CVE-2021-3485

MEDIUM Year: 2021
CVSS v3 Score
6.6
Medium
CVSS v2 Score
6.0
Medium
Weakness Type
CWE-494
View all →

Vulnerability Description

An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.155.

Related Vulnerabilities

CVE-2022-24140

MEDIUM
CVSS:6.6(Medium)

IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in order to download a config file. After dow...

CWE-4942022

CVE-2021-41714

MEDIUM
CVSS:6.5(Medium)

In Tipask < 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitrary files on the Tipask server such as .env, /etc/passwd, la...

CWE-4942021

CVE-2022-31324

MEDIUM
CVSS:6.5(Medium)

An arbitrary file download vulnerability in the downloadAction() function of Penta Security Systems Inc WAPPLES v6.0 r3 4.10-hotfix1 allows attackers to download arbitrary files via a crafted POST req...

CWE-4942022

CVE-2022-37908

MEDIUM
CVSS:6.5(Medium)

An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware chain of trust on the impacted controller.

CWE-4942022

CVE-2022-4261

MEDIUM
CVSS:6.5(Medium)

Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the...

CWE-4942022

CVE-2023-24500

MEDIUM
CVSS:6.5(Medium)

Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW.

CWE-4942023