Input validation

In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center CIC Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station CSCS Versions 1.X CARESCAPE Central Station CSCS Versions 2.X, B450 Version 2.X, B6...

CVE-2020-6966

In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center CIC Versions 4.X and 5.X, CARESCAPE Central Station CSCS Versions 1.X, the affected products utilize a weak encryption scheme for remote desktop control, which may allow an...

CVE-2020-6966

CVE-2020-6966 concerns GE Healthcare CARESCAPE/CIC/CSCS/ApexPro telemetry systems that use a weak encryption scheme for remote desktop control, enabling remote code execution on affected devices. The GE GEHC advisory (ICSMA-20-023-01) lists affected products: ApexPro Telemetry Server (4.2 and pri...

CVE-2020-6965

In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center CIC Versions 4.X and 5.X, CARESCAPE Central Station CSCS Versions 1.X, B450 Version 2.X, B650 Version 1.X, B650 Version 2.X, B850 Version 1.X, B850 Version 2.X, a vulnerability...

CVE-2020-6965

GE Healthcare advisories document CVE-2020-6965 as an Unrestricted Upload of File with Dangerous Type vulnerability in the software update mechanism. Affected products include ApexPro Telemetry Server (4.2 and prior), CARESCAPE Telemetry Server (4.2 and prior), CIC (4.X/5.X), CSCS (1.X), and B450...

CVE-2020-6964

In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center CIC Versions 4.X and 5.X, CARESCAPE Central Station CSCS Versions 1.X and CARESCAPE Central Station CSCS Versions 2.X, the integrated service for keyboard switching of the...

CVE-2020-6964

The CVE-2020-6964 entry corresponds to GE Healthcare vulnerabilities affecting CARESCAPE Telemetry Server, ApexPro Telemetry Server, CIC, and CSCS (and related monitor endpoints) where the integrated service for keyboard switching could allow attackers to obtain remote keyboard input access witho...

CVE-2020-6963

GE Healthcare GECARE/CSCS/CIC/ApexPro Telemetry Server and related components (ApexPro Telemetry Server 4.2 and prior; CARESCAPE Telemetry Server 4.2 and prior; CIC 4.X/5.X; CSCS 1.X, 2.X; B450/B650/B850 monitors) are affected by CVE-2020-6963 alongside a family of vulnerabilities (CVE-2020-6961/...

CVE-2020-6962

In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center CIC Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station CSCS Versions 1.X CARESCAPE Central Station CSCS Versions 2.X, B450 Version 2.X, B6...

CVE-2020-6961

In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center CIC Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station CSCS Versions 1.X, a vulnerability exists in the affected products that could allow...

CVE-2020-6961

CVE-2020-6961 affects GE Healthcare CARESCAPE Telemetry Server, ApexPro Telemetry Server, CIC (4.X/5.X), and CSCS (1.X) per GE ICS advisory (ICSMA-20-023-01). Root cause: unprotected storage of credentials that could allow an attacker to obtain the SSH private key from configuration files. Impact...

GE CARESCAPE, ApexPro, and Clinical Information Center systems

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: GE Equipment: CARESCAPE Telemetry Server, ApexPro Telemetry Server, CARESCAPE Central Station CSCS and Clinical Information Center CIC systems, CARESCAPE B450, B650, B850 Monitors Vulnerabilities:...

Seagate Central Storage Remote Code Execution Vulnerability

Seagate Central Storage is a home network drive made by Seagate for home and small office use. A remote code execution vulnerability exists in Seagate Central Storage, which can be exploited by an attacker to execute code...

Directory traversal

Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central DC and Desktop Central Managed Service Providers MSP edition before 9 build 90055 allows remote attackers to write to and execute arbitrary files as SYSTEM via a .. dot dot in the filename...

CVE-2014-5007

CVE-2014-5007 affects ManageEngine Desktop Central and Desktop Central MSP before 9 build 90055. A directory traversal in the agentLogUploader servlet allows remote attackers to write to and execute arbitrary files as SYSTEM via a .. in the filename parameter. This is a network-based impact with ...

Business-central: Encrypted password shown under Object id 7 of errai_security_context

A vulnerability was found in business-central where encoded passwords are stored in erraisecuritycontext. The encoding used for storing the passwords is Base64, not an encryption algorithm, and any recovery of these passwords could lead to user passwords being exposed...

Business-central: Encrypted password shown under Object id 7 of errai_security_context

A vulnerability was found in business-central where encoded passwords are stored in erraisecuritycontext. The encoding used for storing the passwords is Base64, not an encryption algorithm, and any recovery of these passwords could lead to user passwords being exposed...

Security Bulletin: Vulnerabilities CVE-2017-12613 and CVE-2017-12618 in the IBM i HTTP Server affect IBM i.

Summary HTTP Server is supported by IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-12613 DESCRIPTION: Apache Portable Runtime APR could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds array dereference in aprtimeexp...

Security Bulletin: Vulnerabilities CVE-2017-12150, CVE-2017-12151 and CVE-2017-12163 in Samba affect IBM i

Summary Samba is supported on IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-12163 DESCRIPTION: Samba could allow a remote authenticated attacker to obtain sensitive information, caused by a memory leak over SMB1. By sending specially crafted SMB1 data, an...

Security Bulletin: Vulnerability in Apache Commons FileUpload Affects IBM Sterling Secure Proxy

Summary An Apache Commons Collections vulnerability for handling Java object deserialization was addressed by IBM Sterling Secure Proxy. Vulnerability Details CVEID: CVE-2016-1000031 DESCRIPTION: Apache Commons FileUpload, as used in Novell NetIQ Sentinel and other products, could allow a remote...