- Top reward
- $15,000
- Top severity paid
- Critical
- Assets in scope
- 5
- Public CVEs
- 60
- Last change
At a glance
What to know before you start testing.
- Pays up to $15,000
- for critical bugs, from $100.
- Report on Bugcrowd
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Public disclosure allowed
- You may publish your report.
Rewards
What Bugcrowd lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$15,000 from $3,500 |
| High |
|
$5,000 from $1,500 |
| Medium |
|
$1,000 from $200 |
| Low |
|
$500 from $100 |
- Safe harbor
-
Full
Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Earlier reward tables (1)
- 11 Nov 2026 to 11 Nov 2026: Critical up to $15,000
Scope
5 assets you may test, 24 excluded.
Wildcard domains 2
- *.bitdefender.com
- *.bitdefender.net
Products and areas 3
- Bitdefender Antimalware Engines
- Bitdefender Total Security
- https://www.bitdefender.com/business/smb-products/business-security.html?cid=ppc|b|google|smb&s_kwcid=AL!6076!3!514235572261!p!!g!!bitdefender%20business&utm_term=bitdefender%20business&utm_campaign=USA+SMB+Branded+30&utm_source=adwords&utm_medium=ppc&hsa_acc=8155205354&hsa_cam=7848657822&hsa_grp=124745713150&hsa_ad=514235572261&hsa_src=g&hsa_tgt=kwd-308396066873&hsa_kw=bitdefender%20business&hsa_mt=p&hsa_net=adwords&hsa_ver=3&gclid=CjwKCAjwqIiFBhAHEiwANg9szk-Rr3iSn4mrwsvAUOn-pzrO12ufWDmyCLopWigaLQW0t_xtlBE65RoCr6kQAvD_BwE
Out of scope (24)
- brand.bitdefender.com
- businessemail.bitdefender.com
- businessinsights.bitdefender.com
- businessresources.bitdefender.com
- community.bitdefender.com
- crp.bitdefender.com
- demo.bitdefender.com
- explore.bitdefender.com
- explore-lb.bitdefender.com
- lsems.gravityzone.bitdefender.com
- oemhub.bitdefender.com
- oemresources.bitdefender.com
- partner-marketing.bitdefender.com
- resellerportal.bitdefender.com
- seems.gravityzone.bitdefender.com
- ssems.gravityzone.bitdefender.com
- sstats.bitdefender.com
- stats.bitdefender.com
- telcosuccess.bitdefender.com
- translate.bitdefender.com
- trust.bitdefender.com
- workflow.bitdefender.com
- workflow-dev.bitdefender.com
- workflow-test.bitdefender.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Bitdefender (via Bugcrowd)'s policy. "We" in these lines means the program, not this site.
While testing
-
When experimenting, please only attack test accounts you control.
-
Automated vulnerability scans are strictly prohibited.
-
In any way, do not attack our end users, or engage in the trade of stolen user credentials.
-
For authenticated testing please self-provision utilizing your @bugcrowdninja address or an email that clearly identifies you as a researcher.
-
No payment or promotional codes will be provided for testing purposes.
-
Please refrain from testing contact forms or inputs that would result in a large amount of spam.
Not accepted
-
Self XSS or other types of self-exploitation (cookie reuse, self DoS, self-cookie-bomb, etc.)
-
Descriptive error messages (e.g., stack traces, application or server errors).
-
Email spoofing issues (incomplete or lack of SPF, DMARC, DKIM records)
-
Out of date software versions
-
Content Spoofing
-
Vulnerabilities that are limited to unsupported browsers or operating systems
-
Password policies not enforced on user accounts
-
Clickjacking or any issue exploitable through clickjacking
-
Vulnerabilities in third-party software.
-
Lack of Secure and HTTPOnly cookie flags.
-
Username / email enumeration
-
CORS issues without a working PoC
-
Login or Forgot Password page brute force and account lockout not enforced
-
CSRF issues that have no security impact
-
Antimalware detections bypass or undetected malware samples
-
Local privilege elevation on GravityZone On-Premises OS
-
Missing HTTP security headers
-
TLS/SSL Issues, bad cipher suite, expired certificates, etc.
