Bd
33 CVEs across 108 Bd products. Browse Bd vulnerabilities, severities, and proof-of-concept exploits.
Bd products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-29066 | Low | 3.2 | 2023-11-28 | The FACSChorus software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account can modify informat… |
CVE-2023-29065 | Medium | 4.1 | 2023-11-28 | The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical access could potent… |
CVE-2023-29064 | Medium | 4.1 | 2023-11-28 | The FACSChorus software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets used by the application, which include… |
CVE-2023-29063 | Low | 2.4 | 2023-11-28 | The FACSChorus workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PCI card designed for… |
CVE-2023-29062 | Low | 3.8 | 2023-11-28 | The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately vali… |
CVE-2023-29061 | Medium | 5.2 | 2023-11-28 | There is no BIOS password on the FACSChorus workstation. A threat actor with physical access to the workstation can potentially exploit this vulnerability to a… |
CVE-2023-29060 | Medium | 5.4 | 2023-11-28 | The FACSChorus workstation operating system does not restrict what devices can interact with its USB ports. If exploited, a threat actor with physical access t… |
CVE-2023-30565 | Low | 3.5 | 2023-07-13 | An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker. |
CVE-2023-30564 | Medium | 6.9 | 2023-07-13 | Alaris Systems Manager does not perform input validation during the Device Import Function. |
CVE-2023-30563 | High | 8.2 | 2023-07-13 | A malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session. |
CVE-2023-30562 | Medium | 6.7 | 2023-07-13 | A GRE dataset file within Systems Manager can be tampered with and distributed to PCUs. |
CVE-2023-30561 | Medium | 6.1 | 2023-07-13 | The data flowing between the PCU and its modules is insecure. A threat actor with physical access could potentially read or modify data by attaching a speciall… |
CVE-2023-30560 | Medium | 6.8 | 2023-07-13 | The configuration from the PCU can be modified without authentication using physical connection to the PCU. |
CVE-2023-30559 | Medium | 5.2 | 2023-07-13 | The firmware update package for the wireless card is not properly signed and can be modified. |
CVE-2022-47376 | High | 7.3 | 2023-06-13 | The Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password after the installation. No patient health data is stored in the… |
CVE-2022-43557 | Medium | 5.3 | 2022-12-05 | The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. If exploited, threat actors with physical access, speci… |
CVE-2022-40263 | Medium | 6.6 | 2022-11-04 | BD Totalys MultiProcessor, versions 1.70 and earlier, contain hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensit… |
CVE-2022-30277 | Medium | 5.7 | 2022-06-02 | BD Synapsys™, versions 4.20, 4.20 SR1, and 4.30, contain an insufficient session expiration vulnerability. If exploited, threat actors may be able to access, m… |
CVE-2022-22767 | High | 8.8 | 2022-06-02 | Specific BD Pyxis™ products were installed with default credentials and may presently still operate with these credentials. There may be scenarios where BD Pyx… |
CVE-2022-22765 | High | 8.0 | 2022-02-12 | BD Viper LT system, versions 2.0 and later, contains hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensitive infor… |
CVE-2022-22766 | High | 7.0 | 2022-02-11 | Hardcoded credentials are used in specific BD Pyxis products. If exploited, threat actors may be able to gain access to the underlying file system and could po… |
CVE-2020-25165 | High | 7.5 | 2020-11-13 | BD Alaris PC Unit, Model 8015, Versions 9.33.1 and earlier and BD Alaris Systems Manager, Versions 4.33 and earlier The affected products are vulnerable to a n… |
CVE-2020-10598 | Medium | 6.1 | 2020-04-01 | In BD Pyxis MedStation ES System v1.6.1 and Pyxis Anesthesia (PAS) ES System v1.6.1, a restricted desktop environment escape vulnerability exists in the kiosk… |
CVE-2019-13517 | High | 8.8 | 2019-09-06 | In Pyxis ES Versions 1.3.4 through to 1.6.1 and Pyxis Enterprise Server, with Windows Server Versions 4.4 through 4.12, a vulnerability has been identified whe… |
CVE-2019-10962 | Medium | 5.3 | 2019-06-13 | BD Alaris Gateway versions, 1.0.13,1.1.3 Build 10,1.1.3 MR Build 11,1.1.5, and 1.1.6, The web browser user interface on the Alaris Gateway Workstation does not… |
CVE-2019-10959 | Critical | 10.0 | 2019-06-13 | BD Alaris Gateway Workstation Versions, 1.1.3 Build 10, 1.1.3 MR Build 11, 1.2 Build 15, 1.3.0 Build 14, 1.3.1 Build 13, This does not impact the latest firmwa… |
CVE-2019-6517 | Medium | 6.8 | 2019-02-06 | BD FACSLyric Research Use Only, Windows 10 Professional Operating System, U.S. and Malaysian Releases, between November 2017 and November 2018 and BD FACSLyric… |
CVE-2018-14786 | Critical | 9.4 | 2018-08-23 | Becton, Dickinson and Company (BD) Alaris Plus medical syringe pumps (models Alaris GS, Alaris GH, Alaris CC, and Alaris TIVA) versions 2.3.6 and prior are aff… |
CVE-2018-10595 | Medium | 6.3 | 2018-05-24 | A vulnerability in ReadA version 1.1.0.2 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestr… |
CVE-2018-10593 | Medium | 5.6 | 2018-05-24 | A vulnerability in DB Manager version 3.0.1.0 and previous and PerformA version 3.0.0.0 and previous allows an authorized user with access to a privileged acco… |
CVE-2017-6022 | Critical | 9.8 | 2017-06-30 | A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA Journal Service, Versio… |
CVE-2016-9355 | Medium | 5.3 | 2017-02-13 | An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Version 9.7. An unauthor… |
CVE-2016-8375 | Medium | 4.9 | 2017-02-13 | An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Version 9.7, and 8000 PC… |