deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-5600
Published: 2015-08-03
Description: The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c; http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth2-chall.c.diff?r1=1.42&r2=1.43&f=h; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10697
CVE: CVE-2015-2212
Published: 2015-08-03
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2015-5623.  Reason: This candidate is a reservation duplicate of CVE-2015-5623.  Notes: All CVE users should reference CVE-2015-5623 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2015-3440
Published: 2015-08-03
Description: Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://codex.wordpress.org/Version_4.2.1; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157391.html; http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html
CVE: CVE-2015-5622
Published: 2015-08-03
Description: Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://codex.wordpress.org/Version_4.2.3; http://openwall.com/lists/oss-security/2015/07/23/18; http://www.debian.org/security/2015/dsa-3328
CVE: CVE-2015-5623
Published: 2015-08-03
Description: WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-284
References: http://codex.wordpress.org/Version_4.2.3; http://openwall.com/lists/oss-security/2015/07/23/18; http://www.debian.org/security/2015/dsa-3328
CVE: CVE-2015-1955
Published: 2015-08-03
Description: IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (CPU consumption) via a crafted byte sequence in authentication data.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959205; http://www-01.ibm.com/support/docview.wss?uid=swg21959205
CVE: CVE-2015-1956
Published: 2015-08-03
Description: IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (disk consumption) via a crafted byte sequence in authentication data, a different vulnerability than CVE-2015-1958 and CVE-2015-1987.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959204; http://www-01.ibm.com/support/docview.wss?uid=swg21959204
CVE: CVE-2015-1958
Published: 2015-08-03
Description: IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (disk consumption) via a crafted byte sequence in authentication data, a different vulnerability than CVE-2015-1956 and CVE-2015-1987.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959210; http://www-01.ibm.com/support/docview.wss?uid=swg21959210
CVE: CVE-2015-1970
Published: 2015-08-03
Description: The IBM WebSphere DataPower XC10 appliance 2.1 through 2.1.0.3 and 2.5 through 2.5.0.4 retains data on SSD cards, which might allow physically proximate attackers to obtain sensitive information by extracting a card and attaching it elsewhere.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IT09803; http://www-01.ibm.com/support/docview.wss?uid=swg21962861; http://www-01.ibm.com/support/docview.wss?uid=swg1IT09803
CVE: CVE-2015-1987
Published: 2015-08-03
Description: IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (disk consumption) via a crafted byte sequence in authentication data, a different vulnerability than CVE-2015-1956 and CVE-2015-1958.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg21961276; http://www-01.ibm.com/support/docview.wss?uid=swg21961276
CVE: CVE-2015-4931
Published: 2015-08-03
Description: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a different vulnerability than CVE-2015-4932, CVE-2015-4933, CVE-2015-4934, and CVE-2015-4935.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21961928; http://www.securityfocus.com/bid/76107; http://www.zerodayinitiative.com/advisories/ZDI-15-375
CVE: CVE-2015-4932
Published: 2015-08-03
Description: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a different vulnerability than CVE-2015-4931, CVE-2015-4933, CVE-2015-4934, and CVE-2015-4935.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21961928; http://www.securityfocus.com/bid/76106; http://www.zerodayinitiative.com/advisories/ZDI-15-373
CVE: CVE-2015-4933