-
Internal IP address disclosure
-
Reports of spam (i.e., any report involving ability to send emails without rate limits).
-
Pre-Authentication Account Takeover
-
Mobile issues that require root access or unsupported OS versions
-
Non-sensitive exposed API keys (Google Maps, etc.).
-
Failure to invalidate session on password change or MFA change.
Summarised with AI from the program policy on Bugcrowd, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
trust.bitdefender.com (out of scope)
-
Scope added
workflow-test.bitdefender.com (out of scope)
-
Scope added
workflow.bitdefender.com (out of scope)
-
Scope added
workflow-dev.bitdefender.com (out of scope)
-
Scope added
explore.bitdefender.com (out of scope)
-
Scope added
translate.bitdefender.com (out of scope)
-
Scope added
demo.bitdefender.com (out of scope)
-
Scope added
telcosuccess.bitdefender.com (out of scope)
-
Scope added
crp.bitdefender.com (out of scope)
-
Scope added
ssems.gravityzone.bitdefender.com/ (out of scope)
-
Scope added
lsems.gravityzone.bitdefender.com/ (out of scope)
-
Scope added
sstats.bitdefender.com/ (out of scope)
-
Scope added
stats.bitdefender.com/ (out of scope)
-
Scope added
brand.bitdefender.com/ (out of scope)
-
Scope added
resellerportal.bitdefender.com/ (out of scope)
-
Scope added
community.bitdefender.com/ (out of scope)
-
Scope added
oemresources.bitdefender.com (out of scope)
-
Scope added
oemhub.bitdefender.com (out of scope)
-
Scope added
businessresources.bitdefender.com (out of scope)
-
Scope added
businessemail.bitdefender.com (out of scope)
-
Scope added
businessinsights.bitdefender.com (out of scope)
-
Scope added
https://www.bitdefender.com/business/smb-products/business-security.html?cid=ppc|b|google|smb&s_kwcid=AL!6076!3!514235572261!p!!g!!bitdefend...
-
Scope added
*.bitdefender.com
-
Scope added
Bitdefender Antimalware Engines
-
Scope added
*.bitdefender.net
-
Scope added
Bitdefender Total Security
-
Scope added
seems.gravityzone.bitdefender.com (out of scope)
-
Scope added
partner-marketing.bitdefender.com (out of scope)
-
Scope added
explore-lb.bitdefender.com (out of scope)
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-6851 | An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a race conditions via Symbolic Links. This issue affects Total Security: before 27.0.58.315; Internet Security: before 27.0.58.315. | High 7.0 | 14 Jul 2026 |
| CVE-2026-10047 | The Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the real-mode hook handler, implemented in napoca/kernel/handler.c. The handler uses a guest-controlled SS:SP-derived offset as an index into the 1MB RealModeMemory buffer without bounds validation. With SS=0xFFFF and ESP=0xFFFF, the computed offset can reach 0x10FFEF, exceeding the RealModeMemory buffer | High 8.5 | 2 Jun 2026 |
| CVE-2026-10046 | Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS INT 0x15 / E820 memory map handler, implemented in napoca/guests/bios_handlers.c. The handler computes a destination offset into the guest RealModeMemory buffer from guest-controlled ES and EDI register values without validating that the resulting address remains within the 1MB RealModeMemory allocat | High 8.5 | 2 Jun 2026 |
| CVE-2025-7073 | A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable directory (C:\ProgramData\Atc\Feedback) without proper symbolic link validation, enabling arbitrary file deletion. This issue is chained with a file copy operation du | High 8.8 | 10 Dec 2025 |
| CVE-2025-5317 | An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users with administrative privileges to bypass the configured uninstall password protection. An unauthorized user with sudo privileges can manually remove the application directory (/Applications/Endpoint Security for Mac.app/) and the related directories within /Libr | Medium 6.8 | 11 Nov 2025 |
| CVE-2025-1987 | A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries. As a result, an attacker can craft a malicious vault entry (or trick a user into creating or importing one) with a javascript:URL. When the user inte | Critical 9.3 | 21 Jun 2025 |
| CVE-2025-2244 | A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplied input without validation. By crafting a malicious serialized payload, an attacker can trigger PHP object injection, perform a file write, and gain arbitrary command execution on the host system. | Critical 9.5 | 4 Apr 2025 |
