GSD-2022-1000285 Unsafe default configuration values in Nginx version all version

INFORMATIONAL In Nginx, all versions, a number of unsafe default configuration values exists in the web server that can be attacked via the network resulting in disclosure of information and availability. These include but are not limited to: 1. Not enough file descriptors per worker 2. The...

CVE-2021-3914

It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to conduct cross-site scripting attacks...

CVE-2022-22765

BD Viper LT system, versions 2.0 and later, contains hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information ePHI, protected health information PHI and personally identifiable information...

On the Irish Health Services Executive Hack

A detailed report of the 2021 ransomware attack against Ireland’s Health Services Executive lists some really bad security practices: The report notes that: The HSE did not have a Chief Information Security Officer CISO or a “single responsible owner for cybersecurity at either senior executive o...

BD Viper LT 信任管理问题漏洞

BD Viper LT is a fully automated, integrated molecular test from BD Medical, Inc. The BD Viper LT suffers from a trust management issue vulnerability that can be exploited by an attacker to threaten participants who may be able to access, modify, or delete sensitive information, including protect...

BD Pyxis 信任管理问题漏洞

BD Pyxis is a medication management system from Bidi Medical BD. BD Pyxis has a security vulnerability that stems from the use of hard-coded credentials in certain BD Pyxis products. If exploited, a threat participant could gain access to the underlying file system and potentially utilize...

PT-2022-16620

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2021.2 Description The issue allows health items of pull requests to be shown to users who lack appropriate permissions. Recommendations For versions prior to 2021.2, update to version 2021.2 or later to...

focus30.health-line.me Cross Site Scripting vulnerability OBB-2362263

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| focus30.health-line.me ---|--- Open Bug...

The vulnerability of the centralized system for managing emergency messages and events in CAMS for HIS distributed control systems CENTUM VP and CENTUM VP Entry Class, along with the OPC-server Exaopc, allows a perpetrator to execute arbitrary codes.

The vulnerability of the centralized system for managing emergency messages and events in CAMS for HIS distributed control systems CENTUM VP and CENTUM VP Entry Class, along with the OPC-server Exaopc, lies in the loading of a non-existent dynamic library. Exploiting this vulnerability could allo...

Virtuozzo Hybrid Infrastructure 5.0 (5.0.0-137)

In this release, Virtuozzo Hybrid Infrastructure provides a wide range of new features that enhance service providers' interoperability and help expand their services. The improvements cover compute services, object storage, security, and monitoring. Additionally, this release delivers stability...

health-rise.de Cross Site Scripting vulnerability OBB-2357825

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

sNOTE Holders Are Not Incetivized To Vote On Proposals To Call extractTokensForCollateralShortfall

Handle leastwood Vulnerability details Impact As sNOTE have governance voting rights equivalent to the token amount in NOTE, users who stake their NOTE are also able to vote on governance proposals. In the event a majority of NOTE is staked in the sNOTE contract, it doesn't seem likely that stake...

Unpatched Security Bugs in Medical Wearables Allow Patient Tracking, Data Theft

Telehealth care is on the rise as medical service providers cope with the strain of a pandemic and rising costs. But the rush to roll out remote healthcare has also unleashed a universe of wearable medical devices to collect sensitive data, which researchers say are widely vulnerable to attack...

brooklynhealthworks.com Cross Site Scripting vulnerability OBB-2349553

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

[SECURITY] Fedora 35 Update: zabbix-5.0.19-1.fc35

Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechanism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...

[SECURITY] Fedora 34 Update: zabbix-5.0.19-1.fc34

Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechanism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...

CVE-2022-23365

HMS v1.0 was discovered to contain a SQL injection vulnerability via doctorlogin.php...

Beijing Olympics App Flaws Allow Man-in-the-Middle Attacks

The mobile app that all attendees and athletes of the upcoming Beijing Winter Olympics must use to manage communications and documentation at the event has a “devastating” flaw in the way it encrypts data that can allow for man-in-the-middle attacks that access sensitive user information,...

Vulnerability fixed in Oracle Health Sciences Applications

Oracle has fixed a vulnerability in the following products: Thesaurus Management System Clinical Health Sciences Clinical Development Analytics Argus Safety Argus Insight Argus Analytics Health Sciences InForm CRF Submit Argus Mart ------------------.------.------------------------------------- |...

uDoctorAppointment v2.1.1 - (Multiple) Cross Site Scripting Vulnerability

Exploit Title: uDoctorAppointment v2.1.1 - 'Multiple' Cross Site Scripting XSS Document Title: =============== uDoctorAppointment v2.1.1 - Multiple XSS Vulnerabilities Product & Service Introduction: =============================== Clinic management, doctor or therapist online medical appointment...