Latest CVE Feed
-
7.8
HIGHCVE-2021-23876
Bypass Remote Procedure call in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and perform arbitrary file modification as the SYSTEM user potentially causing Denial of Service via executing carefully constru... Read more
Affected Products : total_protection- Published: Feb. 10, 2021
- Modified: Nov. 21, 2024
-
7.8
HIGHCVE-2021-23873
Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and perform arbitrary file deletion as the SYSTEM user potentially causing Denial of Service via manipulating Junction lin... Read more
Affected Products : total_protection- Published: Feb. 10, 2021
- Modified: Nov. 21, 2024
-
7.8
HIGHCVE-2021-23872
Privilege Escalation vulnerability in the File Lock component of McAfee Total Protection (MTP) prior to 16.0.32 allows a local user to gain elevated privileges by manipulating a symbolic link in the IOCTL interface.... Read more
Affected Products : total_protection- Published: May. 12, 2021
- Modified: Nov. 21, 2024
-
6.1
MEDIUMCVE-2021-23863
HTML code injection vulnerability in Android Application, Bosch Video Security, version 3.2.3. or earlier, when successfully exploited allows an attacker to inject random HTML code into a component loaded by WebView, thus allowing the Application to displ... Read more
Affected Products : video_security- Published: Jan. 28, 2022
- Modified: Nov. 21, 2024
-
9.0
HIGHCVE-2021-23862
A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affects installations of the VRM, DIVAR IP, BVMS with VRM installed, the VIDEOJET decoder (VJD-7513 an... Read more
Affected Products : bosch_video_management_system video_recording_manager divar_ip_5000_firmware divar_ip_7000_firmware videojet_decoder_7513_firmware videojet_decoder_8000_firmware divar_ip_7000_r2_firmware divar_ip_all-in-one_5000_firmware divar_ip_all-in-one_7000_firmware videojet_decoder_7513 +1 more products- Published: Dec. 08, 2021
- Modified: Nov. 21, 2024
-
6.5
MEDIUMCVE-2021-23861
By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impact on integrity or availability of the installed software. This issue also affects installations of the DIVAR IP a... Read more
- Published: Dec. 08, 2021
- Modified: Nov. 21, 2024
-
6.1
MEDIUMCVE-2021-23860
An error in a page handler of the VRM may lead to a reflected cross site scripting (XSS) in the web-based interface. To exploit this vulnerability an attack must be able to modify the HTTP header that is sent. This issue also affects installations of the ... Read more
- Published: Dec. 08, 2021
- Modified: Nov. 21, 2024
-
9.1
CRITICALCVE-2021-23859
An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standalone VRM or BVMS with VRM installation this crash also opens the possibility to send further unauthenticated commands to the service. On... Read more
Affected Products : access_professional_edition bosch_video_management_system building_integration_system video_recording_manager access_easy_controller_firmware divar_ip_5000_firmware divar_ip_7000_firmware video_recording_manager_exporter divar_ip_7000_r2_firmware divar_ip_all-in-one_5000_firmware +2 more products- Published: Dec. 08, 2021
- Modified: Nov. 21, 2024
-
8.6
HIGHCVE-2021-23858
Information disclosure: The main configuration, including users and their hashed passwords, is exposed by an unprotected web server resource and can be accessed without authentication. Additionally, device details are exposed which include the serial numb... Read more
Affected Products : rexroth_indramotion_mlc_l20_firmware rexroth_indramotion_mlc_l40_firmware rexroth_indramotion_mlc_l25_firmware rexroth_indramotion_mlc_l45_firmware rexroth_indramotion_mlc_l65_firmware rexroth_indramotion_mlc_l75_firmware rexroth_indramotion_mlc_l85_firmware rexroth_indramotion_mlc_xm22_firmware rexroth_indramotion_mlc_xm21_firmware rexroth_indramotion_mlc_xm41_firmware +14 more products- Published: Oct. 04, 2021
- Modified: Nov. 21, 2024
-
10.0
CRITICALCVE-2021-23857
Login with hash: The login routine allows the client to log in to the system not by using the password, but by using the hash of the password. Combined with CVE-2021-23858, this allows an attacker to subsequently login to the system.... Read more