| CVE-2025-2245 | A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component on port 7074 uses a domain allowlist to restrict outbound requests, but fails to properly sanitize hostnames containing null-byte (%00) sequences. By crafting a request to a domain such as evil.com%00.bitdefender.com, an attacker can bypass t | Medium 6.9 | 4 Apr 2025 |
| CVE-2025-2243 | A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading characters in DNS requests. Paired with other potential vulnerabilities, this bypass could be used for execution of third party code. This issue affects GravityZone Console: before 6.41.2.1. | Medium 6.9 | 4 Apr 2025 |
| CVE-2024-13871 | A command injection vulnerability exists in the /check_image_and_trigger_recovery API endpoint of Bitdefender Box 1 (firmware version 1.3.11.490). This flaw allows an unauthenticated, network-adjacent attacker to execute arbitrary commands on the device, potentially leading to full remote code execution (RCE). | Critical 9.4 | 12 Mar 2025 |
| CVE-2024-13872 | Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and detection rules on the devices. Updates can be remotely triggered through the /set_temp_token API method. Then, an unauthenticated and network-adjacent attacker can use man-in-the-middle (MITM) techniques to return malicious responses. Rest | Critical 9.4 | 12 Mar 2025 |
| CVE-2024-13870 | An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, potentially vulnerable version of a Bitdefender-signed firmware. The attack requires Bitdefender BOX to be booted in Recovery Mode and that the attacker be present within the WiFi range of the BOX unit. | Low 1.8 | 12 Mar 2025 |
| CVE-2020-8094 | An untrusted search path vulnerability in testinitsigs.exe as used in Bitdefender Antivirus Free 2020 allows a low-privilege attacker to execute code as SYSTEM via a specially crafted DLL file. | High 8.8 | 15 Jan 2025 |
| CVE-2024-11128 | A vulnerability in the BitdefenderVirusScanner binary as used in Bitdefender Virus Scanner for MacOS may allow .dynamic library injection (DYLD injection) without being blocked by AppleMobileFileIntegrity (AMFI). This issue is caused by the absence of Hardened Runtime or Library Validation signing. This issue affects Bitdefender Virus Scanner versions before 3.18. | High 8.4 | 13 Jan 2025 |
| CVE-2023-49570 | A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that isn't authorized to issue certificates. This occurs when the "Basic Constraints" extension in the certificate indicates that it is meant to be an "End Entity”. This flaw could allow an attacker to perform a Man-in-the-Middle (MITM) attack, | High 8.6 | 18 Oct 2024 |
| CVE-2023-6056 | A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of self-signed certificates. The product is found to trust certificates signed with the RIPEMD-160 hashing algorithm without proper validation, allowing an attacker to establish MITM SSL connections to arbitrary sites. | High 8.6 | 18 Oct 2024 |
| CVE-2023-6058 | A vulnerability has been identified in Bitdefender Safepay's handling of HTTPS connections. The issue arises when the product blocks a connection due to an untrusted server certificate but allows the user to add the site to exceptions, resulting in the product trusting the certificate for subsequent HTTPS scans. This vulnerability allows an attacker to perform a Man-in-the-Middle (MITM) attack by | High 8.6 | 18 Oct 2024 |
| CVE-2023-6057 | A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of certificates issued using the DSA signature algorithm. The product does not properly check the certificate chain, allowing an attacker to establish MITM SSL connections to arbitrary sites using a DSA-signed certificate. | High 8.6 | 18 Oct 2024 |
| CVE-2023-6055 | A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software fails to properly validate website certificates. Specifically, if a site certificate lacks the "Server Authentication" specification in the Extended Key Usage extension, the product does not verify the certificate's compliance with the site, deeming such certificates as valid. This fla | High 8.6 | 18 Oct 2024 |
| CVE-2023-49567 | A vulnerability has been identified in the Bitdefender Total Security HTTPS scanning functionality where the product incorrectly checks the site's certificate, which allows an attacker to make MITM SSL connections to an arbitrary site. The product trusts certificates that are issued using the MD5 and SHA1 collision hash functions which allow attackers to create rogue certificates that appear legit | High 8.6 | 18 Oct 2024 |
