Venere vulnerabilities
5 known vulnerabilities in Venere from CompuGroup Medical. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
Infantia: Improper Restriction of XML External Entity Reference
XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks.
- 9.2 Critical severity
Infantia: Download of Code Without Integrity Check
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
- 8.0 High severity
Infantia: Missing Authentication for Critical Functionality
The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.
- 8.0 High severity
Infantia: Use of Hard-coded Cryptographic Key
Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests.
- 8.1 High severity
Phronesis: Use of Hard-coded Credentials
The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts.