多款Bosch产品操作系统命令注入漏洞

Bosch Access Professional Edition and others are products of Bosch, Germany.Bosch Access Professional Edition is an enterprise access control and security management solution.Bosch VRM is an application.Bosch BVMS is an application... Bosch BVMS is an application software. An operating system...

PT-2021-15573

Name of the Vulnerable Software and Affected Versions: VRM affected versions not specified DIVAR IP with VRM installed affected versions not specified BVMS with VRM installed affected versions not specified Description: An error in a page handler of the VRM may lead to a reflected cross site...

Security at Scale in the Open-Source Supply Chain

“We’ve all heard of paying it forward, but this is ridiculous!” That’s probably what most of us think when one of our partners or vendors inadvertently leaves an open door into our shared supply-chain network; an attacker can enter at any time. Well, we probably think in slightly more...

Navigating Vendor Risk Management as IT Professionals

One of the great resources available to businesses today is the large ecosystem of value-added services and solutions. Especially in technology solutions, there is no end to the services of which organizations can avail themselves. In addition, if a business needs a particular solution or service...

Unauthorized Access Vulnerability in VRM of Bosch (China) Investment Ltd (CNVD-2021-33408)

Bosch China Investment Co., Ltd. operates in the fields of machinery manufacturing, light industry, electronics and information industry. An unauthorized access vulnerability exists in the VRM of Bosch China Investment Co. Ltd. that can be exploited by attackers to obtain sensitive information...

CVE-2019-11684

Improper Access Control in the RCP+ server of the Bosch Video Recording Manager VRM component allows arbitrary and unauthenticated access to a limited subset of certificates, stored in the underlying Microsoft Windows operating system. The fixed versions implement modified authentication checks...

Improper access control

Improper Access Control in the RCP+ server of the Bosch Video Recording Manager VRM component allows arbitrary and unauthenticated access to a limited subset of certificates, stored in the underlying Microsoft Windows operating system. The fixed versions implement modified authentication checks...

CVE-2019-11684

The CVE-2019-11684 entry covers an improper access control flaw in the RCP+ server of the Bosch Video Recording Manager (VRM) component. It allows arbitrary, unauthenticated access to a limited subset of certificates stored by Windows. Affected products/versions include VRM v3.70.x, VRM v3.71 up ...

PT-2021-8900

Name of the Vulnerable Software and Affected Versions Bosch Video Recording Manager VRM versions 3.70.x through 3.71.0033 Bosch Video Recording Manager VRM versions 3.71.0034 through 3.80.0038 are not affected, however versions 3.81 through 3.81.0049 DIVAR IP 5000 versions 3.80 through 3.80.0038...

Building a Holistic VRM Strategy That Includes the Web Application Layer

Building security into your overall vulnerability risk management VRM strategy is a must-do in the age of the all-important web app. Between security and IT-Ops teams, there are a number of steps in the VRM process, including asset identification, enumeration, prioritization, and remediation. How...

Upcoming Rapid7 Webcast: How Far Does Your VRM Strategy Go?

Web applications have been growing in complexity over the past several years, while also becoming the preferred method for attackers looking to capitalize on emergent technologies. This is a trend that will only persist and evolve, so it’s crucial to extend your web application testing strategy t...

Defining Vulnerability Risk Management (and How to Build a Modern VRM Program)

Once upon a time just a handful of years ago, vulnerability management programs focused solely on servers, running quarterly scans that targeted only critical systems. But that was then, and you can’t afford such a limited view in the now. Truth is, vulnerability exploitation now happens...

Security Bulletin: Vulnerability in Apache Tomcat affects IBM Spectrum Protect Plus (CVE-2020-1938)

Summary An Apache Tomcat vulnerability which could allow a remote attacker to execute arbitrary code on the system affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2020-1938 DESCRIPTION: Apache Tomcat could allow a remote attacker to execute arbitrary code on the system, caused...

Security Bulletin: Vulnerability in Swagger affects IBM Spectrum Protect Plus (CVE-2019-17495)

Summary A security vulnerability in Swagger which could allow a remote attacker to obtain sensitive information affects IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2019-17495 DESCRIPTION: Swagger UI could allow a remote attacker to obtain sensitive information, caused by a CSS...

CVE-2019-6957

CVE-2019-6957 affects Bosch products including BVMS ≤ v9.0, DIVAR IP 2000–7000, VRM, VSG, Configuration Manager, BIS with Video Engine, APE, AEC, BV C, and VSDK. The issue is described as a buffer overflow vulnerability that potentially allows unauthorized code execution over the network interfac...

CVE-2019-8952: Improper Limitation of a Pathname to a Restricted Directory

A Path Traversal vulnerability located in the webserver affects several Bosch hardware and software products. The vulnerability potentially allows a remote authorized user to access arbitrary files on the system via the network interface. Affected hardware products: Bosch DIVAR IP 2000 vulnerable...

PT-2019-19278

Name of the Vulnerable Software and Affected Versions Bosch DIVAR IP 2000 versions 3.10 through 3.62 Bosch DIVAR IP 5000 versions 3.10 through 3.62 Video Recording Manager VRM versions 3.10 through 3.71 before 3.71.0032 Bosch Video Management System BVMS versions 3.50.00XX through 3.70.0056...

Security Bulletin: Cross-Site Scripting vulnerabilities in IBM Spectrum Protect Operations Center (CVE-2018-1854, CVE-2018-1855)

Summary IBM Spectrum Protect formerly Tivoli Storage Manager Operations Center is vulnerable to cross-site scripting which can result in disclosure of credentials within a trusted session. Vulnerability Details CVEID: CVE-2018-1854 DESCRIPTION: IBM Tivoli Storage Manager Operations Center is...

Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private and IBM Cloud Private Cloud Foundry (CVE-2018-7167, CVE-2018-7164, CVE-2018-7162, CVE-2018-1000168, CVE-2018-7161)

Summary IBM Cloud Private and IBM Cloud Private Cloud Foundry are vulnerable to multiple security vulnerabilities Vulnerability Details CVEID: CVE-2018-7167 DESCRIPTION: Node.js is vulnerable to a denial of service. By invoking Buffer.fill or Buffer.alloc , a remote attacker could exploit this...

Security Bulletin: Tivoli Storage Manager (IBM Spectrum Protect) AIX Client Buffer Overflow (CVE-2016-5985)

Summary The Tivoli Storage Manager IBM Spectrum Protect AIX client is vulnerable to a buffer overflow when Journal-Based Backup is enabled allowing a local attacker to execute arbitrary code on the system or cause a system crash. Vulnerability Details CVEID: CVE-2016-5985 DESCRIPTION: The IBM...