rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-12635 
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.
Problem types: description: Information Disclosure
Affected products: vendor: Apache Software Foundation
product: Apache CouchDB
Published: 2017-11-14T20:00:00.000Z
CVE-2017-12636 
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
Problem types: description: Information Disclosure
Affected products: vendor: Apache Software Foundation
product: Apache CouchDB
Published: 2017-11-14T20:00:00.000Z
CVE-2017-12637 
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 2017, aka SAP Security Note 2486657.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T20:00:00.000Z
CVE-2017-12638 
Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspecified vectors in IMmailSrv, aka ETBL or ETCETERABLUE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-02T21:00:00.000Z
CVE-2017-12639 
Stack based buffer overflow in Ipswitch IMail server up to and including 12.5.5 allows remote attackers to execute arbitrary code via unspecified vectors in IMmailSrv, aka ETRE or ETCTERARED.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-02T21:00:00.000Z
CVE-2017-12640 
ImageMagick 7.0.6-1 has an out-of-bounds read vulnerability in ReadOneMNGImage in coders/png.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T15:00:00.000Z
CVE-2017-12641 
ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadOneJNGImage in coders\png.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T15:00:00.000Z
CVE-2017-12642 
ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadMPCImage in coders\mpc.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T15:00:00.000Z
CVE-2017-12643 
ImageMagick 7.0.6-1 has a memory exhaustion vulnerability in ReadOneJNGImage in coders\png.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T15:00:00.000Z
CVE-2017-12644 
ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadDCMImage in coders\dcm.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T15:00:00.000Z
CVE-2017-12645 
XSS exists in Liferay Portal before 7.0 CE GA4 via an invalid portletId.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T16:00:00.000Z
CVE-2017-12646 
XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T16:00:00.000Z
CVE-2017-12647 
XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T16:00:00.000Z
CVE-2017-12648 
XSS exists in Liferay Portal before 7.0 CE GA4 via a bookmark URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T16:00:00.000Z
CVE-2017-12649 
XSS exists in Liferay Portal before 7.0 CE GA4 via a crafted title or summary that is mishandled in the Web Content Display.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T16:00:00.000Z
CVE-2017-12650 
SQL Injection exists in the Loginizer plugin before 1.3.6 for WordPress via the X-Forwarded-For HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T17:00:00.000Z
CVE-2017-12651 
Cross Site Request Forgery (CSRF) exists in the Blacklist and Whitelist IP Wizard in init.php in the Loginizer plugin before 1.3.6 for WordPress because the HTTP Referer header is not checked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T17:00:00.000Z
CVE-2017-12652 
libpng before 1.6.32 does not properly check the length of chunks against the user limit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-10T14:10:07.000Z
CVE-2017-12653 
360 Total Security 9.0.0.1202 before 2017-07-07 allows Privilege Escalation via a Trojan horse Shcore.dll file in any directory in the PATH, as demonstrated by the C:\Python27 directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T18:00:00.000Z
CVE-2017-12654 
The ReadPICTImage function in coders/pict.c in ImageMagick 7.0.6-3 allows attackers to cause a denial of service (memory leak) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T18:00:00.000Z
CVE-2017-12655 
Cross-Site Scripting (XSS) exists in NexusPHP version v1.5 via the query parameter to log.php in a dailylog action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T20:00:00.000Z
CVE-2017-12662 
ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePDFImage in coders/pdf.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T21:00:00.000Z
CVE-2017-12663 
ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteMAPImage in coders/map.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T21:00:00.000Z
CVE-2017-12664 
ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePALMImage in coders/palm.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T21:00:00.000Z
CVE-2017-12665 
ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePICTImage in coders/pict.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T21:00:00.000Z
CVE-2017-12666 
ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteINLINEImage in coders/inline.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T21:00:00.000Z
CVE-2017-12667 
