Dr. Oliver Matula

The issue allows an authenticated attacker to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges.

The Platform component could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands within the same privilege level as the web access process.

The issue is related to the JoltTransformJSON Processor in Apache NiFi, which provides an advanced configuration user interface vulnerable to DOM-based cross-site scripting. If an authenticated user visits a crafted URL, arbitrary JavaScript code can be executed within the session context of the authenticated user.

A relative path traversal attack allows attackers with service user privileges to upload arbitrary files. By uploading a specially crafted tar file, an attacker can execute arbitrary commands.

A vulnerability allows attackers to recover user credentials of the administrative interface.

A XPath injection issue allows unauthenticated remote attackers to access sensitive information and escalate privileges.

The issue is related to improper access controls, allowing attackers to extract and tamper with the device's network configuration.

The issue allows user input to be validated on the client side without proper authentication by the server. This is problematic because the server should not rely solely on the correctness of the data sent by the client, as users may not support or block JavaScript, or could intentionally bypass the client-side checks. An attacker with knowledge of the service user could exploit this by circumventing the client-side control, potentially allowing them to login with service privileges.

An attacker with physical access to the host can extract secrets from the registry and create valid JWT tokens for the application, allowing them to impersonate arbitrary users. This could also enable the manipulation of RabbitMQ queues and messages by impersonating users.

The issue allows access to sensitive endpoints without requiring authentication information, such as a session cookie. This enables an attacker to send requests to these endpoints as an unauthenticated user, potentially performing critical actions or modifying critical configuration parameters.

The application layer encryption of the communication protocol between the Ypsomed mylife App and mylife Cloud uses non-random IVs, which allows man-in-the-middle attackers to tamper with messages.

The Ypsomed mylife Cloud reflects the user password during the login process after redirecting the user from a HTTPS endpoint to a HTTP endpoint.

The Ypsomed mylife Cloud discloses password hashes during the registration process.

Name of the Vulnerable Software and Affected Versions: Hamilton Medical AG T1-Ventillator versions 2.2.3 and prior Description: The issue is related to an XML validation vulnerability in the ventilator, allowing privileged attackers with physical access to render the device persistently unusable by uploading specially crafted configuration files. Recommendations: For Hamilton Medical AG T1-Ventillator versions 2.2.3 and prior, consider restricting physical access to the device to prevent exploitation of the XML validation vulnerability until a patch is available. As a temporary workaround, consider disabling the upload of configuration files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Innokas Yhtymä Oy Vital Signs Monitor VC150 versions prior to 1.7.15 Description: A stored cross-site scripting issue exists in the affected product, allowing an attacker to inject arbitrary web script or HTML via the `filename` parameter to multiple update endpoints of the administrative web interface. Recommendations: For versions prior to 1.7.15, update to version 1.7.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the administrative web interface to minimize the risk of exploitation. Avoid using the `filename` parameter in the affected update endpoints until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Innokas Yhtymä Oy Vital Signs Monitor VC150 versions prior to 1.7.15 Description: The issue allows physically proximate attackers with a connected barcode reader to inject HL7 v2.x segments into specific HL7 v2.x messages via multiple expected parameters. This is related to HL7 v2.x injection vulnerabilities in the affected products. Recommendations: For versions prior to 1.7.15, update to version 1.7.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the barcode reader or limiting the ability to inject HL7 v2.x segments into messages until a patch is applied.

An Excel Macro Injection issue exists in the export feature due to mishandled input fields in the Excel export.

The issue is related to the configuration import mechanism, which allows attackers with command line access to the underlying Linux system to escalate privileges to the root user. This is due to insecure privilege management in the firmware of the affected medical devices.

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is then used as a webpage and served to other users. Successful exploitation could lead to unauthorized access to patient data via a read-only web application.