Published: 2015-08-03
Description: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a different vulnerability than CVE-2015-4931, CVE-2015-4932, CVE-2015-4934, and CVE-2015-4935.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21961928; http://www.securityfocus.com/bid/76111; http://www.zerodayinitiative.com/advisories/ZDI-15-374
CVE: CVE-2015-4934
Published: 2015-08-03
Description: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a different vulnerability than CVE-2015-4931, CVE-2015-4932, CVE-2015-4933, and CVE-2015-4935.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21961928; http://www.securityfocus.com/bid/76109; http://www.zerodayinitiative.com/advisories/ZDI-15-376
CVE: CVE-2015-4935
Published: 2015-08-03
Description: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a different vulnerability than CVE-2015-4931, CVE-2015-4932, CVE-2015-4933, and CVE-2015-4934.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg21961928; http://www.securityfocus.com/bid/76110; http://www.zerodayinitiative.com/advisories/ZDI-15-372
CVE: CVE-2015-4936
Published: 2015-08-03
Description: Unspecified vulnerability in IBM WebSphere eXtreme Scale 8.6 through 8.6.0.8 allows remote attackers to cause a denial of service via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PI44031; http://www-01.ibm.com/support/docview.wss?uid=swg21962716; http://www-01.ibm.com/support/docview.wss?uid=swg1PI44031
CVE: CVE-2015-3940
Published: 2015-08-04
Description: Untrusted search path vulnerability in Schneider Electric Wonderware System Platform before 2014 R2 Patch 01 allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-22
References: http://iom.invensys.com/EN/pdfLibrary/Security_Bulletin_LFSEC00000106.pdf; http://www.securityfocus.com/bid/75297; http://www.securitytracker.com/id/1033179
CVE: CVE-2015-3942
Published: 2015-08-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in the web-server component in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.garrettcom.com/techsupport/MNS6K_R456_Release_Notes.pdf; http://www.securityfocus.com/bid/75227; https://ics-cert.us-cert.gov/advisories/ICSA-15-167-01
CVE: CVE-2015-3959
Published: 2015-08-04
Description: The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches has a hardcoded serial-console password for a privileged account, which might allow physically proximate attackers to obtain access by establishing a console session to a nonstandard installation on which this account is enabled, and leveraging knowledge of this password.
CVSS Score: 7.2 (HIGH)
References: http://www.garrettcom.com/techsupport/MNS6K_R456_Release_Notes.pdf; http://www.securityfocus.com/bid/75235; https://ics-cert.us-cert.gov/advisories/ICSA-15-167-01
CVE: CVE-2015-3960
Published: 2015-08-04
Description: The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches uses hardcoded RSA private keys and certificates across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms for HTTPS sessions by leveraging knowledge of a private key from another installation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://www.garrettcom.com/techsupport/MNS6K_R456_Release_Notes.pdf; http://www.securityfocus.com/bid/75236; https://ics-cert.us-cert.gov/advisories/ICSA-15-167-01
CVE: CVE-2015-3961
Published: 2015-08-04
Description: The web-server component in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches allows remote authenticated users to cause a denial of service (memory corruption and reboot) via a crafted URL.
CVSS Score: 3.5 (LOW)
CWE: CWE-399
References: http://www.garrettcom.com/techsupport/MNS6K_R456_Release_Notes.pdf; http://www.securityfocus.com/bid/75228; https://ics-cert.us-cert.gov/advisories/ICSA-15-167-01
CVE: CVE-2015-3963
Published: 2015-08-04
Description: Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnet_coreip 1.2.2.0, as used on Schneider Electric SAGE RTU devices before J2 and other devices, does not properly generate TCP initial sequence number (ISN) values, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-330
