ICSMA-17-229-01_Philips' DoseWise Portal Vulnerabilities

OVERVIEW Philips has identified Hard-coded Credentials and Cleartext Storage of Sensitive Information vulnerabilities in Philips’ DoseWise Portal DWP web application. Philips has updated product documentation and produced a new version that mitigates these vulnerabilities. These vulnerabilities...

XenServer Host Console Not Visible On Some High-Resolution Monitors

Due to resolution incompatibility issues on some high-resolution monitors the host console may not be visible when booted The following monitors have been confirmed to have this issue: Dell, U2312HM, 23", 16:9, 1920 x 1080 Philips, 226V6QSB6, 21.5", 16:9, 1920X1080 AOC, I2280SWD, 22", 16:9,...

Philips Hue gen 1 - Customized SSL, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Philips Hue gen 1 published at the 'play' market has multiple vulnerabilities...

Philips Hue - Corrupted files, Dangerous filesystem permissions, Exported components vulnerabilities

HackApp vulnerability scanner discovered that application Philips Hue published at the 'play' market has multiple vulnerabilities...

Portrait Display SDK Service Privilege Escalation

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Privilege Escalation due to insecure service configuration product: Portrait Display SDK Service vulnerable version: mutliple, see PoC fixed version: multiple, see soluti...

Pre-Installed Applications Developed with Portrait Displays SDK Contain Critical Vulnerability

Applications developed using the Portrait Displays software development kit SDK, versions 2.30 through 2.34, contain a critical vulnerability. A local attacker could exploit this vulnerability to take control of an affected system. The affected applications, pre-installed on some Fujitsu, HP, and...

Philips In.Sight B120/37 Privilege Gain Vulnerability

The Philips In.Sight B120/37 is a video monitoring device for infants from Philips Netherlands. A privilege acquisition vulnerability exists in the Philips In.Sight B120/37. Sight B120/37 can be exploited to gain access to the local web server and operating system...

Philips In.Sight B120/37 Information Disclosure Vulnerability

The Philips In.Sight B120/37 is a video monitoring device for infants from Philips Netherlands. An information disclosure vulnerability exists in the Philips In.Sight B120/37. A remote attacker could exploit the vulnerability to obtain sensitive information...

Philips In.Sight B120/37 Cross-Site Scripting Vulnerability

The Philips In.Sight B120/37 is a video monitoring device for infants from Philips Netherlands. A cross-site scripting vulnerability exists in the Philips In.Sight B120/37. Sight B120/37 can be exploited by a remote attacker to inject arbitrary web script or HTML via the name parameter...

CVE-2015-2883

Philips In.Sight B120/37 has XSS, related to the Weaved cloud web service, as demonstrated by the name parameter to deviceSettings.php or shareDevice.php...

CVE-2015-2884

Philips In.Sight B120/37 allows remote attackers to obtain sensitive information via a direct request, related to yoics.net URLs, stream.m3u8 URIs, and camserviceenable.cgi...

Cross site scripting

Philips In.Sight B120/37 has XSS, related to the Weaved cloud web service, as demonstrated by the name parameter to deviceSettings.php or shareDevice.php...

Default credentials

Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of /ADMIN/ for the backdoor admin account, a password of merlin for the backdoor mg3500 account, a password of M100-4674448 for the backdoor user account, and a password of M100-4674448 for the backdoor...

Information disclosure

Philips In.Sight B120/37 allows remote attackers to obtain sensitive information via a direct request, related to yoics.net URLs, stream.m3u8 URIs, and camserviceenable.cgi...

CVE-2015-2882

Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of /ADMIN/ for the backdoor admin account, a password of merlin for the backdoor mg3500 account, a password of M100-4674448 for the backdoor user account, and a password of M100-4674448 for the backdoor...

CVE-2015-2882

The CVE-2015-2882 entry concerns Philips In.Sight B120/37, a video monitoring device. The documented issue is the presence of multiple default/backdoor credentials (b120root, /ADMIN/, merlin, M100-4674448) for various accounts, which OpenVAS entries also flag as default credentials. Connected CNV...

CVE-2015-2884

CVE-2015-2884 affects Philips In.Sight B120/37, a video monitoring device. The connected sources confirm an information-disclosure vulnerability that allows remote attackers to obtain sensitive data via a direct request, referencing yoics.net URLs, stream.m3u8 URIs, and cam_service_enable.cgi. Th...

CVE-2015-2883

Philips In.Sight B120/37 is affected by a cross-site scripting (XSS) vulnerability, related to the Weaved cloud web service. The issue can be triggered via the name parameter in deviceSettings.php or shareDevice.php. The Common result is that arbitrary script/HTML could be injected, potentially a...

CVE-2015-2882

Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of /ADMIN/ for the backdoor admin account, a password of merlin for the backdoor mg3500 account, a password of M100-4674448 for the backdoor user account, and a password of M100-4674448 for the backdoor...

CVE-2015-2883

Philips In.Sight B120/37 has XSS, related to the Weaved cloud web service, as demonstrated by the name parameter to deviceSettings.php or shareDevice.php...