CVE-2021-23862 Authenticated Remote Code Execution

A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affects installations of the VRM, DIVAR IP, BVMS with VRM installed, the VIDEOJET decoder VJD-7513 and VJD-8000...

CVE-2021-23861 Possible Access to Debug Functions in Bosch VRM / BVMS

By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impact on integrity or availability of the installed software. This issue also affects installations of the DIVAR IP and BVMS with VRM installed...

CVE-2021-23861

CVE-2021-23861 affects Bosch VRM and related BVMS/DIVAR IP deployments with VRM installed. The issue allows an administrative user to execute a command that grants access to extended debug functionality, potentially impacting integrity and availability of the installed software. Affected products...

CVE-2021-23860

CVE-2021-23860 describes a reflected XSS in Bosch VRM/web interfaces due to an error in a page handler that allows an attacker to modify the HTTP header to exploit the vulnerability. The issue also affects DIVAR IP and BVMS with VRM installed. Publicly available details identify the affected comp...

CVE-2021-23860 Reflected Cross Site Scripting (XSS) vulnerability in Bosch VRM / BVMS

An error in a page handler of the VRM may lead to a reflected cross site scripting XSS in the web-based interface. To exploit this vulnerability an attack must be able to modify the HTTP header that is sent. This issue also affects installations of the DIVAR IP and BVMS with VRM installed...

CVE-2021-23859 Denial of Service and Authentication Bypass Vulnerability in multiple Bosch products

An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standalone VRM or BVMS with VRM installation this crash also opens the possibility to send further unauthenticated commands to the service. On some products the interface is only local...

多款Bosch产品操作系统命令注入漏洞

Bosch Access Professional Edition and others are products of Bosch, Germany.Bosch Access Professional Edition is an enterprise access control and security management solution.Bosch VRM is an application.Bosch BVMS is an application... Bosch BVMS is an application software. An operating system...

CVE-2021-23861

By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impact on integrity or availability of the installed software. This issue also affects installations of the DIVAR IP and BVMS with VRM installed...

PT-2021-15575 · Bosch · Vrm +3

Name of the Vulnerable Software and Affected Versions: BVMS with VRM installed versions affected versions not specified DIVAR IP versions affected versions not specified VIDEOJET decoder versions affected versions not specified VRM versions affected versions not specified Description: A crafted...

Security at Scale in the Open-Source Supply Chain

“We’ve all heard of paying it forward, but this is ridiculous!” That’s probably what most of us think when one of our partners or vendors inadvertently leaves an open door into our shared supply-chain network; an attacker can enter at any time. Well, we probably think in slightly more...

Navigating Vendor Risk Management as IT Professionals

One of the great resources available to businesses today is the large ecosystem of value-added services and solutions. Especially in technology solutions, there is no end to the services of which organizations can avail themselves. In addition, if a business needs a particular solution or service...

Unauthorized Access Vulnerability in VRM of Bosch (China) Investment Ltd (CNVD-2021-33408)

Bosch China Investment Co., Ltd. operates in the fields of machinery manufacturing, light industry, electronics and information industry. An unauthorized access vulnerability exists in the VRM of Bosch China Investment Co. Ltd. that can be exploited by attackers to obtain sensitive information...

CVE-2019-11684

Improper Access Control in the RCP+ server of the Bosch Video Recording Manager VRM component allows arbitrary and unauthenticated access to a limited subset of certificates, stored in the underlying Microsoft Windows operating system. The fixed versions implement modified authentication checks...

Improper access control

Improper Access Control in the RCP+ server of the Bosch Video Recording Manager VRM component allows arbitrary and unauthenticated access to a limited subset of certificates, stored in the underlying Microsoft Windows operating system. The fixed versions implement modified authentication checks...

CVE-2019-11684

The CVE-2019-11684 entry covers an improper access control flaw in the RCP+ server of the Bosch Video Recording Manager (VRM) component. It allows arbitrary, unauthenticated access to a limited subset of certificates stored by Windows. Affected products/versions include VRM v3.70.x, VRM v3.71 up ...

Building a Holistic VRM Strategy That Includes the Web Application Layer

Building security into your overall vulnerability risk management VRM strategy is a must-do in the age of the all-important web app. Between security and IT-Ops teams, there are a number of steps in the VRM process, including asset identification, enumeration, prioritization, and remediation. How...

Upcoming Rapid7 Webcast: How Far Does Your VRM Strategy Go?

Web applications have been growing in complexity over the past several years, while also becoming the preferred method for attackers looking to capitalize on emergent technologies. This is a trend that will only persist and evolve, so it’s crucial to extend your web application testing strategy t...

Defining Vulnerability Risk Management (and How to Build a Modern VRM Program)

Once upon a time just a handful of years ago, vulnerability management programs focused solely on servers, running quarterly scans that targeted only critical systems. But that was then, and you can’t afford such a limited view in the now. Truth is, vulnerability exploitation now happens...

Security Bulletin: Vulnerability in Apache Tomcat affects IBM Spectrum Protect Plus (CVE-2020-1938)

Summary An Apache Tomcat vulnerability which could allow a remote attacker to execute arbitrary code on the system affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-1938 DESCRIPTION: Apache Tomcat could allow a remote attacker to execute arbitrary code on the system, caused...

Security Bulletin: Vulnerability in Swagger affects IBM Spectrum Protect Plus (CVE-2019-17495)

Summary A security vulnerability in Swagger which could allow a remote attacker to obtain sensitive information affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-17495 DESCRIPTION: Swagger UI could allow a remote attacker to obtain sensitive information, caused by a CSS...