| CVE-2024-6980 | A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-5 running only on premise. | Critical 9.2 | 31 Jul 2024 |
| CVE-2024-4177 | A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-2 that are running only on premise. | High 8.1 | 6 Jun 2024 |
| CVE-2024-2223 | An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay. This issue affects the following products that include the vulnerable component: Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for Windows version 7.9.9.380 GravityZone Control Center | High 8.1 | 9 Apr 2024 |
| CVE-2024-2224 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects the following products that include the vulnerable component: Bitdefender Endpoint Security for Linux version 7.0.5.200089 Bitdefender Endpoint Security for Wind | High 8.1 | 9 Apr 2024 |
| CVE-2023-6154 | A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows an attacker to change the product's expected behavior and potentially load a third-party library upon execution. This issue affects Total Security: 27.0.25.114; Internet Security: 27.0.25.114; Antivirus Plus: 27.0.25.114; | High 7.8 | 1 Apr 2024 |
| CVE-2023-3633 | An out-of-bounds write vulnerability in Bitdefender Engines on Windows causes the engine to crash. This issue affects Bitdefender Engines version 7.94791 and lower. | High 8.1 | 14 Jul 2023 |
| CVE-2022-0357 | Unquoted Search Path or Element vulnerability in the Vulnerability Scan component of Bitdefender Total Security, Bitdefender Internet Security, and Bitdefender Antivirus Plus allows an attacker to elevate privileges to SYSTEM. This issue affects: Bitdefender Total Security versions prior to 26.0.10.45. Bitdefender Internet Security versions prior to 26.0.10.45. Bitdefender Antivirus Plus versions | Medium 6.7 | 24 May 2023 |
| CVE-2022-3369 | An Improper Access Control vulnerability in the bdservicehost.exe component, as used in Bitdefender Engines for Windows, allows an attacker to delete privileged registry keys by pointing a Registry symlink to a privileged key. This issue affects: Bitdefender Engines versions prior to 7.92659. It also affects Bitdefender Antivirus Free, Bitdefender Antivirus Plus, Bitdefender Internet Security, Bit | High 8.6 | 1 Nov 2022 |
| CVE-2022-2830 | Deserialization of Untrusted Data vulnerability in the message processing component of Bitdefender GravityZone Console allows an attacker to pass unsafe commands to the environment. This issue affects: Bitdefender GravityZone Console On-Premise versions prior to 6.29.2-1. Bitdefender GravityZone Cloud Console versions prior to 6.27.2-2. | High 8.8 | 5 Sep 2022 |
| CVE-2022-0677 | Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in relay role), GravityZone (in Update Server role) allows an attacker to cause a Denial-of-Service. This issue affects: Bitdefender Update Server versions prior to 3.4.0.276. Bitdefender GravityZone versions prior to 26.4-1. Bitdefender Endpoint Security Tools f | High 7.5 | 7 Apr 2022 |
| CVE-2021-4199 | Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.exe as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools for Windows allows a remote attacker to escalate local privileges to SYSTEM. This issue affects: Bitdefender Total Security versions prior to 26.0.10.45. Bitdefender Internet Security versi | High 7.8 | 7 Mar 2022 |
| CVE-2021-4198 | A NULL Pointer Dereference vulnerability in the messaging_ipc.dll component as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools, VPN Standalone allows an attacker to arbitrarily crash product processes and generate crashdump files. This issue affects: Bitdefender Total Security versions prior to 26.0.3.29. Bitdefender Internet Security versions prior t | Medium 6.1 | 7 Mar 2022 |
| CVE-2020-8107 | A Process Control vulnerability in ProductAgentUI.exe as used in Bitdefender Antivirus Plus allows an attacker to tamper with product settings via a specially crafted DLL file. This issue affects: Bitdefender Antivirus Plus versions prior to 24.0.26.136. Bitdefender Internet Security versions prior to 24.0.26.136. Bitdefender Total Security versions prior to 24.0.26.136. | High 8.2 | 18 Feb 2022 |
