Chizuru Toyama

Name of the Vulnerable Software and Affected Versions: Sante PACS Server Web Portal (affected versions not specified) Description: The Sante PACS Server Web Portal transmits credential information without encryption. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Sante PACS Server (affected versions not specified) Description: Sante PACS Server is susceptible to stored cross-site scripting. An attacker can inject malicious HTML code, potentially redirecting a user to a malicious webpage and stealing the user's cookie. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Sante PACS Server (affected versions not specified) Description: The Sante PACS Server is susceptible to a denial-of-service condition. A remote attacker can crash the main thread by sending a crafted HL7 message. No authentication is required, and a manual restart of the application is necessary to restore functionality. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Sante PACS Server (affected versions not specified) Description: Sante PACS Server web portal is susceptible to stored cross-site scripting. An attacker can inject malicious HTML code, potentially redirecting a user to a malicious webpage and stealing the user's cookie. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a use after free scenario, which could allow an attacker to upload a crafted DICOM file and cause memory corruption, leading to a denial-of-service condition.

The issue is related to a local use after free scenario. An attacker could locally import a crafted DICOM file, potentially causing memory corruption or a system crash.

The issue concerns the transmission of credential information without encryption by the Pixmeo Osirix MD Web Portal, potentially allowing an attacker to steal credentials.

This issue allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is not required to exploit this issue. The specific flaw exists within the parsing of URLs in the web server module, resulting from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this issue to create a denial-of-service condition on the system.

This issue allows remote attackers to create arbitrary files on affected installations of Sante PACS Server. Authentication is required to exploit this issue. The problem exists within the parsing of DCM files and results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this issue to write files in the context of the current user.

The issue is a Directory Traversal Arbitrary File Write Vulnerability that allows remote attackers to create arbitrary files on affected installations of Sante PACS Server. No authentication is required to exploit this vulnerability. The specific flaw exists within the parsing of DCM files and results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to write files in the context of the current user.

The issue is a denial-of-service vulnerability due to memory corruption in the analysis of DCM files. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is required to exploit this vulnerability. The specific flaw exists within the parsing of DCM files and results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.

This issue allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. The specific flaw exists within the parsing of DCM files, resulting from the lack of proper validation of user-supplied data, which can lead to a memory corruption condition. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Authentication is required to exploit this vulnerability.

The issue is a denial-of-service vulnerability due to memory corruption in the analysis of Sante PACS Server DCM files. This allows remote attackers to create a denial-of-service condition on affected installations without requiring authentication. The problem exists in the parsing of DCM files and results from the lack of proper validation of user-supplied data, leading to a memory corruption condition. An attacker can exploit this to create a denial-of-service condition on the system.

This issue allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is not required to exploit this issue. The specific flaw exists within the parsing of DCM files, resulting from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this issue to create a denial-of-service condition on the system.

The issue concerns insecure permissions where an admin credential is passed as a value of URL parameters without encryption. This allows remote attackers to steal the password and gain full control of the Loytec device configuration.

The issue allows remote attackers to disclose smtp client account credentials and bypass email authentication due to insecure permissions via the registry.xml file.

The issue concerns the use of HTTP Basic Authentication in the LINX Configurator, which transmits usernames and passwords in base64-encoded cleartext. This allows remote attackers to steal the password and gain full control of the Loytec device configuration.

The issue concerns insecure permissions in the LINX Configurator, where credentials are stored in cleartext. This allows remote attackers to disclose the admin password and bypass authentication to login to the Loytec device.

The issue allows remote attackers to disclose smtp client account credentials and bypass email authentication due to insecure permissions via the dpal config.zml file.

The issue is related to Incorrect Access Control via the `dpal config.zml` file, allowing remote attackers to disclose sensitive information on device data point configuration.