CVE-2019-11603

CVE-2019-11603 describes an HTTP path traversal in ProSyst mBS SDK prior to 8.2.6 and Bosch IoT Gateway Software prior to 9.0.2, enabling remote attackers to read files outside the HTTP root. Affected components: ProSyst mBS SDK <8.2.6 and Bosch IoT Gateway Software

CVE-2019-11603 Path traversal in ProSyst mBS SDK and Bosch IoT Gateway Software

A HTTP Traversal Attack in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.0.2 allows remote attackers to read files outside the http root...

CVE-2019-11602

This CVE affects older releases of ProSyst mBS SDK and Bosch IoT Gateway Software, where remote access to backup and restore leaks stack traces that reveal filesystem structure. Affected components are the backup/restore functionality in ProSyst mBS SDK prior to 8.2.6 and Bosch IoT Gateway Softwa...

CVE-2019-11602 Leakage of stack traces in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software

Leakage of stack traces in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to gather information about the file system structure...

CVE-2019-11601

This CVE describes a directory traversal vulnerability in the remote access to the backup and restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software. Affected products and versions: ProSyst mBS SDK before 8.2.6; Bosch IoT Gateway Software before 9.2.0. Root cause, as stated in th...

CVE-2019-11601 Path traversal in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software

A directory traversal vulnerability in remote access to backup & restore in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.2.0 allows remote attackers to write or delete files at any location...

CVE-2019-11897

The CVE-2019-11897 issue is a Server-Side Request Forgery (SSRF) in the backup & restore functionality of older ProSyst mBS SDK releases (before 8.2.6) and Bosch IoT Gateway Software (before 9.3.0). The vulnerability allows a remote attacker to forge GET requests to arbitrary URLs, potentially en...

CVE-2019-11897 Server-side request forgery in the backup & restore functionality of ProSyst mBS SDK and Bosch IoT Gateway Software

A Server-Side Request Forgery SSRF vulnerability in the backup & restore functionality in earlier versions than ProSyst mBS SDK 8.2.6 and Bosch IoT Gateway Software 9.3.0 allows a remote attacker to forge GET requests to arbitrary URLs. In addition, this could potentially allow an attacker to rea...

PT-2019-12408 · Bosch +1 · Bosch Iot Gateway +1

Name of the Vulnerable Software and Affected Versions: ProSyst mBS SDK versions prior to 8.2.6 Bosch IoT Gateway Software versions prior to 9.2.0 Description: A directory traversal issue exists in the remote access to backup and restore functionality, allowing remote attackers to write or delete...

CVE-2019-11895

A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller SHC before 9.8.905 that may result in a successful denial of service of the SHC and connected sensors and actuators. In order to exploit the vulnerability, the adversary needs to...

CVE-2019-11896

A potential incorrect privilege assignment vulnerability exists in the 3rd party pairing mechanism of the Bosch Smart Home Controller SHC before 9.8.907 that may result in a restricted app obtaining default app permissions. In order to exploit the vulnerability, the adversary needs to have...

CVE-2019-11894

A potential improper access control vulnerability exists in the backup mechanism of the Bosch Smart Home Controller SHC before 9.8.905 that may result in unauthorized download of a backup. In order to exploit the vulnerability, the adversary needs to download the backup directly after a backup...

CVE-2019-11896

A potential incorrect privilege assignment vulnerability exists in the 3rd party pairing mechanism of the Bosch Smart Home Controller SHC before 9.8.907 that may result in a restricted app obtaining default app permissions. In order to exploit the vulnerability, the adversary needs to have...

CVE-2019-11894

A potential improper access control vulnerability exists in the backup mechanism of the Bosch Smart Home Controller SHC before 9.8.905 that may result in unauthorized download of a backup. In order to exploit the vulnerability, the adversary needs to download the backup directly after a backup...

CVE-2019-11895

A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller SHC before 9.8.905 that may result in a successful denial of service of the SHC and connected sensors and actuators. In order to exploit the vulnerability, the adversary needs to...

Improper access control

A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller SHC before 9.8.905 that may result in a successful denial of service of the SHC and connected sensors and actuators. In order to exploit the vulnerability, the adversary needs to...

Privilege escalation

A potential incorrect privilege assignment vulnerability exists in the 3rd party pairing mechanism of the Bosch Smart Home Controller SHC before 9.8.907 that may result in a restricted app obtaining default app permissions. In order to exploit the vulnerability, the adversary needs to have...

Improper access control

A potential improper access control vulnerability exists in the backup mechanism of the Bosch Smart Home Controller SHC before 9.8.905 that may result in unauthorized download of a backup. In order to exploit the vulnerability, the adversary needs to download the backup directly after a backup...

CVE-2019-11892

A potential improper access control vulnerability exists in the JSON-RPC interface of the Bosch Smart Home Controller SHC before 9.8.905 that may result in reading or modification of the SHC's configuration or triggering and restoring backups. In order to exploit the vulnerability, the adversary...

Privilege escalation

A potential incorrect privilege assignment vulnerability exists in the app permission update API of the Bosch Smart Home Controller SHC before 9.8.905 that may result in a restricted app obtaining default app permissions. In order to exploit the vulnerability, the adversary needs to have...