CVE-2020-27262

Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 A stored cross-site scripting XSS vulnerability exists in the affected products that allow an attacker to inject arbitrary web script or HTML via the filename parameter to multiple update endpoints of the administrative web...

CVE-2020-27260

Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 HL7 v2.x injection vulnerabilities exist in the affected products that allow physically proximate attackers with a connected barcode reader to inject HL7 v2.x segments into specific HL7 v2.x messages via multiple expected...

CVE-2020-27262

Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 A stored cross-site scripting XSS vulnerability exists in the affected products that allow an attacker to inject arbitrary web script or HTML via the filename parameter to multiple update endpoints of the administrative web...

Design/Logic Flaw

Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 HL7 v2.x injection vulnerabilities exist in the affected products that allow physically proximate attackers with a connected barcode reader to inject HL7 v2.x segments into specific HL7 v2.x messages via multiple expected...

Cross site scripting

Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 A stored cross-site scripting XSS vulnerability exists in the affected products that allow an attacker to inject arbitrary web script or HTML via the filename parameter to multiple update endpoints of the administrative web...

CVE-2020-27260

Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 HL7 v2.x injection vulnerabilities exist in the affected products that allow physically proximate attackers with a connected barcode reader to inject HL7 v2.x segments into specific HL7 v2.x messages via multiple expected...

CVE-2020-27260

CVE-2020-27260 affects Innokas Yhtymä Oy Vital Signs Monitor VC150 (pre-1.7.15). The vuln is an HL7 v2.x injection in HL7 messages triggered by multiple parameters, exploitable by physically proximate attackers with a connected barcode reader. The CVSS v3 base score is 5.3 (NEIGHBOR, HIGH integri...

CVE-2020-27262

Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 A stored cross-site scripting XSS vulnerability exists in the affected products that allow an attacker to inject arbitrary web script or HTML via the filename parameter to multiple update endpoints of the administrative web...

CVE-2020-27262

The CVE-2020-27262 issue affects Innokas Yhtymä Oy Vital Signs Monitor VC150, prior to Version 1.7.15. A stored cross-site scripting (XSS) vulnerability exists in the administrative web interface that allows an attacker to inject arbitrary web script or HTML via the filename parameter to multiple...

PT-2021-11350

Name of the Vulnerable Software and Affected Versions: Innokas Yhtymä Oy Vital Signs Monitor VC150 versions prior to 1.7.15 Description: The issue allows physically proximate attackers with a connected barcode reader to inject HL7 v2.x segments into specific HL7 v2.x messages via multiple expecte...

PT-2021-11351

Name of the Vulnerable Software and Affected Versions: Innokas Yhtymä Oy Vital Signs Monitor VC150 versions prior to 1.7.15 Description: A stored cross-site scripting issue exists in the affected product, allowing an attacker to inject arbitrary web script or HTML via the filename parameter to...

CVE-2020-27260: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 HL7 v2.x injection vulnerabilities exist in the affected products that allow physically proximate attackers with a connected barcode reader to inject HL7 v2.x segments into specific HL7 v2.x messages via multiple expected...

CVE-2020-27262: Improper Neutralization of Input During Web Page Generation

Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 A stored cross-site scripting XSS vulnerability exists in the affected products that allow an attacker to inject arbitrary web script or HTML via the filename parameter to multiple update endpoints of the administrative web...

Innokas Yhtymä Oy Vital Signs Monitor

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Innokas Yhtymä Oy Equipment: Vital Signs Monitor VC150 Vulnerabilities: Cross-site Scripting, Improper Neutralization of Special Elements in Output Used by a Downstream Component 2. RISK EVALUATION...

Innokas Medical Innokas Yhtyma Oy Vital Signs Monitor Cross-Site Scripting Vulnerability

Innokas Medical Innokas Yhtyma Oy Vital Signs Monitor is a monitor from Innokas Medical that measures blood pressure, body temperature, respiratory rate and pulse rate. A cross-site scripting vulnerability exists in Innokas Yhtyma Oy Vital Signs Monitor VC150 prior to Version 1.7.15, which allows...

Innokas Medical Innokas Yhtyma Oy Vital Signs Monitor Injection Vulnerability

Innokas Medical Innokas Yhtyma Oy Vital Signs Monitor is a monitor from Innokas Medical that measures blood pressure, body temperature, respiratory rate and pulse rate. Innokas Yhtyma Oy Vital Signs Monitor VC150 to Version 1.7.15 suffers from injection vulnerabilities that allow an attacker to...

Vulnerability fixed in FortiGate

A remotely authenticated malicious person is able to view the log entries of SSL VPN events from users in other VDOMs by executing "get vpn ssl monitor" from the command line. The sensitive data includes usernames, user groups and IP addresses. FortiGuard has made updates available to fix the...

Security Bulletin: Enterprise Content Management System Monitor is affected by a vulnerability in IBM® SDK Java™ Technology Edition

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 used by Enterprise Content Management System Monitor. Enterprise Content Management System Monitor has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-2590 DESCRIPTION: An unspecified...

PT-2021-30878

Name of the Vulnerable Software and Affected Versions FortiOS versions prior to 6.2.5 FortiOS version 6.0.10 and below Description The issue allows remote authenticated actors to read the SSL VPN events log entries of users in other VDOMs by executing get vpn ssl monitor from the CLI. The sensiti...

New Relic: Stored XSS via malicious key value of Synthetics monitor tag when visiting an Insights dashboard with filtering enabled

Introduction & Context This is a complex XSS that requires multiple steps in order to setup. It also requires you to have a good understanding of both New Relic Insights, New Relic Synthetics monitors, and the NerdGraph API explorer. Background Context: New Relic Synthetics and the history of tag...