Section
Vulnerabilities
CVE records from NVD, ZDI advisories and the CISA KEV catalog, with CVSS, EPSS, SSVC and exploitation state.
11 matching records.
-
CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute…
CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.
-
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums.
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
-
XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML…
XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks.
-
The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization…
The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.
-
Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling…
Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.
-
The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed…
The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts.
-
Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without…
Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection.
-
Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations.
Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations.
-
Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials…
Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields.
-
A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.
A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.
-
Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files.
Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create files.
Reuse this view
Same filters as JSON: /api/items?category=vuln&window=30d&vendor=CompuGroup+Medical&limit=100. RSS for this section: feed.xml.