In Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by authenticated users to access files stored outside of the web root.
oryginał ENCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NPhilips Myvue
APPPhilipswszystkie wersjePhilips Speech
APPPhilipswszystkie wersjePhilips Vue Motion
APPPhilips≤ 12.2.1.5Philips Vue Pacs
APPPhilipswszystkie wersje
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Path Traversal
Powiązane podatności
CVE-2021-33020HIGH8.2ten sam produkt
Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, wh...
CVE-2021-33022HIGH7.5ten sam produkt
Philips Vue PACS versions 12.2.x.x and prior transmits sensitive or security-critical data in cleartext in a c...
CVE-2021-27501HIGH7.5ten sam produkt
Philips Vue PACS versions 12.2.x.x and prior does not follow certain coding rules for development, which can l...
CVE-2021-33018HIGH7.5ten sam produkt
The use of a broken or risky cryptographic algorithm in Philips Vue PACS versions 12.2.x.x and prior is an unn...
CVE-2023-40704MEDIUM5.7ten sam produkt
The product does not require unique and complex passwords to be created during installation. Using Philips's ...