CVE-2015-3459

Hospira LifeCare PCA Infusion System (pre-7.0) has an unauthenticated root Telnet access in the device’s communication module, allowing remote modification of pump configuration. Connected sources confirm affected products include LifeCare PCA Infusion System versions 5.0 and older, with exploita...

LifeCare PCA Infusion System Unvalidated Remote Pharmacy Operations Vulnerability

The LifeCare PCA Infusion System is an infusion pump solution. A security vulnerability in the WEB interface of the LifeCare PCA Infusion System device allows a remote attacker to upload an arbitrary medication library to the device due to a lack of proper authentication...

CVE-2014-5403

Hospira MedNet before 6.1 uses hardcoded cryptographic keys for protection of data transmission from infusion pumps, which allows remote attackers to obtain sensitive information by sniffing the network...

Hardcoded credentials

Hospira MedNet before 6.1 uses hardcoded cryptographic keys for protection of data transmission from infusion pumps, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2014-5403

Summary (CVE-2014-5403) Hospira MedNet before 6.1 uses hard-coded cryptographic keys to protect data transmission from infusion pumps, enabling remote attackers to obtain sensitive information by sniffing network traffic. Affected software: MedNet server software (pre-6.1). Underlying issue: hard...

Baxter SIGMA Spectrum Infusion System Vulnerabilities

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on June 30, 2015, and is being released to the NCCIC/ICS-CERT web site. Researcher Jared Bird with Allina IS Security identified four vulnerabilities in Baxter’s SIGMA Spectrum Infusion System. Baxter has released a...

Hospira Symbiq Infusion System Vulnerability

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on June 23, 2015, and is being released to the NCCIC/ICS-CERT web site. Independent researcher Billy Rios identified a vulnerability in Hospira’s Symbiq Infusion System, which can be exploited to remotely control th...

Hospira Plum A+ and Symbiq Infusion Systems Vulnerabilities

OVERVIEW Independent researcher Billy Rios has identified vulnerabilities in Hospira’s Plum A+ Infusion System that are similar to vulnerabilities identified in Hospira’s LifeCare PCA Infusion System discussed in advisory, ICSA-15-125-01B Hospira LifeCare PCA Infusion System Vulnerabilities...

Hospira LifeCare PCA Infusion System Vulnerabilities

OVERVIEW Independent researcher Billy Rios has identified an improper authorization vulnerability and an insufficient verification of data authenticity vulnerability in Hospira’s LifeCare PCA Infusion System, which NCCIC/ICS-CERT has been coordinating with Hospira since May 2014. This advisory is...

Hospira MedNet Vulnerabilitie

OVERVIEW Independent researcher Billy Rios has identified four vulnerabilities in Hospira’s MedNet server software. Hospira has released a new version of the MedNet software and provided mitigation recommendations that mitigate the reported vulnerabilities. Three of the four vulnerabilities could...

PHP-Fusion Teams Structure Infusion Addon SQL Injection

No description provided by source. Exploit Title: PHP-fusion Team Structure Infusion All versions SQL injection Date: 16-1-2010 Author: Saif El-Sherei Software Link: http://www.php-fusion.co.uk/infusions/addondb/view.php?addonid=120 Version: PHP-fusion 7.01..03, TeamStructure Infusionall versions...

CVE-2012-6528

ATutor before 2.1 contains multiple cross-site scripting (XSS) vulnerabilities exploitable via PATH_INFO in several endpoints (themes/default/tile_search/index.tmpl.php, login.php, search.php, password_reminder.php, login.php/jscripts/infusion, login.php/mods/_standard/flowplayer, browse.php/jscr...

Heap overflow

Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA...

Heap overflow

Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA...

CVE-2012-0258

The CVE-2012-0258 issue is a heap-based buffer overflow in the WWCabFile ActiveX Component used by Wonderware System Platform and related products (Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Informatio...

ATutor 2.0.3 Multiple XSS vulnerabilities

Advisory: ATutor 2.0.3 Multiple XSS vulnerabilities Advisory ID: SSCHADV2012-002 Author: Stefan Schurtz Affected Software: Successfully tested on ATutor 2.0.3 Vendor URL: http://atutor.ca Vendor Status: informed ========================== Vulnerability Description ========================== ATuto...

PHP-Fusion Teams Structure Infusion Addon - SQL Injection

PHP-Fusion Teams Structure Infusion Addon - SQL Injection Exploit Title: PHP-fusion Team Structure Infusion All versions SQL injection Date: 16-1-2010 Author: Saif El-Sherei Software Link: http://www.php-fusion.co.uk/infusions/addondb/view.php?addonid=120 Version: PHP-fusion 7.01..03, TeamStructu...

PHP-Fusion Team Structure Infusion SQL Injection

Exploit Title: PHP-fusion Team Structure Infusion All versions SQL injection Date: 16-1-2010 Author: Saif El-Sherei Software Link: http://www.php-fusion.co.uk/infusions/addondb/view.php?addonid=120 Version: PHP-fusion 7.01..03, TeamStructure Infusionall versions Tested on: Firefox 3.0.15, , IE 8...

Expected Twitter Ads Should Get Malware Infusion

Miscreants are highly likely to take advantage of Twitter’s move towards making money through ad-supported micro-blogging updates, security watchers warn. Read the full article. The Register...

PHP-Fusion Teams Structure Infusion Addon SQL Injection Vulnerability

Exploit for php platform in category web applications Date: 16-1-2010 Author: Saif El-Sherei Software Link: http://www.php-fusion.co.uk/infusions/addondb/view.php?addonid=120 Version: PHP-fusion 7.01..03, TeamStructure Infusionall versions Tested on: Firefox 3.0.15, , IE 8 Info: Plugin that allow...