| CVE-2021-3960 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects Bitdefender GravityZone versions prior to 3.3.8.272 | High 7.1 | 16 Dec 2021 |
| CVE-2021-3959 | A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay server. This issue affects: Bitdefender Bitdefender GravityZone versions prior to 3.3.8.272 | Medium 6.8 | 16 Dec 2021 |
| CVE-2021-3554 | Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint versions prior to 6.2.21.1 | Critical 9.0 | 24 Nov 2021 |
| CVE-2021-3553 | A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService of Bitdefender Endpoint Security Tools allows an attacker to use the Endpoint Protection relay as a proxy for any remote host. This issue affects: Bitdefender Endpoint Security Tools versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint for Linux versions prior to 6.2.21.160. Bitdefender Gra | Medium 5.3 | 24 Nov 2021 |
| CVE-2021-3552 | A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay server. This issue affects: Bitdefender Endpoint Security Tools versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender GravityZone 6.24.1-1. | Medium 5.3 | 24 Nov 2021 |
| CVE-2021-3641 | Improper Link Resolution Before File Access ('Link Following') vulnerability in the EPAG component of Bitdefender Endpoint Security Tools for Windows allows a local attacker to cause a denial of service. This issue affects: Bitdefender GravityZone version 7.1.2.33 and prior versions. | Medium 6.1 | 9 Nov 2021 |
| CVE-2021-3823 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects: Bitdefender GravityZone versions prior to 3.3.8.249. | High 7.1 | 28 Oct 2021 |
| CVE-2021-3579 | Incorrect Default Permissions vulnerability in the bdservicehost.exe and Vulnerability.Scan.exe components as used in Bitdefender Endpoint Security Tools for Windows, Total Security allows a local attacker to elevate privileges to NT AUTHORITY\SYSTEM This issue affects: Bitdefender Endpoint Security Tools for Windows versions prior to 7.2.1.65. Bitdefender Total Security versions prior to 7.2.1.65 | High 7.8 | 28 Oct 2021 |
| CVE-2021-3576 | Execution with Unnecessary Privileges vulnerability in Bitdefender Endpoint Security Tools, Total Security allows a local attacker to elevate to 'NT AUTHORITY\System. Impersonation enables the server thread to perform actions on behalf of the client but within the limits of the client's security context. This issue affects: Bitdefender Endpoint Security Tools versions prior to 7.2.1.65. Bitdefende | High 7.8 | 28 Oct 2021 |
| CVE-2020-15732 | Improper Certificate Validation vulnerability in the Online Threat Prevention module as used in Bitdefender Total Security allows an attacker to potentially bypass HTTP Strict Transport Security (HSTS) checks. This issue affects: Bitdefender Total Security versions prior to 25.0.7.29. Bitdefender Internet Security versions prior to 25.0.7.29. Bitdefender Antivirus Plus versions prior to 25.0.7.29. | Medium 6.5 | 22 Jun 2021 |
| CVE-2021-3485 | An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.155. | Medium 6.4 | 24 May 2021 |
| CVE-2021-3423 | Uncontrolled Search Path Element vulnerability in the openssl component as used in Bitdefender GravityZone Business Security allows an attacker to load a third party DLL to elevate privileges. This issue affects Bitdefender GravityZone Business Security versions prior to 6.6.23.329. | High 7.8 | 18 May 2021 |
| CVE-2020-15279 | An Improper Access Control vulnerability in the logging component of Bitdefender Endpoint Security Tools for Windows versions prior to 6.6.23.320 allows a regular user to learn the scanning exclusion paths. This issue was discovered during external security research. | Medium 4.0 | 18 May 2021 |
| CVE-2020-15734 | An Origin Validation Error vulnerability in Bitdefender Safepay allows an attacker to manipulate the browser's file upload capability into accessing other files in the same directory or sub-directories. This issue affects: Bitdefender Safepay versions prior to 25.0.7.29. | Medium 5.5 | 12 Apr 2021 |
| CVE-2020-15294 | Compiler Optimization Removal or Modification of Security-critical Code vulnerability in IntPeParseUnwindData() results in multiple dereferences to the same pointer. If the pointer is located in memory-mapped from the guest space, this may cause a race-condition where the generated code would dereference the same address twice, thus obtaining different values, which may lead to arbitrary code exec | High 7.8 | 17 Dec 2020 |
| CVE-2020-15293 | Memory corruption in IntLixCrashDumpDmesg, IntLixTaskFetchCmdLine, IntLixFileReadDentry and IntLixFileGetPath due to insufficient guest-data input validation may lead to denial of service conditions. | Medium 6.1 | 17 Dec 2020 |
| CVE-2020-15292 | Lack of validation on data read from guest memory in IntPeGetDirectory, IntPeParseUnwindData, IntLogExceptionRecord, IntKsymExpandSymbol and IntLixTaskDumpTree may lead to out-of-bounds read or it could cause DoS due to integer-overflor (IntPeGetDirectory), TOCTOU (IntPeParseUnwindData) or insufficient validations. | Medium 5.5 | 17 Dec 2020 |
| CVE-2020-15733 | An Origin Validation Error vulnerability in the SafePay component of Bitdefender Antivirus Plus allows a web resource to misrepresent itself in the URL bar. This issue affects: Bitdefender Antivirus Plus versions prior to 25.0.7.29. | Medium 6.5 | 14 Dec 2020 |
| CVE-2020-15297 | Insufficient validation in the Bitdefender Update Server and BEST Relay components of Bitdefender Endpoint Security Tools versions prior to 6.6.20.294 allows an unprivileged attacker to bypass the in-place mitigations and interact with hosts on the network. This issue affects: Bitdefender Update Server versions prior to 6.6.20.294. | High 7.1 | 9 Nov 2020 |
| CVE-2020-8110 | A vulnerability has been discovered in the ceva_emu.cvd module that results from a lack of proper validation of user-supplied data, which can result in a pointer that is fetched from uninitialized memory. This can lead to denial-of-service. This issue affects: Bitdefender Engines version 7.84897 and prior versions. | Medium 5.9 | 2 Oct 2020 |
| CVE-2020-8109 | A vulnerability has been discovered in the ace.xmd parser that results from a lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. This can result in denial-of-service. This issue affects: Bitdefender Engines version 7.84892 and prior versions. | Medium 5.9 | 1 Oct 2020 |
| CVE-2020-15731 | An improper Input Validation vulnerability in the code handling file renaming and recovery in Bitdefender Engines allows an attacker to write an arbitrary file in a location hardcoded in a specially-crafted malicious file name. This issue affects: Bitdefender Engines versions prior to 7.85448. | Low 3.2 | 30 Sep 2020 |
| CVE-2020-8097 | An improper authentication vulnerability in Bitdefender Endpoint Security Tools for Windows and Bitdefender Endpoint Security SDK allows an unprivileged local attacker to escalate privileges or tamper with the product's security settings. This issue affects: Bitdefender Endpoint Security Tools for Windows versions prior to 6.6.18.261. This issue affects: Bitdefender Endpoint Security Tools for Win | High 8.1 | 30 Aug 2020 |
| CVE-2020-8108 | Improper Authentication vulnerability in Bitdefender Endpoint Security for Mac allows an unprivileged process to restart the main service and potentially inject third-party code into a trusted process. This issue affects: Bitdefender Endpoint Security for Mac versions prior to 4.12.80. | High 8.2 | 3 Aug 2020 |
| CVE-2020-8102 | Improper Input Validation vulnerability in the Safepay browser component of Bitdefender Total Security 2020 allows an external, specially crafted web page to run remote commands inside the Safepay Utility process. This issue affects Bitdefender Total Security 2020 versions prior to 24.0.20.116. | High 8.8 | 22 Jun 2020 |
| CVE-2020-8103 | A vulnerability in the improper handling of symbolic links in Bitdefender Antivirus Free can allow an unprivileged user to substitute a quarantined file, and restore it to a privileged location. This issue affects Bitdefender Antivirus Free versions prior to 1.0.17.178. | High 7.2 | 5 Jun 2020 |
| CVE-2020-8100 | Improper Input Validation vulnerability in the cevakrnl.rv0 module as used in the Bitdefender Engines allows an attacker to trigger a denial of service while scanning a specially-crafted sample. This issue affects: Bitdefender Bitdefender Engines versions prior to 7.84063. | Critical 9.0 | 15 May 2020 |
Original policy
Copied from bugcrowd.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Description
We appreciate all security concerns brought forth and are constantly striving to keep on top of the latest threats. Being pro-active rather than re-active to emerging security issues is a fundamental belief at Bitdefender.