References: http://www.schneider-electric.com/ww/en/download/document/SEVD-2015-162-01; http://www.securityfocus.com/bid/75302; http://www.securitytracker.com/id/1032730
CVE: CVE-2001-1594
Published: 2015-08-04
Description: GE Healthcare eNTEGRA P&R has a password of (1) entegra for the entegra user, (2) passme for the super user of the Polestar/Polestar-i Starlink 4 upgrade, (3) 0 for the entegra user of the Codonics printer FTP service, (4) eNTEGRA for the eNTEGRA P&R user account, (5) insite for the WinVNC Login, and possibly other accounts, which has unspecified impact and attack vectors.  NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://apps.gehealthcare.com/servlet/ClientServlet/2263784.pdf?DOCCLASS=A&REQ=RAC&DIRECTION=2263784-100&FILENAME=2263784.pdf&FILEREV=5&DOCREV_ORG=5&SUBMIT=+ACCEPT+; http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/; https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02
CVE: CVE-2002-2445
Published: 2015-08-04
Description: GE Healthcare Millennium MG, NC, and MyoSIGHT has a default password of (1) root.genie for the root user, (2) "service." for the service user, (3) admin.genie for the admin user, (4) reboot for the reboot user, and (5) shutdown for the shutdown user, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://apps.gehealthcare.com/servlet/ClientServlet/2338955-100.pdf?REQ=RAA&DIRECTION=2338955-100&FILENAME=2338955-100.pdf&FILEREV=1&DOCREV_ORG=1; http://apps.gehealthcare.com/servlet/ClientServlet/2354459-100.pdf?REQ=RAA&DIRECTION=2354459-100&FILENAME=2354459-100.pdf&FILEREV=4&DOCREV_ORG=4; http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/
CVE: CVE-2002-2446
Published: 2015-08-04
Description: GE Healthcare Millennium MG, NC, and MyoSIGHT has a password of insite.genieacq for the insite account that cannot be changed without disabling product functionality for remote InSite support, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://apps.gehealthcare.com/servlet/ClientServlet/2338955-100.pdf?REQ=RAA&DIRECTION=2338955-100&FILENAME=2338955-100.pdf&FILEREV=1&DOCREV_ORG=1; http://apps.gehealthcare.com/servlet/ClientServlet/2354459-100.pdf?REQ=RAA&DIRECTION=2354459-100&FILENAME=2354459-100.pdf&FILEREV=4&DOCREV_ORG=4; http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/
CVE: CVE-2003-1603
Published: 2015-08-04
Description: GE Healthcare Discovery VH has a default password of (1) interfile for the ftpclient user of the Interfile server or (2) "2" for the LOCAL user of the FTP server for the Codonics printer, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://apps.gehealthcare.com/servlet/ClientServlet/2337093-100.pdf?REQ=RAA&DIRECTION=2337093-100&FILENAME=2337093-100.pdf&FILEREV=1&DOCREV_ORG=1; http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/; https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02
CVE: CVE-2004-2777
Published: 2015-08-04
Description: GE Healthcare Centricity Image Vault 3.x has a password of (1) gemnet for the administrator account, (2) webadmin for the webadmin administrator account of the ASACA DVD library, (3) an empty value for the gemsservice account of the Ultrasound Database, and possibly (4) gemnet2002 for the gemnet2002 account of the GEMNet license server, which has unspecified impact and attack vectors.  NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://apps.gehealthcare.com/servlet/ClientServlet/2010564-002E.pdf?REQ=RAA&DIRECTION=2010564-002&FILENAME=2010564-002E.pdf&FILEREV=E&DOCREV_ORG=E; http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/; https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02
CVE: CVE-2006-7253
Published: 2015-08-04
