HIGH🇵🇱 Wersja polska

CVE-2019-6736

CVSS 8.8v3.1pub. 2019-06-03upd. 2024-11-21

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of tiscript. When processing the System.Exec method the application does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7234.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  • Bitdefender Safepay

    APP
    Bitdefender
    23.0.10.34
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCECommand Injection
CWE
References

Related vulnerabilities

CVE-2019-6737HIGH8.8ten sam produkt

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefende...

CVE-2019-6738HIGH8.8ten sam produkt

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefende...

CVE-2020-15734MEDIUM5.5ten sam produkt

An Origin Validation Error vulnerability in Bitdefender Safepay allows an attacker to manipulate the browser's...

CVE-2025-1987CRITICAL9.3PL ✓ten sam vendor

Stored XSS w Psono Client / Bitdefender SecurePass via złośliwe URL w magazynie haseł

CVE-2025-2244CRITICAL9.5PL ✓ten sam vendor

Niebezpieczna deserializacja PHP w Bitdefender GravityZone Console (RCE)