ImageMagick 7.0.6-1 has a memory leak vulnerability in ReadMATImage in coders\mat.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T21:00:00.000Z
CVE-2017-12668 
ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePCXImage in coders/pcx.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T21:00:00.000Z
CVE-2017-12669 
ImageMagick 7.0.6-2 has a memory leak vulnerability in WriteCALSImage in coders/cals.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T21:00:00.000Z
CVE-2017-12670 
In ImageMagick 7.0.6-3, missing validation was found in coders/mat.c, leading to an assertion failure in the function DestroyImage in MagickCore/image.c, which allows attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T21:00:00.000Z
CVE-2017-12671 
In ImageMagick 7.0.6-3, a missing NULL assignment was found in coders/png.c, leading to an invalid free in the function RelinquishMagickMemory in MagickCore/memory.c, which allows attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T21:00:00.000Z
CVE-2017-12672 
In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T21:00:00.000Z
CVE-2017-12673 
In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadOneMNGImage in coders/png.c, which allows attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T21:00:00.000Z
CVE-2017-12674 
In ImageMagick 7.0.6-2, a CPU exhaustion vulnerability was found in the function ReadPDBImage in coders/pdb.c, which allows attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T21:00:00.000Z
CVE-2017-12675 
In ImageMagick 7.0.6-3, a missing check for multidimensional data was found in coders/mat.c, leading to a memory leak in the function ReadImage in MagickCore/constitute.c, which allows attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T21:00:00.000Z
CVE-2017-12676 
In ImageMagick 7.0.6-3, a memory leak vulnerability was found in the function ReadOneJNGImage in coders/png.c, which allows attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T21:00:00.000Z
CVE-2017-12677 
IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on the authorize response page, which might allow remote attackers to obtain sensitive information about the IdentityServer authorization response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-08T01:00:00.000Z
CVE-2017-12678 
In TagLib 1.11.1, the rebuildAggregateFrames function in id3v2framefactory.cpp has a pointer to cast vulnerability, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted audio file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-08T01:00:00.000Z
CVE-2017-12679 
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-24T17:00:00.000Z
CVE-2017-12680 
Cross-Site Scripting (XSS) exists in NexusPHP 1.5 via the type parameter to shoutbox.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-18T16:00:00.000Z
CVE-2017-12691 
The ReadOneLayer function in coders/xcf.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-01T21:00:00.000Z
CVE-2017-12692 
The ReadVIFFImage function in coders/viff.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted VIFF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-01T21:00:00.000Z
CVE-2017-12693 
The ReadBMPImage function in coders/bmp.c in ImageMagick 7.0.6-6 allows remote attackers to cause a denial of service (memory consumption) via a crafted BMP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-01T21:00:00.000Z
CVE-2017-12694 
A Directory Traversal issue was discovered in SpiderControl SCADA Web Server. An attacker may be able to use a simple GET request to perform a directory traversal into system files.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: n/a
product: SpiderControl SCADA Web Server
Published: 2017-08-25T19:00:00.000Z
CVE-2017-12695 
An Improper Authentication issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow an attacker to subvert security mechanisms and reset a user account password.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: n/a
product: General Motors and Shanghai OnStar (SOS) iOS Client
Published: 2018-01-09T21:00:00.000Z
CVE-2017-12697 
A Man-in-the-Middle issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow an attacker to intercept sensitive information when the client connects to the server.
Problem types: cwe_id: CWE-300
description: CWE-300
Affected products: vendor: n/a
product: General Motors and Shanghai OnStar (SOS) iOS Client
Published: 2018-01-09T21:00:00.000Z
CVE-2017-12698 
An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Specially crafted requests allow a possible authentication bypass that could allow remote code execution.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: n/a
product: Advantech WebAccess
Published: 2017-08-30T18:00:00.000Z
CVE-2017-12699 
An Incorrect Default Permissions issue was discovered in AzeoTech DAQFactory versions prior to 17.1. Local, non-administrative users may be able to replace or modify original application files with malicious ones.
Problem types: cwe_id: CWE-276
description: CWE-276
Affected products: vendor: n/a
product: AzeoTech DAQFactory
Published: 2017-09-09T01:00:00.000Z
CVE-2017-12701 
BMC Medical Luna CPAP Machines released prior to July 1, 2017, contain an improper input validation vulnerability which may allow an authenticated attacker to crash the CPAP's Wi-Fi module resulting in a denial-of-service condition.
Problem types: cwe_id: CWE-20
description: Improper input validation write CWE-20
Affected products: vendor: BMC Medical
product: Luna CPAP Machine
Published: 2018-04-17T14:00:00.000Z
CVE-2017-12702 
An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. String format specifiers based on user provided input are not properly validated, which could allow an attacker to execute arbitrary code.
Problem types: cwe_id: CWE-134
description: CWE-134
Affected products: vendor: n/a
product: Advantech WebAccess
Published: 2017-08-30T18:00:00.000Z
CVE-2017-12703 
A Cross-Site Request Forgery (CSRF) issue was discovered in Westermo MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The application does not verify whether a request was intentionally provided by the user, making it possible for an attacker to trick a user into making a malicious request to the server.
Problem types: description: CSRF
Affected products: vendor: n/a
product: Westermo MRD-305-DIN, MRD-315, MRD-355, and MRD-455
Published: 2017-08-25T16:00:00.000Z
CVE-2017-12704 
A heap-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multiple vulnerabilities where there is a lack of proper validation of the length of user-supplied data prior to copying it to the heap-based buffer, which could allow an attacker to execute arbitrary code under the context of the process.
Problem types: cwe_id: CWE-122
description: CWE-122
Affected products: vendor: n/a
product: Advantech WebAccess
Published: 2017-08-30T18:00:00.000Z
CVE-2017-12705 
A Heap-Based Buffer Overflow issue was discovered in Advantech WebOP. A maliciously crafted project file may be able to trigger a heap-based buffer overflow, which may crash the process and allow an attacker to execute arbitrary code.
Problem types: description: heap-based buffer overflow
Affected products: vendor: n/a
product: Advantech WebOP
Published: 2017-10-25T07:00:00.000Z
CVE-2017-12706 
A stack-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multiple vulnerabilities where there is a lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer, which could allow an attacker to execute arbitrary code under the context of the process.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: n/a
product: Advantech WebAccess
Published: 2017-08-30T18:00:00.000Z
CVE-2017-12707 
A Stack-based Buffer Overflow issue was discovered in SpiderControl SCADA MicroBrowser Versions 1.6.30.144 and prior. Opening a maliciously crafted html file may cause a stack overflow.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: n/a
product: SpiderControl SCADA MicroBrowser
Published: 2017-08-25T19:00:00.000Z
CVE-2017-12708 
An Improper Restriction Of Operations Within The Bounds Of A Memory Buffer issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multiple vulnerabilities that allow invalid locations to be referenced for the memory buffer, which may allow an attacker to execute arbitrary code or cause the system to crash.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: Advantech WebAccess
Published: 2017-08-30T18:00:00.000Z
CVE-2017-12709 
A Use of Hard-Coded Credentials issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions older than 1.7.5.0. The device utilizes hard-coded credentials, which could allow for unauthorized local low-privileged access to the device.
Problem types: cwe_id: CWE-798
description: CWE-798
Affected products: vendor: n/a
product: Westermo MRD-305-DIN, MRD-315, MRD-355, and MRD-455
Published: 2017-08-25T16:00:00.000Z
CVE-2017-12710 
A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. By submitting a specially crafted parameter, it is possible to inject arbitrary SQL statements that could allow an attacker to obtain sensitive information.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: n/a
product: Advantech WebAccess
Published: 2017-08-30T18:00:00.000Z
CVE-2017-12711 
An Incorrect Privilege Assignment issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A built-in user account has been granted a sensitive privilege that may allow a user to elevate to administrative privileges.
