Stack overflow

IntelliVue Patient Monitors MP Series including MP2/X2/MP30/MP50/MP70/NP90/MX700/800 Rev B-M, IntelliVue Patient Monitors MX MX400-550 Rev J-M and X3/MX100 for Rev M only, and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that...

CVE-2018-10599

IntelliVue Patient Monitors MP Series including MP2/X2/MP30/MP50/MP70/NP90/MX700/800 Rev B-M, IntelliVue Patient Monitors MX MX400-550 Rev J-M and X3/MX100 for Rev M only, and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that...

CVE-2018-10601

The CVE-2018-10601 issue affects Philips IntelliVue Patient Monitors MP Series (and MP2/X2/MP30/MP50/MP70/NP90/MX700/800), MX (MX400-550, Rev J-M; X3/MX100 Rev M), and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50. Root cause: a vulnerability in an exposed "echo" service where an attacker-se...

CVE-2018-10599

IntelliVue Patient Monitors MP Series including MP2/X2/MP30/MP50/MP70/NP90/MX700/800 Rev B-M, IntelliVue Patient Monitors MX MX400-550 Rev J-M and X3/MX100 for Rev M only, and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that...

CVE-2018-10601

IntelliVue Patient Monitors MP Series including MP2/X2/MP30/MP50/MP70/NP90/MX700/800 Rev B-M, IntelliVue Patient Monitors MX MX400-550 Rev J-M and X3/MX100 for Rev M only, and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that...

CVE-2018-10597

IntelliVue Patient Monitors MP Series including MP2/X2/MP30/MP50/MP70/NP90/MX700/800 Rev B-M, IntelliVue Patient Monitors MX MX400-550 Rev J-M and X3/MX100 for Rev M only, and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that...

CVE-2018-10597

CVE-2018-10597 affects Philips IntelliVue MP Series, MX monitors and Avalon FM monitors. Root cause: improper authentication allowing an unauthenticated attacker to read/write memory via an attacker-chosen device address within the same subnet (write-what-where). Affected versions include MP Seri...

CVE-2018-10599

The Connected document (ICSMA-18-156-01) confirms CVE-2018-10599 affects Philips IntelliVue Patient Monitors (MP series, MX series) and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50. Root cause: information exposure vulnerability allowing an unauthenticated attacker to read memory from an at...

CVE-2018-10601: Stack-based Buffer Overflow

IntelliVue Patient Monitors MP Series including MP2/X2/MP30/MP50/MP70/NP90/MX700/800 Rev B-M, IntelliVue Patient Monitors MX MX400-550 Rev J-M and X3/MX100 for Rev M only, and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that...

CVE-2018-10597: Improper Authentication

IntelliVue Patient Monitors MP Series including MP2/X2/MP30/MP50/MP70/NP90/MX700/800 Rev B-M, IntelliVue Patient Monitors MX MX400-550 Rev J-M and X3/MX100 for Rev M only, and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that...

CVE-2018-10599: Exposure of Sensitive Information to an Unauthorized Actor

IntelliVue Patient Monitors MP Series including MP2/X2/MP30/MP50/MP70/NP90/MX700/800 Rev B-M, IntelliVue Patient Monitors MX MX400-550 Rev J-M and X3/MX100 for Rev M only, and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that...

Philips' IntelliVue Patient and Avalon Fetal Monitors

1. EXECUTIVE SUMMARY CVSS v3 8.3 Vendor: Philips Equipment: IntelliVue Patient Monitors, Avalon Fetal/Maternal Monitors Vulnerabilities: Improper Authentication, Information Exposure, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation may allow an attacker to read/write...

Security update for ceph (important)

This update for ceph fixes the following issues: Security issues fixed: - CVE-2018-7262: rgw: malformed http headers can crash rgw bsc1081379. - CVE-2017-16818: User reachable asserts allow for DoS bsc1063014. Bug fixes: - bsc1061461: OSDs keep generating coredumps after adding new OSD node to...

HP SiteScope Unspecified Unauthorized Access Vulnerability

HPE SiteScope is a suite of application monitoring solutions from Hewlett Packard Enterprise HPE. The solution collects operational status of servers and applications in physical, virtual and cloud infrastructure environments. A security vulnerability exists in HPE SiteScope versions 11.2x and...

CVE-2017-2604

In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permission checks SECURITY-371. All administrative monitors now require the user accessing them to be an administrator...

CVE-2017-2604

In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permission checks SECURITY-371...

CVE-2017-2604

CVE-2017-2604 affects Jenkins before version 2.44 (and 2.32.x before 2.32.2). Affects the permissions on administrative monitors; a low-privilege user could act on these monitors due to inconsistent permission checks (as described in SECURITY-371). The connected sources confirm multiple vulnerabi...

CVE-2017-2604: Improperly Implemented Security Check for Standard

In Jenkins before versions 2.44, 2.32.2 low privilege users were able to act on administrative monitors due to them not being consistently protected by permission checks SECURITY-371...

New Relic: [NR Synthetics] Restricted User can add/modify alert conditions on monitors without any synthetics privileges

There is a privilege escalation bug that allows a user with restricted privileges to make changes to alerts on Synthetics monitors, without the proper permissions to do so in fact, they can make changes with NO synthetics permissions. In order to reproduce this it's easiest if you have two accoun...

New Relic: [NR Synthetics] Restricted user can view synthetics monitors and user permissions through .json endpoint at /permissions/securablemetadata/{GROUP ID}

This report is two reports in one, but I figured why create two reports when the root cause is essentially the same exact endpoint. Description When a restricted user with no permissions to view synthetics monitors tries to navigate to the permissions settings within Synthetics...