Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
3 vulnerabilities found for SecurePass by Bitdefender
CERTFR-2025-AVI-0531
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans Bitdefender SecurePass. Elle permet à un attaquant de provoquer une injection de code indirecte à distance (XSS).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Bitdefender | SecurePass | Greffon SecurePass pour Firefox versions antérieures à 1.1.22 | ||
| Bitdefender | SecurePass | Greffon SecurePass pour Chrome et Edge versions antérieures à 1.1.18 | ||
| Bitdefender | SecurePass | Client web SecurePass versions antérieures à 0.0.76 | ||
| Bitdefender | SecurePass | Greffon SecurePass pour Safari versions antérieures à 1.0.10 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Greffon SecurePass pour Firefox versions ant\u00e9rieures \u00e0 1.1.22",
"product": {
"name": "SecurePass",
"vendor": {
"name": "Bitdefender",
"scada": false
}
}
},
{
"description": "Greffon SecurePass pour Chrome et Edge versions ant\u00e9rieures \u00e0 1.1.18",
"product": {
"name": "SecurePass",
"vendor": {
"name": "Bitdefender",
"scada": false
}
}
},
{
"description": "Client web SecurePass versions ant\u00e9rieures \u00e0 0.0.76 ",
"product": {
"name": "SecurePass",
"vendor": {
"name": "Bitdefender",
"scada": false
}
}
},
{
"description": "Greffon SecurePass pour Safari versions ant\u00e9rieures \u00e0 1.0.10",
"product": {
"name": "SecurePass",
"vendor": {
"name": "Bitdefender",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-1987",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-1987"
}
],
"links": [],
"reference": "CERTFR-2025-AVI-0531",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-06-23T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Bitdefender SecurePass. Elle permet \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS).",
"title": "Vuln\u00e9rabilit\u00e9 dans Bitdefender SecurePass",
"vendor_advisories": [
{
"published_at": "2025-06-21",
"title": "Bulletin de s\u00e9curit\u00e9 Bitdefender stored-xss-in-psono-client-via-malicious-vault-entry-urls",
"url": "https://www.bitdefender.com/support/security-advisories/stored-xss-in-psono-client-via-malicious-vault-entry-urls/"
}
]
}
CVE-2025-1987 (GCVE-0-2025-1987)
Vulnerability from cvelistv5 – Published: 2025-06-21 21:35 – Updated: 2025-06-23 14:56
VLAI
Title
Stored XSS in Psono-Client via Malicious Vault Entry URLs
Summary
A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries. As a result, an attacker can craft a malicious vault entry (or trick a user into creating or importing one) with a javascript:URL. When the user interacts with this entry (for example, by clicking or opening it), the application will execute the malicious JavaScript in the context of the Psono vault. This allows an attacker to run arbitrary code in the victim’s browser, potentially giving them access to the user’s password vault and sensitive data.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Psono | Psono-client |
Affected:
0 , ≤ 4.0.4
(git)
|
|
| Bitdefender | SecurePass |
Affected:
0 , < 0.0.76
(Web client)
Affected: 0 , < 1.1.18 (Chrome) Affected: 0 , < 1.1.22 (Firefox) Affected: 0 , < 1.1.18 (Edge) Affected: 0 , < 1.0.10 (Safari) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1987",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T14:56:38.593939Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T14:56:45.902Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Psono-client",
"vendor": "Psono",
"versions": [
{
"lessThanOrEqual": "4.0.4",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SecurePass",
"vendor": "Bitdefender",
"versions": [
{
"lessThan": "0.0.76",
"status": "affected",
"version": "0",
"versionType": "Web client"
},
{
"lessThan": "1.1.18",
"status": "affected",
"version": "0",
"versionType": "Chrome"
},
{
"lessThan": "1.1.22",
"status": "affected",
"version": "0",
"versionType": "Firefox"
},
{
"lessThan": "1.1.18",
"status": "affected",
"version": "0",
"versionType": "Edge"
},
{
"lessThan": "1.0.10",
"status": "affected",
"version": "0",
"versionType": "Safari"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ionut DR\u0102GU\u021a, Bitdefender Labs"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA \u003cb\u003eCross-Site Scripting (XSS)\u003c/b\u003e\u0026nbsp;vulnerability has been identified in Psono-Client\u2019s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries. As a result, an attacker can craft a malicious vault entry (or trick a user into creating or importing one) with a javascript:URL. When the user interacts with this entry (for example, by clicking or opening it), the application will execute the malicious JavaScript in the context of the Psono vault. This allows an attacker to run arbitrary code in the victim\u2019s browser, potentially giving them access to the user\u2019s password vault and sensitive data.\u003c/p\u003e\u003cbr\u003e"
}
],
"value": "A Cross-Site Scripting (XSS)\u00a0vulnerability has been identified in Psono-Client\u2019s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries. As a result, an attacker can craft a malicious vault entry (or trick a user into creating or importing one) with a javascript:URL. When the user interacts with this entry (for example, by clicking or opening it), the application will execute the malicious JavaScript in the context of the Psono vault. This allows an attacker to run arbitrary code in the victim\u2019s browser, potentially giving them access to the user\u2019s password vault and sensitive data."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-21T21:35:06.643Z",
"orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"shortName": "Bitdefender"
},
"references": [
{
"url": "https://bitdefender.com/support/support/security-advisories/stored-xss-in-psono-client-via-malicious-vault-entry-urls"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An automatic update to these product versions fixes the issue:\u003cbr\u003e\u003cbr\u003e\u003cul\u003e\u003cli\u003eWeb client: 0.0.76\u003c/li\u003e\u003cli\u003eChrome: 1.1.18\u003c/li\u003e\u003cli\u003eFirefox: 1.1.22\u003c/li\u003e\u003cli\u003eEdge: 1.1.18\u003c/li\u003e\u003cli\u003eSafari: 1.0.10\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "An automatic update to these product versions fixes the issue:\n\n * Web client: 0.0.76\n * Chrome: 1.1.18\n * Firefox: 1.1.22\n * Edge: 1.1.18\n * Safari: 1.0.10"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored XSS in Psono-Client via Malicious Vault Entry URLs",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"assignerShortName": "Bitdefender",
"cveId": "CVE-2025-1987",
"datePublished": "2025-06-21T21:35:06.643Z",
"dateReserved": "2025-03-05T14:48:09.124Z",
"dateUpdated": "2025-06-23T14:56:45.902Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-1987 (GCVE-0-2025-1987)
Vulnerability from nvd – Published: 2025-06-21 21:35 – Updated: 2025-06-23 14:56
VLAI
Title
Stored XSS in Psono-Client via Malicious Vault Entry URLs
Summary
A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries. As a result, an attacker can craft a malicious vault entry (or trick a user into creating or importing one) with a javascript:URL. When the user interacts with this entry (for example, by clicking or opening it), the application will execute the malicious JavaScript in the context of the Psono vault. This allows an attacker to run arbitrary code in the victim’s browser, potentially giving them access to the user’s password vault and sensitive data.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Psono | Psono-client |
Affected:
0 , ≤ 4.0.4
(git)
|
|
| Bitdefender | SecurePass |
Affected:
0 , < 0.0.76
(Web client)
Affected: 0 , < 1.1.18 (Chrome) Affected: 0 , < 1.1.22 (Firefox) Affected: 0 , < 1.1.18 (Edge) Affected: 0 , < 1.0.10 (Safari) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1987",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-23T14:56:38.593939Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-23T14:56:45.902Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Psono-client",
"vendor": "Psono",
"versions": [
{
"lessThanOrEqual": "4.0.4",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SecurePass",
"vendor": "Bitdefender",
"versions": [
{
"lessThan": "0.0.76",
"status": "affected",
"version": "0",
"versionType": "Web client"
},
{
"lessThan": "1.1.18",
"status": "affected",
"version": "0",
"versionType": "Chrome"
},
{
"lessThan": "1.1.22",
"status": "affected",
"version": "0",
"versionType": "Firefox"
},
{
"lessThan": "1.1.18",
"status": "affected",
"version": "0",
"versionType": "Edge"
},
{
"lessThan": "1.0.10",
"status": "affected",
"version": "0",
"versionType": "Safari"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ionut DR\u0102GU\u021a, Bitdefender Labs"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA \u003cb\u003eCross-Site Scripting (XSS)\u003c/b\u003e\u0026nbsp;vulnerability has been identified in Psono-Client\u2019s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries. As a result, an attacker can craft a malicious vault entry (or trick a user into creating or importing one) with a javascript:URL. When the user interacts with this entry (for example, by clicking or opening it), the application will execute the malicious JavaScript in the context of the Psono vault. This allows an attacker to run arbitrary code in the victim\u2019s browser, potentially giving them access to the user\u2019s password vault and sensitive data.\u003c/p\u003e\u003cbr\u003e"
}
],
"value": "A Cross-Site Scripting (XSS)\u00a0vulnerability has been identified in Psono-Client\u2019s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries. As a result, an attacker can craft a malicious vault entry (or trick a user into creating or importing one) with a javascript:URL. When the user interacts with this entry (for example, by clicking or opening it), the application will execute the malicious JavaScript in the context of the Psono vault. This allows an attacker to run arbitrary code in the victim\u2019s browser, potentially giving them access to the user\u2019s password vault and sensitive data."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-21T21:35:06.643Z",
"orgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"shortName": "Bitdefender"
},
"references": [
{
"url": "https://bitdefender.com/support/support/security-advisories/stored-xss-in-psono-client-via-malicious-vault-entry-urls"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An automatic update to these product versions fixes the issue:\u003cbr\u003e\u003cbr\u003e\u003cul\u003e\u003cli\u003eWeb client: 0.0.76\u003c/li\u003e\u003cli\u003eChrome: 1.1.18\u003c/li\u003e\u003cli\u003eFirefox: 1.1.22\u003c/li\u003e\u003cli\u003eEdge: 1.1.18\u003c/li\u003e\u003cli\u003eSafari: 1.0.10\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "An automatic update to these product versions fixes the issue:\n\n * Web client: 0.0.76\n * Chrome: 1.1.18\n * Firefox: 1.1.22\n * Edge: 1.1.18\n * Safari: 1.0.10"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Stored XSS in Psono-Client via Malicious Vault Entry URLs",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "b3d5ebe7-963e-41fb-98e1-2edaeabb8f82",
"assignerShortName": "Bitdefender",
"cveId": "CVE-2025-1987",
"datePublished": "2025-06-21T21:35:06.643Z",
"dateReserved": "2025-03-05T14:48:09.124Z",
"dateUpdated": "2025-06-23T14:56:45.902Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}