Affected Products : rexroth_indramotion_xlc_firmware rexroth_indramotion_mlc_l20_firmware rexroth_indramotion_mlc_l40_firmware rexroth_indramotion_mlc_l25_firmware rexroth_indramotion_mlc_l45_firmware rexroth_indramotion_mlc_l65_firmware rexroth_indramotion_mlc_l75_firmware rexroth_indramotion_mlc_l85_firmware rexroth_indramotion_mlc_xm22_firmware rexroth_indramotion_mlc_xm21_firmware +14 more products- Published: Oct. 04, 2021
- Modified: Nov. 21, 2024
-
10.0
CRITICALCVE-2021-23856
The web server is vulnerable to reflected XSS and therefore an attacker might be able to execute scripts on a client’s computer by sending the client a manipulated URL.... Read more
- Published: Oct. 04, 2021
- Modified: Nov. 21, 2024
-
8.6
HIGHCVE-2021-23855
The user and password data base is exposed by an unprotected web server resource. Passwords are hashed with a weak hashing algorithm and therefore allow an attacker to determine the password by using rainbow tables.... Read more
- Published: Oct. 04, 2021
- Modified: Nov. 21, 2024
-
8.3
HIGHCVE-2021-23854
An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. This issue only affects versions 7.7x and 7.6x. All other versions are not affected.... Read more
Affected Products : cpp6_firmware cpp7_firmware cpp7.3_firmware cpp13_firmware cpp6 cpp7 cpp7.3 cpp13- Published: Jun. 09, 2021
- Modified: Nov. 21, 2024
-
9.8
CRITICALCVE-2021-23853
In Bosch IP cameras, improper validation of the HTTP header allows an attacker to inject arbitrary HTTP headers through crafted URLs.... Read more
Affected Products : cpp6_firmware cpp7_firmware cpp7.3_firmware cpp4_firmware cpp13_firmware cpp6 cpp7 cpp7.3 cpp4 cpp13- Published: Jun. 09, 2021
- Modified: Nov. 21, 2024
-
4.9
MEDIUMCVE-2021-23852
An authenticated attacker with administrator rights Bosch IP cameras can call an URL with an invalid parameter that causes the camera to become unresponsive for a few seconds and cause a Denial of Service (DoS).... Read more
Affected Products : cpp6_firmware cpp7_firmware cpp7.3_firmware cpp4_firmware cpp13_firmware cpp6 cpp7 cpp7.3 cpp4 cpp13- Published: Jun. 09, 2021
- Modified: Nov. 21, 2024
-
7.2
HIGHCVE-2021-23851
A specially crafted TCP/IP packet may cause the camera recovery image web interface to crash. It may also cause a buffer overflow which could enable remote code execution. The recovery image can only be booted with administrative rights or with physical a... Read more
Affected Products : autodome_ip_4000i_firmware autodome_ip_5000i_firmware autodome_ip_starlight_5000i_firmware autodome_ip_starlight_7000i_firmware dinion_ip_3000i_firmware dinion_ip_bullet_4000i_firmware dinion_ip_bullet_5000_firmware dinion_ip_bullet_5000i_firmware dinion_ip_bullet_6000i_firmware flexidome_ip_3000i_firmware +126 more products- Published: Mar. 30, 2022
- Modified: Nov. 21, 2024
-
7.2
HIGHCVE-2021-23850
A specially crafted TCP/IP packet may cause a camera recovery image telnet interface to crash. It may also cause a buffer overflow which could enable remote code execution. The recovery image can only be booted with administrative rights or with physical ... Read more
Affected Products : autodome_ip_4000i_firmware autodome_ip_5000i_firmware autodome_ip_starlight_5000i_firmware autodome_ip_starlight_7000i_firmware dinion_ip_3000i_firmware dinion_ip_bullet_4000i_firmware dinion_ip_bullet_5000_firmware dinion_ip_bullet_5000i_firmware dinion_ip_bullet_6000i_firmware flexidome_ip_3000i_firmware +126 more products- Published: Mar. 30, 2022
- Modified: Nov. 21, 2024
-
8.8
HIGHCVE-2021-23849
A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of another user (CSRF - Cross Site Request Forgery). This requires the victim to be tricked into clicking a malicious l... Read more
Affected Products : cpp6_firmware cpp7_firmware cpp7.3_firmware cpp4_firmware cpp13_firmware aviotec_firmware cpp14_firmware cpp6 cpp7 cpp7.3 +4 more products- Published: Aug. 05, 2021
- Modified: Nov. 21, 2024
-
8.3
HIGHCVE-2021-23848
An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the camera address can send a crafted link to a user, which will execute javascript code in the conte... Read more
Affected Products : cpp6_firmware cpp7_firmware cpp7.3_firmware cpp4_firmware cpp13_firmware cpp6 cpp7 cpp7.3 cpp4 cpp13- Published: Jun. 09, 2021
- Modified: Nov. 21, 2024
-
9.8
CRITICALCVE-2021-23847
A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract sensitive information or change settings of the camera by sending crafted requests to the device. Only devices of the CPP6, CPP7 and CPP... Read more
- Published: Jun. 09, 2021
- Modified: Nov. 21, 2024