HIGH🇬🇧 English

CVE-2019-6738

CVSS 8.8v3.1pub. 2019-06-03upd. 2024-11-21

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of TIScript. When processing the launch method the application does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability execute code in the context of the current process. Was ZDI-CAN-7250.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  • Bitdefender Safepay

    APP
    Bitdefender
    23.0.10.34
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
RCECommand Injection
CWE
Referencje

Powiązane podatności

CVE-2019-6736HIGH8.8ten sam produkt

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefende...

CVE-2019-6737HIGH8.8ten sam produkt

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefende...

CVE-2020-15734MEDIUM5.5ten sam produkt

An Origin Validation Error vulnerability in Bitdefender Safepay allows an attacker to manipulate the browser's...

CVE-2025-1987CRITICAL9.3PL ✓ten sam vendor

Stored XSS w Psono Client / Bitdefender SecurePass via złośliwe URL w magazynie haseł

CVE-2025-2244CRITICAL9.5PL ✓ten sam vendor

Niebezpieczna deserializacja PHP w Bitdefender GravityZone Console (RCE)