Targets
DOWNLOAD LINKS: Bitdefender Total Security -> https://www.bitdefender.com/solutions/total-security.html (Consumer) Bitdefender GravityZone Business Security -> https://www.bitdefender.com/business/free-trials/ (Business) Target info: For authenticated testing please self-provision utilizing your @bugcrowdninja address or an email that clearly identifies you as a researcher. No payment or promotional codes will be provided for testing purposes. Please refrain from testing contact forms or inputs that would result in a large amount of spam. Qualification Criteria A finding must demonstrate a clear and meaningful security impact. The report should identify the security boundary that is crossed, the privileges or access required to exploit the issue, and the additional capability gained by a successful attacker. Findings that require administrative, root, SYSTEM, or equivalent privileges are eligible only when they demonstrate a meaningful impact beyond the capabilities already available to an attacker with those privileges. Examples may include crossing a separate trust boundary, compromising another user or tenant, bypassing a security control, obtaining access to otherwise protected data, or gaining privileges in a distinct security context. Eligibility will be determined based on the demonstrated security impact. Rewards Bitdefender will rely on the Bugcrowd Vulnerability Rating Taxonomy for prioritization of findings, but reserve the right to either downgrade or upgrade findings' severity based on the criticality of their underlying risk to Bitdefender. Appropriate payouts will then be awarded accordingly. Any downgraded submission will come with a full and detailed explanation. There are some things we explicitly ask you not to do: When experimenting, please only attack test accounts you control. A PoC unnecessarily involving accounts of other end users or Bitdefender employees may be disqualified. Automated vulnerability scans are strictly prohibited. In any way, do not attack our end users, or engage in the trade of stolen user credentials. The following kinds of findings are specifically non-rewardable within this program: Self XSS or other types of self-exploitation (cookie reuse, self DoS, self-cookie-bomb, etc.) Descriptive error messages (e.g., stack traces, application or server errors). Email spoofing issues (incomplete or lack of SPF, DMARC, DKIM records) Out of date software versions Content Spoofing Vulnerabilities that are limited to unsupported browsers or operating systems Password policies not enforced on user accounts Clickjacking or any issue exploitable through clickjacking Vulnerabilities in third-party software. Please reach out to the company responsible for the code to have the issues fixed. We may contact the upstream provider, depending on the impact of the vulnerability. Lack of Secure and HTTPOnly cookie flags. Username / email enumeration CORS issues without a working PoC Login or Forgot Password page brute force and account lockout not enforced CSRF issues that have no security impact Antimalware detections bypass or undetected malware samples Local privilege elevation on GravityZone On-Premises OS Recently disclosed critical vulnerabilities in third-party software where there is no patch, or a recent patch (less than one week) is available. Missing HTTP security headers TLS/SSL Issues, bad cipher suite, expired certificates, etc. Internal IP address disclosure Reports of spam (i.e., any report involving ability to send emails without rate limits). Pre-Authentication Account Takeover Mobile issues that require root access or unsupported OS versions Non-sensitive exposed API keys (Google Maps, etc.). Failure to invalidate session on password change or MFA change. Insufficient or non-incremental security impact: Findings that require administrative, root, SYSTEM, or equivalent privileges and do not demonstrate a meaningful security impact beyond the capabilities already available with those privileges. Abuse of intended product functionality by a user who is already authorized to perform an equivalent action. Reports that demonstrate only the absence of a security detection, alert, or prevention event, without identifying an underlying exploitable vulnerability or a bypass of an explicitly documented security boundary. Defense-in-depth or product-hardening recommendations that do not demonstrate a practical attack scenario and a meaningful security impact. Reports based solely on theoretical impact, without sufficient reproduction steps or a working proof of concept demonstrating the claimed security consequence. Findings where the reported result can be achieved through standard operating-system functionality at the same privilege level, unless the Bitdefender component enables an additional capability, crosses a separate trust boundary, or bypasses a security control. HAPPY HUNTING!! Safe Harbor When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through one of our official channels before going any further.