Description: GE Healthcare Infinia II has a default password of (1) infinia for the infinia user, (2) #bigguy1 for the acqservice user, (3) dont4get2 for the Administrator user, (4) #bigguy1 for the emergency user, and (5) 2Bfamous for the InfiniaAdmin user, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://apps.gehealthcare.com/servlet/ClientServlet/H-xw4100+Workstation.pdf?REQ=RAA&DIRECTION=2411012-100&FILENAME=H-xw4100%2BWorkstation.pdf&FILEREV=6&DOCREV_ORG=6; http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/; https://twitter.com/digitalbond/status/[PII_REDACTED]51222277
CVE: CVE-2007-6757
Published: 2015-08-04
Description: GE Healthcare Centricity DMS 4.2, 4.1, and 4.0 has a password of Muse!Admin for the Museadmin user, which has unspecified impact and attack vectors.  NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://apps.gehealthcare.com/servlet/ClientServlet/2019295-133D.pdf?REQ=RAA&DIRECTION=2019295-133D&FILENAME=2019295-133D.pdf&FILEREV=D&DOCREV_ORG=D; http://apps.gehealthcare.com/servlet/ClientServlet/2019295-133G.pdf?REQ=RAA&DIRECTION=2019295-133&FILENAME=2019295-133G.pdf&FILEREV=G&DOCREV_ORG=G; http://apps.gehealthcare.com/servlet/ClientServlet/DMS+Sys+Mgmt+Manual.pdf?REQ=RAA&DIRECTION=DOC1258180&FILENAME=DMS%2BSys%2BMgmt%2BManual.pdf&FILEREV=3&DOCREV_ORG=3
CVE: CVE-2009-5143
Published: 2015-08-04
Description: GE Healthcare Discovery 530C has a password of #bigguy1 for the (1) acqservice user and (2) wsservice user of the Xeleris System, which has unspecified impact and attack vectors.  NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://apps.gehealthcare.com/servlet/ClientServlet/5323167-1EN_r2.pdf?REQ=RAA&DIRECTION=5323167-1EN&FILENAME=5323167-1EN_r2.pdf&FILEREV=2&DOCREV_ORG=2; http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/; https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02
CVE: CVE-2010-5306
Published: 2015-08-04
Description: GE Healthcare Optima CT680, CT540, CT640, and CT520 has a default password of #bigguy for the root user, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://apps.gehealthcare.com/servlet/ClientServlet/5341628-1EN_r12.pdf?REQ=RAA&DIRECTION=5341628-1EN&FILENAME=5341628-1EN_r12.pdf&FILEREV=12&DOCREV_ORG=12; http://apps.gehealthcare.com/servlet/ClientServlet/5401943_rev+3.pdf?REQ=RAA&DIRECTION=5401943&FILENAME=5401943_rev%2B3.pdf&FILEREV=3&DOCREV_ORG=3; http://apps.gehealthcare.com/servlet/ClientServlet/5472001-1EN_rev2.pdf?REQ=RAA&DIRECTION=5472001-1EN&FILENAME=5472001-1EN_rev2.pdf&FILEREV=2&DOCREV_ORG=2
CVE: CVE-2010-5307
Published: 2015-08-04
Description: The HIPAA configuration interface in GE Healthcare Optima MR360 has a password of (1) operator for the root account, (2) adw2.0 for the admin account, and (3) adw2.0 for the sdc account, which has unspecified impact and attack vectors.  NOTE: it is not clear whether these passwords are default, hardcoded, or dependent on another system or product that requires a fixed value.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://apps.gehealthcare.com/servlet/ClientServlet/MR360+operator+manual+paper.pdf?REQ=RAA&DIRECTION=5339461-1EN&FILENAME=MR360%2Boperator%2Bmanual%2Bpaper.pdf&FILEREV=4&DOCREV_ORG=4; http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/; https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02
CVE: CVE-2010-5308
Published: 2015-08-04
Description: GE Healthcare Optima MR360 does not require authentication for the HIPAA emergency login procedure, which allows physically proximate users to gain access via an arbitrary username in the Emergency Login screen.  NOTE: this might not qualify for inclusion in CVE if unauthenticated emergency access is part of the intended security policy of the product, can be controlled by the system administrator, and is not enabled by default.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://apps.gehealthcare.com/servlet/ClientServlet/MR360+operator+manual+paper.pdf?REQ=RAA&DIRECTION=5339461-1EN&FILENAME=MR360%2Boperator%2Bmanual%2Bpaper.pdf&FILEREV=4&DOCREV_ORG=4; http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/; https://twitter.com/digitalbond/status/[PII_REDACTED]51222277
CVE: CVE-2010-5309
