CVSS: 7.7EPSS: 0%CPEs: 22EXPL: 0CVE-2023-28175
https://notcve.org/view.php?id=CVE-2023-28175
15 Jun 2023 — Improper Authorization in SSH server in Bosch VMS 11.0, 11.1.0, and 11.1.1 allows a remote authenticated user to access resources within the trusted internal network via a port forwarding request. • https://psirt.bosch.com/security-advisories/BOSCH-SA-025794-bt.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-863: Incorrect Authorization •
CVSS: 7.8EPSS: 0%CPEs: 15EXPL: 0CVE-2020-6785 – Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer
https://notcve.org/view.php?id=CVE-2020-6785
25 Mar 2021 — Loading a DLL through an Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer in versions 10.1.0, 10.0.1, 10.0.0 and 9.0.0 and older potentially allows an attacker to execute arbitrary code on a victim's system. This affects both the installer as well as the installed application. This also affects Bosch DIVAR IP 7000 R2, Bosch DIVAR IP all-in-one 5000 and Bosch DIVAR IP all-in-one 7000 with installers and installed BVMS versions prior to BVMS 10.1.1. Cargar una DLL mediante un Elemento de Ruta de... • https://psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html • CWE-427: Uncontrolled Search Path Element •
CVSS: 8.6EPSS: 1%CPEs: 19EXPL: 0CVE-2020-6768 – Path Traversal in Bosch Video Management System (BVMS)
https://notcve.org/view.php?id=CVE-2020-6768
07 Feb 2020 — A path traversal vulnerability in the Bosch Video Management System (BVMS) NoTouch deployment allows an unauthenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is... • https://psirt.bosch.com/security-advisories/bosch-sa-815013-bt.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.7EPSS: 0%CPEs: 19EXPL: 0CVE-2020-6767 – Path Traversal in Bosch Video Management System (BVMS)
https://notcve.org/view.php?id=CVE-2020-6767
06 Feb 2020 — A path traversal vulnerability in the Bosch Video Management System (BVMS) FileTransferService allows an authenticated remote attacker to read arbitrary files from the Central Server. This affects Bosch BVMS versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch BVMS Viewer versions 10.0 <= 10.0.0.1225, 9.0 <= 9.0.0.827, 8.0 <= 8.0.329 and 7.5 and older. This affects Bosch DIVAR IP 3000, DIVAR IP 7000 and DIVAR IP all-in-one 5000 if a vulnerable BVMS version is ... • https://media.boschsecurity.com/fs/media/pb/security_advisories/bosch-sa-381489-bt_cve-2020-6767_securityadvisory_bvms_pathtraversal.pdf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2017-15290
https://notcve.org/view.php?id=CVE-2017-15290
12 Oct 2017 — Mirasys Video Management System (VMS) 6.x before 6.4.6, 7.x before 7.5.15, and 8.x before 8.1.1 has a login process in which cleartext data is sent from a server to a client, and not all of this data is required for the client functionality. Mirasys Video Management System (VMS) en versiones 6.x anteriores a la 6.4.6, 7.x anteriores a la 7.5.15 y 8.x anteriores a la 8.1.1 tiene un proceso de login en el que se envían datos en texto en claro desde un servidor a un cliente y no se necesitan todos estos datos ... • https://ipvm.com/forums/video-surveillance/topics/mirasys-happy-with-bad-security-unless-hit-with-bad-press • CWE-319: Cleartext Transmission of Sensitive Information •