CVE-2018-14786

CRITICAL Year: 2018
CVSS v3 Score
9.4
Critical
CVSS v2 Score
7.5
High
Weakness Type
CWE-287
View all →

Vulnerability Description

Becton, Dickinson and Company (BD) Alaris Plus medical syringe pumps (models Alaris GS, Alaris GH, Alaris CC, and Alaris TIVA) versions 2.3.6 and prior are affected by an improper authentication vulnerability where the software does not perform authentication for functionality that requires a provable user identity, where it may allow a remote attacker to gain unauthorized access to various Alaris Syringe pumps and impact the intended operation of the pump when it is connected to a terminal server via the serial port.

Related Vulnerabilities

CVE-2017-14000

CRITICAL
CVSS:9.4(Critical)

An Improper Authentication issue was discovered in Ctek SkyRouter Series 4200 and 4400, all versions prior to V6.00.11. By accessing a specific uniform resource locator (URL) on the web server, a mali...

CWE-2872017

CVE-2017-9630

CRITICAL
CVSS:9.4(Critical)

An Improper Authentication issue was discovered in PDQ Manufacturing LaserWash G5 and G5 S Series all versions, LaserWash M5, all versions, LaserWash 360 and 360 Plus, all versions, LaserWash AutoXpre...

CWE-2872017

CVE-2023-1935

CRITICAL
CVSS:9.4(Critical)

ROC800-Series RTU devices are vulnerable to an authentication bypass, which could allow an attacker to gain unauthorized access to data or control of the device and cause a denial-of-service condition...

CWE-2872023

CVE-2023-22501

CRITICAL
CVSS:9.4(Critical)

An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain access to a Jira Service Management insta...

CWE-2872023

CVE-2023-6353

CRITICAL
CVSS:9.4(Critical)

Tyler Technologies Civil and Criminal Electronic Filing allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the Upload.aspx 'enky' parameter.

CWE-2872023

CVE-2023-6354

CRITICAL
CVSS:9.4(Critical)

Tyler Technologies Magistrate Court Case Management Plus allows an unauthenticated, remote attacker to upload, delete, and view files by manipulating the PDFViewer.aspx 'filename' parameter.

CWE-2872023