79 matches found
Medtronic Defibrillators Have Critical Flaws, Warns DHS
The Department of Homeland Security has issued an emergency alert warning of critical flaws allowing attackers to tamper with several Medtronic medical devices, including defibrillators. The two vulnerabilities – comprised of a medium and critical-severity flaw – exist in 20 products made by the...
Medtronic Conexus Radio Frequency Telemetry Protocol (Update C)
1. EXECUTIVE SUMMARY CVSS v3 9.3 ATTENTION: Exploitable with adjacent access/low attack complexity Vendor: Medtronic Equipment: MyCareLink Monitor, CareLink Monitor, CareLink 2090 Programmer, specific Medtronic implanted cardiac devices listed below Vulnerabilities: Improper Access Control,...
e-katalog.ru XSS vulnerability
Open Bug Bounty ID: OBB-653877 Description| Value ---|--- Affected Website:| e-katalog.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Code injection
The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-654...
Code injection
The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by being in close proximity to the Bluetooth device, effectively exposing the device ID. The ID can be used to track devices. Updated apps,...
Code injection
TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-653...
CVE-2016-6538
The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-654...
CVE-2016-6541 TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes
TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-653...
CVE-2016-6538
The TrackR Bravo app stores the account password for cloud authentication in cleartext in cache.db (affected in all reports). Affected versions are iOS 5.1.6 and Android 2.2.5; vendors released updates to address CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541. CVSS data indicate pa...
CVE-2016-6538 TrackR Bravo mobile application stores account passwords in cleartext
The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-654...
CVE-2018-6538
CVE-2018-6538 is rejected/not used and does not represent an active vulnerability entry.
CVE-2013-6538
CVE-2013-6538 is rejected/not used per the Initial Description.
CVE-2017-6538
A Cross-Site Scripting XSS issue was discovered in webpagetest 3.0. The vulnerability exists due to insufficient filtration of user-supplied data video passed to the webpagetest-master/www/speedindex/index.php URL. An attacker could execute arbitrary HTML and script code in a browser in the conte...
CVE-2017-6538
CVE-2017-6538 concerns an XSS vulnerability in webpagetest 3.0 where user-supplied data (video) passed to webpagetest-master/www/speedindex/index.php is not properly filtered, allowing an attacker to inject arbitrary HTML/JavaScript in the victim’s browser. The issue is triggered via insufficient...
TrackR Bravo contains multiple vulnerabilities
Overview TrackR Bravo contains multiple vulnerabilities including sensitive information exposure and missing authentication. Description CWE-313:Cleartext Storage in a File or on Disk - CVE-2016-6538The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in...
CVE-2015-6538
CVE-2015-6538 affects Epiphany Cardio Server login page: improper handling of authentication requests enables an LDAP injection via a crafted URL, bypassing access controls. Impacted versions are 3.3, 4.0, and 4.1, potentially allowing unauthenticated attackers to bypass authentication and access...
Epiphany Cardio Server is vulnerable to SQL and LDAP injection
Overview The Epiphany Cardio Server is vulnerable to SQL injection and LDAP injection, allowing an unauthenticated attacker to gain administrator rights. Description Epiphany Cardio Server was reported as being vulnerable to the following issues:CWE-89: Improper Neutralization of Special Elements...
Design/Logic Flaw
Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2014-4294, CVE-2014-4295, and CVE-2014-6538...