Why Healthcare Can't Afford to Ignore Digital Identity

Investing in digital identity can improve security, increase clinical productivity, and boost healthcare's bottom line. — b y Gus Malezis, CEO of Imprivata Digitalization has created immeasurable opportunities for businesses over the past two decades. But the growth of hybrid work and expansion o...

Telehealth Sites Put Addiction Patient Data at Risk

New research found pervasive use of tracking tech on substance-abuse-focused health care websites, potentially endangering users in a post-Roe world...

CVE-2022-41627

The CVE-2022-41627 issue affects AliveCor’s KardiaMobile IoT device: the data-over-sound channel has no encryption, enabling an attacker in close proximity (less than 5 feet) to read ECG results or trigger a DoS by emitting matching audio frequencies. The vulnerability is tied to the IoT device’s...

CVE-2022-37461

Multiple cross-site scripting XSS vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary web script or HTML via 1 the input after the error subdirectory to the /vitrea-view/error/ subdirectory, or the 2 groupID, 3 offset, or 4 limit parameter to a...

PT-2022-24013 · Canon Medical · Canon Medical Vitrea View

Name of the Vulnerable Software and Affected Versions: Canon Medical Vitrea View versions 7.x through 7.7.5 Description: Multiple cross-site scripting XSS vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the input after the error subdirectory to the...

PT-2022-24184 · Cms8000 · Cms8000

Name of the Vulnerable Software and Affected Versions: CMS8000 devices affected versions not specified Description: The issue concerns multiple globally default credentials existing across all CMS8000 devices. If these credentials are exposed, a threat actor with momentary physical access can gai...

Contec Health CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor 信任管理问题漏洞

The Contec Health CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor is a vital signs patient monitor from Contec Health. The Contec Health CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor suffers from a trust management issue vulnerability that stems from the presence of multiple global defaul...

For Ransomware Double-Extorters, It's All About the Benjamins — and Data From Healthcare and Pharma

Welcome to the second installment in our series looking at the latest ransomware research from Rapid7. Two weeks ago, we launched "Pain Points: Ransomware Data Disclosure Trends", our first-of-its-kind look into the practice of double extortion, what kinds of data get disclosed, and how the...

Sourcecodester Hospital Patient Records Management System SQL注入漏洞（CNVD-2022-48748）

Sourcecodester Hospital Patient Records Management System is a web-based application that provides an automated platform for hospitals to store and manage their patient records. Management System contains a SQL injection vulnerability that originates in...

Patient Records Management System SQL注入漏洞

Sourcecodester Hospital Patient Records Management System is a web-based application that provides an automated platform for hospitals to store and manage their patient records. Management System contains a SQL injection vulnerability that originates in...

Connected Healthcare: A Cybersecurity Battlefield We Must Win

Connected Healthcare: A Cybersecurity Battlefield We Must Win By Trellix · June 6, 2022 This blog was written by Charles McFarland We are commonly taught to prioritize the most critical, severe, or impactful tasks when trying to conquer a list of intimidating problems. Yet, how is this possible...

Hospitals taken offline after cyberattack

The GHT Coeur Grand Est has become a victim of a cyberattack on the hospital centers of Vitry-le-François and Saint-Dizier. The hospital’s administration has warned French that data have been exfiltrated and might be used for phishing in the future. As a consequence, the GHT Cœur Grand Est has cu...

CVE-2022-1067

The CVE-2022-1067 issue affects LifePoint Informatics Patient Portal (Product: LifePoint Informatics Patient Portal; Affected Version: LPI 3.5.12.P30). It is an Authentication Bypass using an alternate path or channel (CWE-288) where navigating to a URL with a patient ID causes the server to gene...

Design/Logic Flaw

Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite OpenEyes returning a Forbidden error message, the contents of a patient's profile are still returned in the server response. This respons...

CVE-2021-40375

CVE-2021-40375 affects OpenEyes 3.5.1 (Apperta Foundation). The vulnerability allows remote attackers to view sensitive patient information (PII, medication history) because the server responded with sensitive data in responses despite returning a Forbidden message. Underlying cause and mitigatio...

Apperta Foundation OpenEyes 信息泄露漏洞

Apperta Foundation OpenEyes is an open source electronic medical record ERP from the Apperta Foundation. A security vulnerability exists in Apperta Foundation OpenEyes 3.5.1 that allows remote attackers to view sensitive patient information without the expected privilege level...

Unpatched Security Bugs in Medical Wearables Allow Patient Tracking, Data Theft

Telehealth care is on the rise as medical service providers cope with the strain of a pandemic and rising costs. But the rush to roll out remote healthcare has also unleashed a universe of wearable medical devices to collect sensitive data, which researchers say are widely vulnerable to attack...

Philips Patient Information Center iX 安全漏洞

Philips Patient Information Center iX Philips Patient Information Center PIC iX, a Philips company in Europe, is at the heart of our patient monitoring system, which facilitates understanding of the patient's condition and helps caregivers to identify potential deterioration at an early stage, as...

Philips IntelliBridge EC80 Hub 安全漏洞

Philips IntelliBridge Enterprise IBE is a solution from Philips Europe that provides a single point of contact between EHR Electronic Health Record and Philips clinical solutions. A security vulnerability exists in the Philips IntelliBridge EC 40 and EC 80 Hubs, which stems from the fact that...

Philips IntelliBridge EC80 Hub 信任管理问题漏洞

Philips IntelliBridge Enterprise IBE is a solution from Philips Europe that provides a single point of contact between EHR Electronic Health Record and Philips clinical solutions. The Philips IntelliBridge EC 40 and EC 80 Hubs have trust management issue vulnerabilities that stem from Successful...