Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

4.8

MEDIUM

CVE-2021-23881

A stored cross site scripting vulnerability in ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 February 2021 Update allows an ENS ePO administrator to add a script to a policy event which will trigger the script to be run through a browser...

Affected Products : endpoint_security
Published: Feb. 10, 2021

Modified: Nov. 21, 2024
6.7

MEDIUM

CVE-2021-23880

Improper Access Control in attribute in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows authenticated local administrator user to perform an uninstallation of the anti-malware engine via the running of a specific com...

Affected Products : endpoint_security
Published: Feb. 10, 2021

Modified: Nov. 21, 2024
7.2

HIGH

CVE-2021-23879

Unquoted service path vulnerability in McAfee Endpoint Product Removal (EPR) Tool prior to 21.2 allows local administrators to execute arbitrary code, with higher-level privileges, via execution from a compromised folder. The tool did not enforce and prot...

Affected Products : endpoint_product_removal_tool
Published: Mar. 15, 2021

Modified: Nov. 21, 2024
7.3

HIGH

CVE-2021-23878

Clear text storage of sensitive Information in memory vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows a local user to view ENS settings and credentials via accessing process memory after the ENS admi...

Affected Products : endpoint_security
Published: Feb. 10, 2021

Modified: Nov. 21, 2024
7.8

HIGH

CVE-2021-23877

Privilege escalation vulnerability in the Windows trial installer of McAfee Total Protection (MTP) prior to 16.0.34_x may allow a local user to run arbitrary code as the admin user by replacing a specific temporary file created during the installation of ...

Affected Products : total_protection
Published: Oct. 26, 2021

Modified: Nov. 21, 2024
7.8

HIGH

CVE-2021-23876

Bypass Remote Procedure call in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and perform arbitrary file modification as the SYSTEM user potentially causing Denial of Service via executing carefully constru...

Affected Products : total_protection
Published: Feb. 10, 2021

Modified: Nov. 21, 2024
7.8

HIGH

CVE-2021-23873

Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and perform arbitrary file deletion as the SYSTEM user potentially causing Denial of Service via manipulating Junction lin...

Affected Products : total_protection
Published: Feb. 10, 2021

Modified: Nov. 21, 2024
7.8

HIGH

CVE-2021-23872

Privilege Escalation vulnerability in the File Lock component of McAfee Total Protection (MTP) prior to 16.0.32 allows a local user to gain elevated privileges by manipulating a symbolic link in the IOCTL interface....

Affected Products : total_protection
Published: May. 12, 2021

Modified: Nov. 21, 2024
6.1

MEDIUM

CVE-2021-23863

HTML code injection vulnerability in Android Application, Bosch Video Security, version 3.2.3. or earlier, when successfully exploited allows an attacker to inject random HTML code into a component loaded by WebView, thus allowing the Application to displ...

Affected Products : video_security
Published: Jan. 28, 2022

Modified: Nov. 21, 2024
9.0

HIGH

CVE-2021-23862

A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affects installations of the VRM, DIVAR IP, BVMS with VRM installed, the VIDEOJET decoder (VJD-7513 an...

Affected Products : bosch_video_management_system video_recording_manager divar_ip_5000_firmware divar_ip_7000_firmware videojet_decoder_7513_firmware videojet_decoder_8000_firmware divar_ip_7000_r2_firmware divar_ip_all-in-one_5000_firmware divar_ip_all-in-one_7000_firmware videojet_decoder_7513 +1 more products
Published: Dec. 08, 2021

Modified: Nov. 21, 2024
6.5

MEDIUM

CVE-2021-23861

By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impact on integrity or availability of the installed software. This issue also affects installations of the DIVAR IP a...

Affected Products : bosch_video_management_system video_recording_manager divar_ip_5000_firmware divar_ip_7000_firmware divar_ip_7000_r2_firmware divar_ip_all-in-one_5000_firmware divar_ip_all-in-one_7000_firmware
Published: Dec. 08, 2021

Modified: Nov. 21, 2024
6.1

MEDIUM

CVE-2021-23860

An error in a page handler of the VRM may lead to a reflected cross site scripting (XSS) in the web-based interface. To exploit this vulnerability an attack must be able to modify the HTTP header that is sent. This issue also affects installations of the ...

