CVE Vulnerability Catalog

CVE-2015-1818 describes an XXE vulnerability in the dashbuilder import facility in Red Hat JBoss BPM Suite before version 6.1.2. It allows remote attackers to read arbitrary files and conduct SSRF attacks via a crafted XML document.

The pipe_read and pipe_write implementations in the Linux kernel before version 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls. This can lead to system crashes or potential privilege escalation by local users via a crafted application.

Sierra Wireless ALEOS before 4.4.2 on AirLink ES, GX, and LS devices has hardcoded root accounts, which makes it easier for remote attackers to obtain administrative access via a SSH or TELNET session.

The autoupdate implementation in TimeDoctor Pro 1.4.72.3 on Windows relies on unsigned installer files that are retrieved without use of SSL, making it easier for man-in-the-middle attackers to execute arbitrary code via a crafted file.

The GE Healthcare Centricity Clinical Archive Audit Trail Repository has default passwords that may be exploited for unauthorized access. These passwords pertain to the SSL key manager, server keystore, truststore, and databases storing data.

The GE Healthcare Precision THUNIS-800+ device has default passwords that can be used to access various system functions. These passwords include '1973' for the System Utilities menu and 'TH8740' for installation, which may pose a risk of unauthorized access.

GE Healthcare Discovery XR656 and XR656 G2 have weak passwords for the insite, xruser, and root users, which may lead to unauthorized access.

GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1 have passwords for the Administrator user (CANal1) and the IIS user (iis), which may lead to unspecified threats related to TimbuktuPro.

The Ad Hoc Reporting feature in GE Healthcare Centricity DMS 4.2 has a password of 'Never!Mind' for the Administrator user, which may lead to unspecified impacts and attack vectors.

GE Healthcare Discovery NM 750b has a password '2getin' for the insite account used in Telnet and FTP. It is unclear whether this password is default, hardcoded, or dependent on another system or product requiring a fixed value.

GE Healthcare Centricity PACS Workstation versions 4.0 and 4.0.1 has a password of 'ddpadmin' for the ddpadmin user, which may lead to unspecified impacts and attack vectors.

GE Healthcare Centricity PACS Workstation 4.0 and 4.0.1, and Server 4.0 have a password '2charGE' for the geservice account, which may lead to unspecified impacts and attack vectors related to TimbuktuPro.

GE Healthcare Centricity PACS 4.0 Server has default passwords for the nasro (ReadOnly) and nasrw (Read/Write) users, which poses potential security risks.

GE Healthcare Precision MPi has weak passwords for users, including 'orion' for the serviceapp and clinical operator users, and 'PlatinumOne' for the administrator user. It is unclear whether these are default, hardcoded, or dependent on another system.

The TeraRecon server, used in GE Healthcare Centricity PACS-IW versions 3.7.3.7, 3.7.3.8, and possibly others, has passwords (1) 'shared' for the shared user and (2) 'scan' for the scan user. It is unclear whether these passwords are default, hardcoded, or dependent on another system or product requiring a fixed value.

GE Healthcare Centricity PACS-IW versions 3.7.3.7, 3.7.3.8, and possibly others have a password of A11enda1e for the sa SQL server user, which may lead to unspecified impacts and attack vectors.

GE Healthcare Centricity Analytics Server version 1.1 has default passwords for various users, which may lead to unauthorized access. These passwords include 'V0yag3r' for the sa user and 'G3car3s' for the analyst user.

The Acquisition Workstation for GE Healthcare Revolution XQ/i has a password of 'adw3.1' for the sdc user, which may lead to unspecified impact and attack vectors.

GE Healthcare CADStream Server has a default password 'confirma' for the admin user, which may lead to unauthorized access.