUpdateService remote config file (VA-9825)
- Bitdefender Endpoint Security Tools
- Bitdefender Unified Endpoint for Linux
- Server-side request forgery (SSRF)
- CVSS 9.0 CriticalCritical · CVSS 9+
Improper Access Control vulnerability in the patchesUpdate API
- Bitdefender Endpoint Security Tools for Linux
- Bitdefender Unified Endpoint
- Broken access control
- CVSS 5.3 Medium
Insufficient validation on regular expression in EPPUpdateService config file (VA-9825)
- Bitdefender Endpoint Security Tools
- Bitdefender GravityZone
- Server-side request forgery (SSRF)
- CVSS 6.1 Medium
Improper Link Resolution Before File Access in Bitdefender GravityZone (VA-9921)
- Bitdefender GravityZone
- Path traversal