Affected Products : bosch_video_management_system video_recording_manager divar_ip_5000_firmware divar_ip_7000_firmware divar_ip_7000_r2_firmware divar_ip_all-in-one_5000_firmware divar_ip_all-in-one_7000_firmware
Published: Dec. 08, 2021

Modified: Nov. 21, 2024
9.1

CRITICAL

CVE-2021-23859

An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standalone VRM or BVMS with VRM installation this crash also opens the possibility to send further unauthenticated commands to the service. On...

Affected Products : access_professional_edition bosch_video_management_system building_integration_system video_recording_manager access_easy_controller_firmware divar_ip_5000_firmware divar_ip_7000_firmware video_recording_manager_exporter divar_ip_7000_r2_firmware divar_ip_all-in-one_5000_firmware +2 more products
Published: Dec. 08, 2021

Modified: Nov. 21, 2024
8.6

HIGH

CVE-2021-23858

Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial numb...

Affected Products : rexroth_indramotion_mlc_l20_firmware rexroth_indramotion_mlc_l40_firmware rexroth_indramotion_mlc_l25_firmware rexroth_indramotion_mlc_l45_firmware rexroth_indramotion_mlc_l65_firmware rexroth_indramotion_mlc_l75_firmware rexroth_indramotion_mlc_l85_firmware rexroth_indramotion_mlc_xm22_firmware rexroth_indramotion_mlc_xm21_firmware rexroth_indramotion_mlc_xm41_firmware +14 more products
Published: Oct. 04, 2021

Modified: Nov. 21, 2024
10.0

CRITICAL

CVE-2021-23857

Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the password. Combined with CVE-2021-23858, this allows an attacker to subsequently login to the system....

Affected Products : rexroth_indramotion_xlc_firmware rexroth_indramotion_mlc_l20_firmware rexroth_indramotion_mlc_l40_firmware rexroth_indramotion_mlc_l25_firmware rexroth_indramotion_mlc_l45_firmware rexroth_indramotion_mlc_l65_firmware rexroth_indramotion_mlc_l75_firmware rexroth_indramotion_mlc_l85_firmware rexroth_indramotion_mlc_xm22_firmware rexroth_indramotion_mlc_xm21_firmware +14 more products
Published: Oct. 04, 2021

Modified: Nov. 21, 2024
10.0

CRITICAL

CVE-2021-23856

The web server is vulnerable to reflected XSS and therefore an attacker might be able to execute scripts on a client’s computer by sending the client a manipulated URL....

Affected Products : rexroth_indramotion_mlc_l20_firmware rexroth_indramotion_mlc_l40_firmware rexroth_indramotion_mlc_l20 rexroth_indramotion_mlc_l40
Published: Oct. 04, 2021

Modified: Nov. 21, 2024
8.6

HIGH

CVE-2021-23855

The user and password data base is exposed by an unprotected web server resource. Passwords are hashed with a weak hashing algorithm and therefore allow an attacker to determine the password by using rainbow tables....

Affected Products : rexroth_indramotion_xlc_firmware rexroth_indramotion_mlc_firmware rexroth_indramotion_xlc rexroth_indramotion_mlc
Published: Oct. 04, 2021

Modified: Nov. 21, 2024
8.3

HIGH

CVE-2021-23854

An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. This issue only affects versions 7.7x and 7.6x. All other versions are not affected....

Affected Products : cpp6_firmware cpp7_firmware cpp7.3_firmware cpp13_firmware cpp6 cpp7 cpp7.3 cpp13
Published: Jun. 09, 2021

Modified: Nov. 21, 2024
9.8

CRITICAL

CVE-2021-23853

In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs....

Affected Products : cpp6_firmware cpp7_firmware cpp7.3_firmware cpp4_firmware cpp13_firmware cpp6 cpp7 cpp7.3 cpp4 cpp13
Published: Jun. 09, 2021

Modified: Nov. 21, 2024
4.9

MEDIUM

CVE-2021-23852

An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to become unresponsive for a few seconds and cause a Denial of Service (DoS)....

Affected Products : cpp6_firmware cpp7_firmware cpp7.3_firmware cpp4_firmware cpp13_firmware cpp6 cpp7 cpp7.3 cpp4 cpp13
Published: Jun. 09, 2021

Modified: Nov. 21, 2024

Showing 20 of 292811 Results

Browse by Apps

Latest CVE Feed

4.8

6.7

7.2

7.3

7.8

7.8

7.8

7.8

6.1

9.0

6.5

6.1

9.1

8.6

10.0

10.0

8.6

8.3

9.8

4.9

Theme Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable