Medical software firm leakes personal data of 3.1 million patients

By Zara Khan Somehow, the misconfigured Elasticsearch cluster did not contain medical data of patients. This is a post from HackRead.com Read the original post: Medical software firm leakes personal data of 3.1 million patients...

LibreHealth EHR Local File Inclusion Vulnerability

LibreHealth EHR is a free open source electronic health record and medical practice management application. LibreHealth EHR 2.0.0 suffers from a local file inclusion vulnerability that can be exploited by an attacker to include and execute arbitrary PHP files in the EMR application...

Unauthorized Access Vulnerability in Hospital Diagnosis and Treatment System of Chongqing Yuanqiu Technology Co.

The Hospital Diagnostic and Treatment System HDTS is a large-scale medical database that directly addresses clinical diagnosis and treatment. Chongqing Yuanqiu Technology Co., Ltd. hospital diagnosis and treatment system there is an unauthorized access vulnerability, an attacker can use the...

Microsoft Launches Free Linux Forensics and Rootkit Malware Detection Service

Microsoft has announced a new free-to-use initiative aimed at uncovering forensic evidence of sabotage on Linux systems, including rootkits and intrusive malware that may otherwise go undetected. The cloud offering, dubbed Project Freta, is a snapshot-based memory forensic mechanism that aims to...

Unauthorized Access Vulnerability in Healthcare Information Resource Platform of Chongqing Yuanqiu Technology Co.

Chongqing Yuanqiu Technology Co., Ltd. is the first large-scale intelligence service organization specializing in medical information collection and medical database development in China. There is an unauthorized access vulnerability in the medical and health information resource platform of...

CVE-2020-12037

Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption e.g., TLS/SSL when configured to send treatment data to a PDMS Patient Data Management System or an EMR Electronic Medical Record system. An attacker could observe...

CVE-2020-12036

Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption e.g., TLS/SSL when configured to send treatment data to a PDMS Patient Data Management System or an EMR Electronic Medical Record system. An attacker could observe...

CVE-2019-18254

BIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at rest. An attacker with physical access to the CardioMessenger can disclose medical measurement data and the serial number from the implanted cardiac device the CardioMessenger is paired with...

CVE-2019-18254

BIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at rest. An attacker with physical access to the CardioMessenger can disclose medical measurement data and the serial number from the implanted cardiac device the CardioMessenger is paired with...

Design/Logic Flaw

BIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at rest. An attacker with physical access to the CardioMessenger can disclose medical measurement data and the serial number from the implanted cardiac device the CardioMessenger is paired with...

CVE-2019-18254

BIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at rest. An attacker with physical access to the CardioMessenger can disclose medical measurement data and the serial number from the implanted cardiac device the CardioMessenger is paired with...

CVE-2019-18254

CVE-2019-18254 affects BIOTRONIK CardioMessenger II; root cause is lack of encryption of sensitive data at rest, enabling disclosure of medical measurements and device serial numbers with physical access. The ICS advisory confirms affected CardioMessenger II variants and assigns CVSSv3 base 4.6 (...

CVE-2020-12048

CVE-2020-12048 affects Baxter’s Phoenix Hemodialysis Delivery System software versions 3.36 and 3.40. The vulnerability is cleartext transmission of sensitive data (CWE-319): the system does not support data-in-transit encryption (e.g., TLS/SSL) when sending treatment and prescription data over t...

IT guy from FEMA hacked medical center, sold data on dark web

By Waqas According to prosecutors, the 29-year old Johnson sold it on the dark web. This is a post from HackRead.com Read the original post: IT guy from FEMA hacked medical center, sold data on dark web...

BIOTRONIK CardioMessenger II-S Authorization Issue Vulnerability (CNVD-2020-52054)

The Biotronik CardioMessenger II-S is a portable medical monitoring device from Biotronik Germany. A security vulnerability exists in the Biotronik CardioMessenger II-S T-Line T4APP version 2.20 and II-S GSM T4APP version 2.20, which originates from a program that can recover format-stored...

Baxter PrismaFlex and PrismMax Information Disclosure Vulnerabilities

The Baxter PrismaFlex and PrismMax are both critical care devices from Baxter. An information disclosure vulnerability exists in Baxter PrismaFlex all versions and PrismMax prior to version 3.x. The vulnerability stems from the failure of an affected device to encrypt e.g., TLS/SSL transmitted da...

Unspecified Vulnerability in BIOTRONIK CardioMessenger II-S (CNVD-2020-52055)

The Biotronik CardioMessenger II-S is a portable medical monitoring device from Biotronik Germany. A security vulnerability exists in the Biotronik CardioMessenger II-S T-Line T4APP version 2.20 and II-S GSM T4APP version 2.20. An attacker could exploit the vulnerability to obtain medical...

Treck IP stacks contain multiple vulnerabilities

Overview Treck IP stack implementations for embedded systems are affected by multiple vulnerabilities. This set of vulnerabilities was researched and reported by JSOF, who calls them Ripple20. Description Treck IP network stack software is designed for and used in a variety of embedded systems. T...

Phishing Attack Hits German Coronavirus Task Force

Researchers are warning of an ongoing phishing attack that’s targeting the credentials of more than 100 high-profile executives at a German multinational corporation that’s tasked with procuring coronavirus medical gear for Germany. The company, left unnamed by researchers, is part of a task forc...

marylandmedicalcenter.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1178528 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...