CVE-2017-7836

The "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of libcurl, which an attacker could replace. This allows for privilege escalation as the replaced libcurl code will run with Firefox's privileges. Note: This attack requires an attacker have local system...

Privilege escalation

The "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of libcurl, which an attacker could replace. This allows for privilege escalation as the replaced libcurl code will run with Firefox's privileges. Note: This attack requires an attacker have local system...

CVE-2017-7836

CVE-2017-7836 affects Mozilla Firefox when running on OS X/Linux, where the pingsender used by Firefox Health Report dynamically loads a system copy of libcurl. An attacker with local access could replace the libcurl binary, causing the replaced code to execute with Firefox’s privileges and enabl...

CVE-2017-7836

The "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of libcurl, which an attacker could replace. This allows for privilege escalation as the replaced libcurl code will run with Firefox's privileges. Note: This attack requires an attacker have local system...

CVE-2017-7836

The "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of libcurl, which an attacker could replace. This allows for privilege escalation as the replaced libcurl code will run with Firefox's privileges. Note: This attack requires an attacker have local system...

Further Down the Trello Rabbit Hole

Last month's story about organizations exposing passwords and other sensitive data via collaborative online spaces at Trello.com only scratched the surface of the problem. A deeper dive suggests a large number of government agencies, marketing firms, healthcare organizations and IT support...

CVE-2016-10684

healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if t...

Remote code execution

healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if t...

CVE-2016-10684

CVE-2016-10684 concerns the healthcenter component of IBM Monitoring and Diagnostic Tools. The vulnerability arises because healthcenter downloads binary resources over HTTP, allowing a man-in-the-middle to intercept or replace the resources, which could lead to remote code execution on the host....

Logic Design Vulnerability in LemHealth APP, a Smart Health Bracelet from Synerchip Technology

LemHealth APP is a health management software. A logical design vulnerability exists in the LemHealth APP, a smart health bracelet from Synergy Technology. An attacker can reset any password and perform unauthorized operations by catching packets and intercepting changes...

healthinfo.gundersenhealth.org XSS vulnerability

Open Bug Bounty ID: OBB-623804 Description| Value ---|--- Affected Website:| healthinfo.gundersenhealth.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| StayWell Solutions Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score...

library.brookwoodbaptisthealth.com XSS vulnerability

Open Bug Bounty ID: OBB-623793 Description| Value ---|--- Affected Website:| library.brookwoodbaptisthealth.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| StayWell Solutions Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3...

healthlibrary.aultcare.com XSS vulnerability

Open Bug Bounty ID: OBB-623785 Description| Value ---|--- Affected Website:| healthlibrary.aultcare.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Staywell Solutions Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6...

Women's private doctor app has logic design flaws

Women's Private Doctor App is a medical application for women. There is a logical design vulnerability in Women's Private Doctor APP. Attackers can view all registered account information leakage, including latitude and longitude positioning, by grabbing packets and modifying them...

health-mall24.com XSS vulnerability

Open Bug Bounty ID: OBB-621403 Description| Value ---|--- Affected Website:| health-mall24.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

How connected devices put health care at risk

The health care industry is one of the most attractive sectors to hackers. Not only do hospitals, doctor offices and other facilities store and have access to an array of patients' personal information, but many organizations also have financial details on file to facilitate billing processes. On...

BD Kiestra and InoquIA Systems (Update A)

1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION : Exploitable from adjacent network Vendor : Becton, Dickinson and Company BD Equipment : BD Kiestra and InoqulA systems Vulnerabilities : Product UI does not Warn User of Unsafe Actions 2. UPDATE INFORMATION This updated advisory is a follow-up to the...

CVE-2018-8849

Medtronic N'Vision Clinician Programmer 8840 N'Vision Clinician Programme and 8870 N'Vision removable Application Card do not encrypt PII and PHI while at rest...

PT-2018-18662 · Medtronic · Medtronic N'Vision Removable Application Card 8870 +1

Name of the Vulnerable Software and Affected Versions: Medtronic N'Vision Clinician Programmer 8840 all versions Medtronic N'Vision removable Application Card 8870 all versions Description: The issue concerns the lack of encryption for personally identifiable information PII and protected health...

Medtronic N'Vision Clinician Programmer (Update A)

1. EXECUTIVE SUMMARY --------- Begin Update A Part 1 of 5 -------- CVSS v3 6.3 --------- End Update A Part 1 of 5 ----------- ATTENTION: Low skill level to exploit Vendor: Medtronic Equipment: N’Vision Clinician Programmer --------- Begin Update A Part 2 of 5 ----------- Vulnerabilities:...