Vulnerabilities for E-alert firmware (...) - CXSECURITY.COM

Vulnerabilities for 'E-alert firmware'

2018-09-26

CVE-2018-8856

CWE-798

Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software contains hard-coded cryptographic key, which it uses for encryption of internal data.

CVE-2018-8854

CWE-400

Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not properly restrict the size or amount of resources requested or influenced by an actor, which can be used to consume more resources than intended.

CVE-2018-8852

CWE-384

Philips e-Alert Unit (non-medical device), Version R2.1 and prior. When authenticating a user or otherwise establishing a new user session, the software gives an attacker the opportunity to steal authenticated sessions without invalidating any existing session identifier.

CVE-2018-8850

CWE-20

Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not validate input properly, allowing an attacker to craft the input in a form that is not expected by the rest of the application. This would lead to parts of the unit receiving unintended input, which may result in altered control flow, arbitrary control of a resource, or arbitrary code execution.

CVE-2018-8848

CWE-276

Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software, upon installation, sets incorrect permissions for an object that exposes it to an unintended actor.

CVE-2018-8846

CWE-79

Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is then served to other users.

CVE-2018-8844

CWE-352

Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

CVE-2018-8842

CWE-319

Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. The Philips e-Alert communication channel is not encrypted which could therefore lead to disclosure of personal contact information and application login credentials from within the same subnet.

CVE-2018-14803

CWE-200

Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The Philips e-Alert contains a banner disclosure vulnerability that could allow attackers to obtain extraneous product information, such as OS and software components, via the HTTP response header that is normally not available to the attacker, but might be useful information in an attack.

>>> Vendor: Philips 67 Products

Xper information management physiomonitoring 5

Xper information management vascular monitoring 5

Xper flex cardio

In.sight b120\37

Hue bridge bsb002 firmware

Intellispace cardiovascular

Intellispace portal

Alice 6 firmware

brilliance ct big bore firmware

Brilliance firmware 64

Brilliance ict firmware

Brilliance ict sp firmware

Avalon fetal/maternal monitors fm20 firmware

Avalon fetal/maternal monitors fm30 firmware

Avalon fetal/maternal monitors fm40 firmware

Avalon fetal/maternal monitors fm50 firmware

Intellivue patient monitors mp2 firmware

Intellivue patient monitors mp30 firmware

Intellivue patient monitors mp50 firmware

Intellivue patient monitors mp70 firmware

Intellivue patient monitors mx100 firmware

Intellivue patient monitors mx400 firmware

Intellivue patient monitors mx450 firmware

Intellivue patient monitors mx500 firmware

Intellivue patient monitors mx550 firmware

Intellivue patient monitors mx700 firmware

Intellivue patient monitors mx800 firmware

Intellivue patient monitors np90 firmware

Intellivue patient monitors x2 firmware

Intellivue patient monitors x3 firmware

Smart control premium

Pagewriter tc10 firmware

Pagewriter tc20 firmware

Pagewriter tc30 firmware

Pagewriter tc50 firmware

Pagewriter tc70 firmware

E-alert firmware

Healthsuite health

Intellispace pacs

Zymed holter 2010

Hdi 4000 firmware

Intellivue mp monitors mp2/x2 firmware

Intellivue mp monitors mp20-mp90 firmware

Intellivue mp monitors mp5/5sc firmware

Intellivue mp monitors mx800/700/600 firmware

Patient information center ix

Performancebridge focal point

Clinical collaboration platform

Dynamic coronary roadmap

Interventional workspot

Stentboost live

Tasy electronic medical record

Copyright 2024, cxsecurity.com