Security News

CVE-2017-12720

National Vulnerability Database - Thu, 02/15/2018 - 05:29
An Improper Access Control issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server on the pump does not require authentication if the pump is configured to allow FTP connections.
Categories: Security News

CVE-2017-12721

National Vulnerability Database - Thu, 02/15/2018 - 05:29
An Improper Certificate Validation issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump does not validate host certificates, leaving the pump vulnerable to a man-in-the-middle (MITM) attack.
Categories: Security News

CVE-2017-12722

National Vulnerability Database - Thu, 02/15/2018 - 05:29
An Out-of-bounds Read issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. A third-party component used in the pump reads memory out of bounds, causing the communications module to crash. Smiths Medical assesses that the crash of the communications module would not impact the operation of the therapeutic module.
Categories: Security News

CVE-2017-12723

National Vulnerability Database - Thu, 02/15/2018 - 05:29
A Password in Configuration File issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump stores some passwords in the configuration file, which are accessible if the pump is configured to allow external communications.
Categories: Security News

CVE-2017-12724

National Vulnerability Database - Thu, 02/15/2018 - 05:29
A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server on the pump contains hardcoded credentials, which are not fully initialized. The FTP server is only accessible if the pump is configured to allow FTP connections.
Categories: Security News

CVE-2017-12725

National Vulnerability Database - Thu, 02/15/2018 - 05:29
A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump with default network configuration uses hard-coded credentials to automatically establish a wireless network connection. The pump will establish a wireless network connection even if the pump is Ethernet connected and active; however, if the wireless association is established and the Ethernet cable is attached, the pump does not attach the network stack to the wireless network. In this scenario, all network traffic is instead directed over the wired Ethernet connection.
Categories: Security News

CVE-2017-12726

National Vulnerability Database - Thu, 02/15/2018 - 05:29
A Use of Hard-coded Password issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. Telnet on the pump uses hardcoded credentials, which can be used if the pump is configured to allow external communications. Smiths Medical assesses that it is not possible to upload files via Telnet and the impact of this vulnerability is limited to the communications module.
Categories: Security News

CVE-2017-18189

National Vulnerability Database - Thu, 02/15/2018 - 05:29
In the startread function in xa.c in Sound eXchange (SoX) through 14.4.2, a corrupt header specifying zero channels triggers an infinite loop with a resultant NULL pointer dereference, which may allow a remote attacker to cause a denial-of-service.
Categories: Security News

CVE-2018-5440

National Vulnerability Database - Thu, 02/15/2018 - 05:29
A Stack-based Buffer Overflow issue was discovered in 3S-Smart CODESYS Web Server. Specifically: all Microsoft Windows (also WinCE) based CODESYS web servers running stand-alone Version 2.3, or as part of the CODESYS runtime system running prior to Version V1.1.9.19. A crafted request may cause a buffer overflow and could therefore execute arbitrary code on the web server or lead to a denial-of-service condition due to a crash in the web server.
Categories: Security News

CVE-2018-7055

National Vulnerability Database - Thu, 02/15/2018 - 05:29
GroupViewProxyServlet in RoomWizard before 4.4.x allows SSRF via the url parameter.
Categories: Security News

CVE-2018-7056

National Vulnerability Database - Thu, 02/15/2018 - 05:29
RoomWizard before 4.4.x allows remote attackers to obtain potentially sensitive information about IP addresses via /getGroupTimeLineJSON.action.
Categories: Security News

CVE-2018-7057

National Vulnerability Database - Thu, 02/15/2018 - 05:29
RoomWizard before 4.4.x allows XSS via the HelpAction.action pageName parameter.
Categories: Security News

Vuln: General Electric D60 Line Distance Relay Multiple Buffer Overflow Vulnerabilities

SecurityFocus Vulnerabilities - Thu, 02/15/2018 - 00:00
General Electric D60 Line Distance Relay Multiple Buffer Overflow Vulnerabilities
Categories: Security News

Vuln: Nortek Linear eMerge E3 Series CVE-2017-5439 Remote Command Injection Vulnerability

SecurityFocus Vulnerabilities - Thu, 02/15/2018 - 00:00
Nortek Linear eMerge E3 Series CVE-2017-5439 Remote Command Injection Vulnerability
Categories: Security News

Vuln: Cisco StarOS CVE-2018-0122 Local Arbitrary File Overwrite Vulnerability

SecurityFocus Vulnerabilities - Thu, 02/15/2018 - 00:00
Cisco StarOS CVE-2018-0122 Local Arbitrary File Overwrite Vulnerability
Categories: Security News

CVE-2018-0847

National Vulnerability Database - Wed, 02/14/2018 - 21:29
Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allow information disclosure, due to how Internet Explorer handles objects in memory, aka "Internet Explorer Information Disclosure Vulnerability".
Categories: Security News

CVE-2018-0850

National Vulnerability Database - Wed, 02/14/2018 - 21:29
Microsoft Outlook 2007, Microsoft Outlook 2010, Microsoft Outlook 2013, Microsoft Outlook 2016, and Microsoft Office 2016 Click-to-Run allow an elevation of privilege vulnerability due to how the format of incoming message is validated, aka "Microsoft Outlook Elevation of Privilege Vulnerability".
Categories: Security News

CVE-2018-0851

National Vulnerability Database - Wed, 02/14/2018 - 21:29
Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due to how Office handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0852.
Categories: Security News

CVE-2018-0852

National Vulnerability Database - Wed, 02/14/2018 - 21:29
Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1 and RT SP1, Microsoft Outlook 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due to how Outlook handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0851.
Categories: Security News

CVE-2018-0853

National Vulnerability Database - Wed, 02/14/2018 - 21:29
Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow an information disclosure vulnerability, due to how Office initializes the affected variable, aka "Microsoft Office Information Disclosure Vulnerability".
Categories: Security News

Pages