cvd@cert.pl
organization01
Rollen
Rollen dieser Identität.
02
Referenzen
Weitere Namen und Kennungen dieser Entität.
nvdUS cvd@cert.pl
03
bewertete Schwachstellen (534)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-58403US | — | — | ||
CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious URL… | ||||
| CVE-2025-30054US | — | — | ||
CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts… | ||||
| CVE-2025-30053US | —OT erhöht | — | ||
The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication.
The vulnerability was confirmed to affect versions up to… | ||||
| CVE-2025-30052US | — | — | ||
The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to… | ||||
| CVE-2025-30051US | — | — | ||
The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permission… | ||||
| CVE-2025-30050US | — | — | ||
CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data p… | ||||
| CVE-2025-30049US | — | — | ||
The CGM CLININET application stores user passwords as unsalted MD5 hashes.
This issue was fixed in versions 2026.MS1 and 2026.MS3 | ||||
| CVE-2025-30047US | — | — | ||
CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that excha… | ||||
| CVE-2025-30046US | — | — | ||
In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received… | ||||
| CVE-2025-30045US | — | — | ||
CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated fro… | ||||
| CVE-2025-30043US | —OT erhöht | — | ||
CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated… | ||||
| CVE-2026-16477US | — | — | ||
CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a m… | ||||
| CVE-2026-106030US | —OT erhöht | — | ||
NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user-mode application al… | ||||
| CVE-2026-88794US | — | — | ||
Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a `DOCTYPE` with an external… | ||||
| CVE-2026-63315US | — | — | ||
WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log… | ||||
| CVE-2026-63314US | — | — | ||
WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an authenticated attacke… | ||||
| CVE-2026-35088US | — | — | ||
Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has access to these files can decryp… | ||||
| CVE-2026-63316US | — | — | ||
A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers allows an authenticated… | ||||
| CVE-2026-103663US | — | Exploit | ||
Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacke… | ||||
| CVE-2026-75820US | — | — | ||
GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word leng… | ||||