301 matches found
CVE-2024-53457
A stored cross-site scripting XSS vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name parameter...
CVE-2024-53457
A stored cross-site scripting XSS vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name parameter...
CVE-2024-48973
The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port which are unencrypted; see 3.2.1 that result in unauthorized disclosure of information and/or have unintended impacts on device settings and...
CVE-2024-48966
The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC where the tools are installed could obtain diagnostic information through the test tool or manipulate the ventilator's settings and embedde...
CVE-2024-48966
The CVE-2024-48966 case affects Baxter Life2000 ventilator software tools used for testing and calibration, where the test/calibration tools do not require authentication. The root cause is lack of user authentication on these tools, enabling an attacker with access to the Service PC to obtain di...
CVE-2024-48966 Life2000 service tools for test and calibration do not support user authentication
The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC where the tools are installed could obtain diagnostic information through the test tool or manipulate the ventilator's settings and embedde...
CVE-2024-48973 Debug port on Life2000 Ventilator serial interface is enabled by default
The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port which are unencrypted; see 3.2.1 that result in unauthorized disclosure of information and/or have unintended impacts on device settings and...
CVE-2024-48973
The CVE-2024-48973 entry concerns Baxter Life2000/Life2000 ventilator devices with the debug port on the serial interface enabled by default. Concrete details: debugging is unencrypted and may allow unauthorized disclosure of information and unintended changes to device settings or performance. I...
CVE-2024-48973 Debug port on Life2000 Ventilator serial interface is enabled by default
The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port which are unencrypted; see 3.2.1 that result in unauthorized disclosure of information and/or have unintended impacts on device settings and...
CVE-2024-9832
There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execute a brute-force attack to gain unauthorized access to the ventilator, and then make changes to device settings that could disrupt the...
CVE-2024-9834
Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance...
CVE-2024-9832 No limit on failed login attempts with Clinician Password or Serial Number Clinician Password on Life2000 Ventilator
There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execute a brute-force attack to gain unauthorized access to the ventilator, and then make changes to device settings that could disrupt the...
CVE-2024-9832 No limit on failed login attempts with Clinician Password or Serial Number Clinician Password on Life2000 Ventilator
There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execute a brute-force attack to gain unauthorized access to the ventilator, and then make changes to device settings that could disrupt the...
CVE-2024-9834 Improper data protection on Life2000 ventilator serial interface
Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance...
CVE-2024-9834
CVE-2024-9834 affects the Baxter Life2000 ventilator via the serial interface, where improper data protection could let an attacker send/receive messages and cause unauthorized disclosure or unintended changes to device settings/performance. The ICS advisory lists concrete weaknesses contributing...
Baxter Life2000 访问控制错误漏洞
The Baxter Life2000 is a mask-less non-invasive ventilator from Baxter. An access control error vulnerability exists in Baxter Life2000 version 06.08.00.00 and prior, which stems from unsupported user authentication, allowing an attacker to obtain diagnostic information or manipulate device...
PT-2024-39874 · Unknown · Ventilator
Name of the Vulnerable Software and Affected Versions: Ventilator affected versions not specified Description: The issue concerns improper data protection on the ventilator's serial interface. This could allow an attacker to send and receive messages, resulting in unauthorized disclosure of...
SoftBank Mesh Wi-Fi router RP562B 安全漏洞
SoftBank Mesh Wi-Fi router RP562B is a router from SoftBank Japan. A security vulnerability exists in SoftBank Mesh Wi-Fi router RP562B version 1.0.2 and earlier, which stems from an active debugging code vulnerability that could allow an attacker to obtain or change the settings of the device...
CVE-2024-41999
Smart-tab Android app installed April 2023 or earlier contains an active debug code vulnerability. If this vulnerability is exploited, an attacker with physical access to the device may exploit the debug function to gain access to the OS functions, escalate the privilege, change the device's...
CVE-2024-41999
Smart-tab Android app installed April 2023 or earlier contains an active debug code vulnerability. If this vulnerability is exploited, an attacker with physical access to the device may exploit the debug function to gain access to the OS functions, escalate the privilege, change the device's...