Bd vulnerabilities, page 2
32 vulnerabilities
Known vulnerabilities in Bd products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 60 products.
MediumCVE-2023-29061bd · facschorus +1 moreLack of Adequate BIOS AuthenticationThere is no BIOS password on the FACSChorus workstation. A threat actor with physical access to the workstation can potentially exploit this vulnerability to access the BIOS configuration and modify the drive boot order and BIOS pre-boot authentication.EPSS0.38%MediumCVE-2023-29065bd · facschorus +1 moreOverly Permissive Access PolicyThe FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical access could potentially gain credentials, which could be used to alter or destroy data stored in the database.EPSS0.27%LowCVE-2023-29062bd · facschorus +1 moreUnsecure Identity VerificationThe Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately validating the identity of the requested resource. This is possible through the use of LLMNR, MBT-NS, or MDNS and will result in NTLMv2 hashes being sent to a malicious entity position on the local network. These hashes can subsequently be attacked through brute force and cracked if a weak password is used. This attack would only apply to domain joined systems.EPSS0.30%MediumCVE-2023-29064bd · facschorus +1 moreHardcoded SecretsThe FACSChorus software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets used by the application, which include tokens and passwords for administrative accounts.EPSS0.27%LowCVE-2023-29066bd · facschorus +1 moreIncorrect User ManagementThe FACSChorus software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account can modify information stored in the local application data folders.EPSS0.27%MediumCVE-2023-30561bd · alaris_8015_pcu_firmware +1 moreLack of Cryptographic Security of IUI BusThe data flowing between the PCU and its modules is insecure. A threat actor with physical access could potentially read or modify data by attaching a specially crafted device while an infusion is running.EPSS0.19%MediumCVE-2023-30560bd · alaris_8015_pcu_firmware +1 morePCU Configuration Lacks AuthenticationThe configuration from the PCU can be modified without authentication using physical connection to the PCU.EPSS0.30%MediumCVE-2023-30559bd · alaris_8015_pcu_firmware +1 moreWireless Card Firmware Improperly SignedThe firmware update package for the wireless card is not properly signed and can be modified.EPSS0.18%MediumCVE-2023-30562bd · alaris_guardrails_editor +1 moreLack of Dataset Integrity CheckingA GRE dataset file within Systems Manager can be tampered with and distributed to PCUs.EPSS0.18%HighCVE-2023-30563bd · alaris_systems_manager +1 moreStored Cross-Site Scripting on User Import FunctionalityA malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session.EPSS0.44%MediumCVE-2023-30564bd · alaris_systems_manager +1 moreStored Cross-Site Scripting on Device Import FunctionalityAlaris Systems Manager does not perform input validation during the Device Import Function.EPSS0.29%LowCVE-2023-30565bd · guardrails_cqi_reporter +1 moreCQI Data SniffingAn insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker.EPSS0.14%