CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-8863 – Philips EncoreAnywhere Exposure of Sensitive Information to an Unauthorized Actor
https://notcve.org/view.php?id=CVE-2018-8863
The HTTP header in Philips EncoreAnywhere contains data an attacker may be able to use to gain sensitive information. El encabezado HTTP de Philips EncoreAnywhere contiene datos que un atacante puede utilizar para obtener información confidencial. • https://www.cisa.gov/news-events/ics-advisories/icsma-18-137-02 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-39369
https://notcve.org/view.php?id=CVE-2021-39369
In Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by authenticated users to access files stored outside of the web root. En Philips (anteriormente Carestream) Vue MyVue PACS hasta 12.2.xx, la función VideoStream permite que usuarios autenticados realicen Path Traversal para acceder a archivos almacenados fuera de la raíz web. • https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01 https://www.usa.philips.com/healthcare https://www.youtube.com/watch?v=7zC84TNpIxw • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-32966 – Philips Interoperability Solution XDS - Clear Text Transmission of Sensitive Information
https://notcve.org/view.php?id=CVE-2021-32966
Philips Interoperability Solution XDS versions 2.5 through 3.11 and 2018-1 through 2021-1 are vulnerable to clear text transmission of sensitive information when configured to use LDAP via TLS and where the domain controller returns LDAP referrals, which may allow an attacker to remotely read LDAP system credentials. Philips Interoperability Solution XDS versiones 2.5 a 3.11 y 2018-1 a 2021-1, son vulnerables a una transmisión de texto sin cifrar de información confidencial cuando están configuradas para usar LDAP por medio de TLS y cuando el controlador de dominio devuelve referencias LDAP, lo que puede permitir a un atacante leer remotamente las credenciales del sistema LDAP • https://www.cisa.gov/uscert/ics/advisories/icsma-21-175-01 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-0922 – ICSMA-22-088-01 Philips e-Alert
https://notcve.org/view.php?id=CVE-2022-0922
The software does not perform any authentication for critical system functionality. El software no lleva a cabo ninguna autenticación para la funcionalidad crítica del sistema • https://www.cisa.gov/uscert/ics/advisories/icsma-22-088-01 • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-33018 – Philips Vue PACS Use of a Broken or Risky Cryptographic Algorithm
https://notcve.org/view.php?id=CVE-2021-33018
The use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and prior is an unnecessary risk that may result in the exposure of sensitive information. El uso de un algoritmo criptográfico roto o arriesgado en Philips Vue PACS versiones 12.2.x.x y anteriores, es un riesgo innecesario que puede resultar en una exposición de información confidencial • http://www.philips.com/productsecurity https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •