CVE-2020-6785

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Loading a DLL through an Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer in versions 10.1.0, 10.0.1, 10.0.0 and 9.0.0 and older potentially allows an attacker to execute arbitrary code on a victim's system. This affects both the installer as well as the installed application. This also affects Bosch DIVAR IP 7000 R2, Bosch DIVAR IP all-in-one 5000 and Bosch DIVAR IP all-in-one 7000 with installers and installed BVMS versions prior to BVMS 10.1.1.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published
Mar 25, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-67867.8Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Recording Manager installer up to and including version 3.82.00CVE-2020-67877.8Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Client installer up to and including version 1.7.6.079 potentiaCVE-2020-67887.8Loading a DLL through an Uncontrolled Search Path Element in the Bosch Configuration Manager installer up to and including version 7.21.0078CVE-2020-67897.8Loading a DLL through an Uncontrolled Search Path Element in the Bosch Monitor Wall installer up to and including version 10.00.0164 potentiCVE-2020-67907.8Calling an executable through an Uncontrolled Search Path Element in the Bosch Video Streaming Gateway installer up to and including versionCVE-2020-67924.3When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents. This vulnerability affeCVE-2020-67936.5When processing an email message with an ill-formed envelope, Thunderbird could read data from a random memory location. This vulnerability CVE-2020-67946.5If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessCVE-2020-67956.5When processing a message that contains multiple S/MIME signatures, a bug in the MIME processing code caused a null pointer dereference, leaCVE-2020-67968.8A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write. CVE-2020-67974.3By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer.CVE-2020-67986.1If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing and execution when it should not be al