Chizuru Toyama

Name of the Vulnerable Software and Affected Versions: Sante PACS Server Web Portal (affected versions not specified) Description: The Sante PACS Server Web Portal transmits credential information without encryption. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Sante PACS Server (affected versions not specified) Description: Sante PACS Server is susceptible to stored cross-site scripting. An attacker can inject malicious HTML code, potentially redirecting a user to a malicious webpage and stealing the user's cookie. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Sante PACS Server (affected versions not specified) Description: The Sante PACS Server is susceptible to a denial-of-service condition. A remote attacker can crash the main thread by sending a crafted HL7 message. No authentication is required, and a manual restart of the application is necessary to restore functionality. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Sante PACS Server (affected versions not specified) Description: Sante PACS Server web portal is susceptible to stored cross-site scripting. An attacker can inject malicious HTML code, potentially redirecting a user to a malicious webpage and stealing the user's cookie. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Pixmeo OsiriX MD (affected versions not specified) **Description** The issue is related to a use after free scenario, which could allow an attacker to upload a crafted DICOM file and cause memory corruption, leading to a denial-of-service condition. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Pixmeo OsiriX MD (affected versions not specified) **Description** The issue is related to a local use after free scenario. An attacker could locally import a crafted DICOM file, potentially causing memory corruption or a system crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Pixmeo Osirix MD Web Portal (affected versions not specified) **Description** The issue concerns the transmission of credential information without encryption by the Pixmeo Osirix MD Web Portal, potentially allowing an attacker to steal credentials. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sante PACS Server (affected versions not specified) **Description** This issue allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is not required to exploit this issue. The specific flaw exists within the parsing of URLs in the web server module, resulting from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this issue to create a denial-of-service condition on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Sante PACS Server Web Portal DCM (affected versions not specified) **Description** This issue allows remote attackers to create arbitrary files on affected installations of Sante PACS Server. Authentication is required to exploit this issue. The problem exists within the parsing of DCM files and results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this issue to write files in the context of the current user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Sante PACS Server DCM (affected versions not specified) **Description** The issue is a Directory Traversal Arbitrary File Write Vulnerability that allows remote attackers to create arbitrary files on affected installations of Sante PACS Server. No authentication is required to exploit this vulnerability. The specific flaw exists within the parsing of DCM files and results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to write files in the context of the current user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sante PACS Server Web Portal DCM (affected versions not specified) **Description** The issue is a denial-of-service vulnerability due to memory corruption in the analysis of DCM files. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the parsing of DCM files and results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sante PACS Server (affected versions not specified) **Description** This issue allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. The specific flaw exists within the parsing of DCM files, resulting from the lack of proper validation of user-supplied data, which can lead to a memory corruption condition. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Authentication is required to exploit this vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sante PACS Server (affected versions not specified) **Description** The issue is a denial-of-service vulnerability due to memory corruption in the analysis of Sante PACS Server DCM files. This allows remote attackers to create a denial-of-service condition on affected installations without requiring authentication. The problem exists in the parsing of DCM files and results from the lack of proper validation of user-supplied data, leading to a memory corruption condition. An attacker can exploit this to create a denial-of-service condition on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sante PACS Server (affected versions not specified) **Description** This issue allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is not required to exploit this issue. The specific flaw exists within the parsing of DCM files, resulting from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this issue to create a denial-of-service condition on the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** LOYTEC electronics GmbH LINX Configurator (all versions) **Description** The issue concerns insecure permissions where an admin credential is passed as a value of URL parameters without encryption. This allows remote attackers to steal the password and gain full control of the Loytec device configuration. **Recommendations** For all versions, consider restricting access to the LINX Configurator to minimize the risk of exploitation. As a temporary workaround, avoid using the LINX Configurator until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) **Description** The issue allows remote attackers to disclose smtp client account credentials and bypass email authentication due to insecure permissions via the registry.xml file. **Recommendations** For all versions, consider restricting access to the registry.xml file to minimize the risk of exploitation. As a temporary workaround, avoid using the smtp client account credentials in the affected devices until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LOYTEC electronics GmbH LINX Configurator (all versions) **Description** The issue concerns the use of HTTP Basic Authentication in the LINX Configurator, which transmits usernames and passwords in base64-encoded cleartext. This allows remote attackers to steal the password and gain full control of the Loytec device configuration. **Recommendations** For all versions, consider disabling HTTP Basic Authentication as a temporary workaround until a more secure authentication method is implemented. Restrict access to the LINX Configurator to minimize the risk of exploitation. Avoid using the `username` and `password` variables in cleartext until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LOYTEC electronics GmbH LINX Configurator (all versions) **Description** The issue concerns insecure permissions in the LINX Configurator, where credentials are stored in cleartext. This allows remote attackers to disclose the admin password and bypass authentication to login to the Loytec device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) **Description** The issue allows remote attackers to disclose smtp client account credentials and bypass email authentication due to insecure permissions via the dpal config.zml file. **Recommendations** For LINX-212 and LINX-151 devices, restrict access to the dpal config.zml file to prevent remote attackers from disclosing smtp client account credentials and bypassing email authentication. As a temporary workaround, consider restricting the use of the smtp client until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LINX-212 and LINX-151 devices (all versions) **Description** The issue is related to Incorrect Access Control via the `dpal config.zml` file, allowing remote attackers to disclose sensitive information on device data point configuration. **Recommendations** For all versions, consider restricting access to the `dpal config.zml` file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.