Skip to content
OpenAdvisories
Critical 1 exploited CVE ICSMA-21-187-01 16 CVEs

Philips Vue PACS (Update B)

Published Jul 6, 2021 · Updated Apr 5, 2022 · Revision 3

Vendor: Philips Product: Vue Motion Product: Vue MyVue Product: Vue PACS Product: Vue Speech

Summary

Successful exploitation of these vulnerabilities could allow an unauthorized person or process to eavesdrop, view or modify data, gain system access, perform code execution, install unauthorized software, or affect system data integrity in such a way as to negatively impact the confidentiality, integrity, or availability of the system.

Vulnerabilities 16

  • Critical 9.8
    CVE-2020-1938 Exploited Public exploit Scanner template EPSS 99%

    Improper Privilege Management in Tomcat

    When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an atta…

    Apache Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
    KEV Mar 3, 2022
  • Critical 9.8
    CVE-2018-8014 EPSS 21%

    The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins

    The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 8.2
    CVE-2021-33020

    Philips Vue PACS Use of a Key Past its Expiration Date

    Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.

    Philips Vue PACS Vue Speech Vue MyVue
  • High 7.5
    CVE-2021-27501

    Philips Vue PACS Improper Adherence to Coding Standards

    Philips Vue PACS versions 12.2.x.x and prior does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

    Philips Vue PACS Vue Speech Vue MyVue
  • High 7.5
    CVE-2021-33018

    Philips Vue PACS Use of a Broken or Risky Cryptographic Algorithm

    The use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and prior is an unnecessary risk that may result in the exposure of sensitive information.

    Philips Vue PACS Vue Motion Vue Speech
  • High 7.5
    CVE-2021-33022

    Philips Vue PACS Cleartext Transmission of Sensitive Information

    Philips Vue PACS versions 12.2.x.x and prior transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

    Philips Vue PACS Vue MyVue Vue Motion
  • High 7.4
    CVE-2020-4670

    IBM Planning Analytics Local 2.0 connects to a Redis server. The Redis server, an in-memory data structure store, runni…

    IBM Planning Analytics Local
  • Medium 6.5
    CVE-2021-27497

    Philips Vue PACS Protection Mechanism Failure

    Philips Vue PACS versions 12.2.x.x and prior does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

    Philips Vue PACS Vue MyVue Vue Motion
  • Medium 6.1
    CVE-2015-9251 Public exploit EPSS 30%

    Cross-Site Scripting (XSS) in jquery

    jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

    ruby ceph jquery-rails org.webjars.npm:jquery Ubuntu Azure Linux Alpine npm Maven NuGet RubyGems
  • Medium 6.1
    CVE-2021-27493

    Philips Vue PACS

    Philips Vue PACS versions 12.2.x.x and prior does not ensure or incorrectly ensures structured messages or data are well formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

    Philips Vue PACS Vue MyVue Vue Motion
  • Medium 5.3
    CVE-2019-9636

    Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorr…

    python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Alpine
  • Low 3.7
    CVE-2021-33024

    Philips Vue PACS Insufficiently Protected Credentials

    Philips Vue PACS versions 12.2.x.x and prior transmits or stores authentication credentials, but it uses an insecure method susceptible to unauthorized interception and/or retrieval.

    Philips Vue PACS Vue Speech Vue MyVue
  • Unscored —
    CVE-2012-1708

    Unspecified vulnerability in the Application Express component in Oracle Database Server 4.0 and 4.1 allows remote atta…

  • Unscored —
    CVE-2018-10115

    Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memo…

    p7zip p7zip-rar p7zip-rar Debian Ubuntu Alpine
  • Unscored —
    CVE-2018-11218 Public exploit EPSS 59%

    Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10…

    redis redis redis Debian Ubuntu Alpine
  • Unscored —
    CVE-2018-12326 Public exploit

    Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution…

    redis redis Debian Ubuntu

Revision history

  1. #3

    ICSMA-21-187-01 Philips Vue PACS (Update B)

  2. #2

    ICSMA-21-187-01 Philips Vue PACS (Update A)

  3. #1

    ICSMA-21-187-01 Philips Vue PACS

References