CVE-2019-11684

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitrary and unauthenticated access to a limited subset of certificates, stored in the underlying Microsoft Windows operating system. The fixed versions implement modified authentication checks. Prior releases of VRM software version 3.70 are considered unaffected. This vulnerability affects VRM v3.70.x, v3.71 < v3.71.0034 and v3.81 < 3.81.0050; DIVAR IP 5000 3.80 < 3.80.0039; BVMS all versions using VRM.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Feb 26, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-116865.5Western Digital SanDisk X300, X300s, X400, and X600 devices: A vulnerability in the wear-leveling algorithm of the drive may cause cryptogra CVE-2019-116877.8An issue was discovered in the DICOM Part 10 File Format in the NEMA DICOM Standard 1995 through 2019b and continuing in current implementat CVE-2019-116887.4An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl accept any cer CVE-2019-116898.1An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl fail to proper CVE-2019-11697.8An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An CVE-2019-116905.9gen_rand_uuid in lib/uuid.c in Das U-Boot v2014.04 through v2019.04 lacks an srand call, which allows attackers to determine UUID values in CVE-2019-116919.8A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called a CVE-2019-116929.8A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a poten CVE-2019-116939.8The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious CVE-2019-116947.5A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a CVE-2019-116954.3A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allo CVE-2019-116967.8Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even though