Published: 2015-08-04
Description: GE Healthcare CADStream Server has a default password of confirma for the admin user, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://apps.gehealthcare.com/servlet/ClientServlet/MR360+operator+manual+paper.pdf?REQ=RAA&DIRECTION=5339461-1EN&FILENAME=MR360%2Boperator%2Bmanual%2Bpaper.pdf&FILEREV=4&DOCREV_ORG=4; http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/; https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02
CVE: CVE-2010-5310
Published: 2015-08-04
Description: The Acquisition Workstation for the GE Healthcare Revolution XQ/i has a password of adw3.1 for the sdc user, which has unspecified impact and attack vectors.  NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://apps.gehealthcare.com/servlet/ClientServlet/2296976-100R10.pdf?DOCCLASS=A&REQ=RAC&DIRECTION=2296976-100&FILENAME=2296976-100R10.pdf&FILEREV=10&DOCREV_ORG=10&SUBMIT=+ACCEPT+; http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/; https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02
CVE: CVE-2011-5322
Published: 2015-08-04
Description: GE Healthcare Centricity Analytics Server 1.1 has a default password of (1) V0yag3r for the SQL Server sa user, (2) G3car3s for the analyst user, (3) G3car3s for the ccg user, (4) V0yag3r for the viewer user, and (5) geservice for the geservice user in the Webmin interface, which has unspecified impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://apps.gehealthcare.com/servlet/ClientServlet/CA11_IN_2059103-001r4.pdf?REQ=RAA&DIRECTION=2059103-001&FILENAME=CA11_IN_2059103-001r4.pdf&FILEREV=4&DOCREV_ORG=4; http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/; https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02
CVE: CVE-2011-5323
Published: 2015-08-04
Description: GE Healthcare Centricity PACS-IW 3.7.3.7, 3.7.3.8, and possibly other versions has a password of A11enda1e for the sa SQL server user, which has unspecified impact and attack vectors.  NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://apps.gehealthcare.com/servlet/ClientServlet/3.7.3.7+Installation+Guide.pdf?REQ=RAA&DIRECTION=DOC0947634&FILENAME=3.7.3.7%2BInstallation%2BGuide.pdf&FILEREV=1&DOCREV_ORG=1; http://apps.gehealthcare.com/servlet/ClientServlet/3.7.3.8+Installation+guide.pdf?REQ=RAA&DIRECTION=DOC1059456&FILENAME=3.7.3.8%2BInstallation%2Bguide.pdf&FILEREV=1&DOCREV_ORG=1; http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/
CVE: CVE-2011-5324
Published: 2015-08-04
Description: The TeraRecon server, as used in GE Healthcare Centricity PACS-IW 3.7.3.7, 3.7.3.8, and possibly other versions, has a password of (1) shared for the shared user and (2) scan for the scan user, which has unspecified impact and attack vectors.  NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://apps.gehealthcare.com/servlet/ClientServlet/3.7.3.7+Installation+Guide.pdf?REQ=RAA&DIRECTION=DOC0947634&FILENAME=3.7.3.7%2BInstallation%2BGuide.pdf&FILEREV=1&DOCREV_ORG=1; http://apps.gehealthcare.com/servlet/ClientServlet/3.7.3.8+Installation+guide.pdf?REQ=RAA&DIRECTION=DOC1059456&FILENAME=3.7.3.8%2BInstallation%2Bguide.pdf&FILEREV=1&DOCREV_ORG=1; http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/
CVE: CVE-2012-6660
Published: 2015-08-04
Description: GE Healthcare Precision MPi has a password of (1) orion for the serviceapp user, (2) orion for the clinical operator user, and (3) PlatinumOne for the administrator user, which has unspecified impact and attack vectors.  NOTE: it is not clear whether these passwords are default, hardcoded, or dependent on another system or product that requires a fixed value.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://apps.gehealthcare.com/servlet/ClientServlet/2407310-100+Vol.+F_Rev1.pdf?REQ=RAA&DIRECTION=2407310-100+Vol.+F&FILENAME=2407310-100%2BVol.%2BF_Rev1.pdf&FILEREV=1&DOCREV_ORG=1; http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/; https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02