Problem types: cwe_id: CWE-266
description: CWE-266
Affected products: vendor: n/a
product: Advantech WebAccess
Published: 2017-08-30T18:00:00.000Z
CVE-2017-12712 
The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an authentication key and time stamp, can be compromised or bypassed, which may allow a nearby attacker to issue unauthorized commands to the pacemaker via RF communications. CVSS v3 base score: 7.5, CVSS vector string: AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Abbott has developed a firmware update to help mitigate the identified vulnerabilities.
Problem types: cwe_id: CWE-287
description: Improper authentication CWE-287
Affected products: vendor: Abbott Laboratories
product: Accent/Anthem, Accent MRI, Assurity/Allure, and Assurity MRI.
Published: 2018-04-25T13:00:00.000Z
CVE-2017-12713 
An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Multiple files and folders with ACLs that affect other users are allowed to be modified by non-administrator accounts.
Problem types: cwe_id: CWE-732
description: CWE-732
Affected products: vendor: n/a
product: Advantech WebAccess
Published: 2017-08-30T18:00:00.000Z
CVE-2017-12714 
Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017 do not restrict or limit the number of correctly formatted "RF wake-up" commands that can be received, which may allow a nearby attacker to repeatedly send commands to reduce pacemaker battery life. CVSS v3 base score: 5.3, CVSS vector string: AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. Abbott has developed a firmware update to help mitigate the identified vulnerabilities.
Problem types: cwe_id: CWE-920
description: Improper Restriction of power consumption CWE-920
Affected products: vendor: Abbott Laboratories
product: Accent/Anthem, Accent MRI, Assurity/Allure, and Assurity MRI.
Published: 2018-04-25T13:00:00.000Z
CVE-2017-12716 
Abbott Laboratories Accent and Anthem pacemakers manufactured prior to Aug 28, 2017 transmit unencrypted patient information via RF communications to programmers and home monitoring units. Additionally, the Accent and Anthem pacemakers store the optional patient information without encryption. CVSS v3 base score: 3.1, CVSS vector string: AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Abbott has developed a firmware update to help mitigate the identified vulnerabilities.
Problem types: cwe_id: CWE-311
description: Missing encryption of sensitive data CWE-311
Affected products: vendor: Abbott Laboratories
product: Accent and Anthem
Published: 2018-04-25T13:00:00.000Z
CVE-2017-12717 
An Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A maliciously crafted dll file placed earlier in the search path may allow an attacker to execute code within the context of the application.
Problem types: cwe_id: CWE-427
description: CWE-427
Affected products: vendor: n/a
product: Advantech WebAccess
Published: 2017-08-30T18:00:00.000Z
CVE-2017-12718 
A Classic Buffer Overflow issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. A third-party component used in the pump does not verify input buffer size prior to copying, leading to a buffer overflow, allowing remote code execution on the target device. The pump receives the potentially malicious input infrequently and under certain conditions, increasing the difficulty of exploitation.
Problem types: cwe_id: CWE-120
description: CWE-120
Affected products: vendor: n/a
product: Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump
Published: 2018-02-15T10:00:00.000Z
CVE-2017-12719 
An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A remote attacker is able to execute code to dereference a pointer within the program causing the application to become unavailable.
Problem types: cwe_id: CWE-822
description: CWE-822
Affected products: vendor: n/a
product: Advantech WebAccess
Published: 2017-11-06T22:00:00.000Z
CVE-2017-12720 
An Improper Access Control issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The FTP server on the pump does not require authentication if the pump is configured to allow FTP connections.
Problem types: description: Improper Access Control
Affected products: vendor: n/a
product: Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump
Published: 2018-02-15T10:00:00.000Z
CVE-2017-12721 
An Improper Certificate Validation issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. The pump does not validate host certificates, leaving the pump vulnerable to a man-in-the-middle (MITM) attack.
Problem types: description: Improper Certificate Validation
Affected products: vendor: n/a
product: Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump
Published: 2018-02-15T10:00:00.000Z