Priority HIGH 82
During login to the web server in "Sante PACS Server.exe", OpenSSL function EVP_DecryptUpdate is called to decrypt the username and password.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01191 · Published 2025-03-13 · Fixed in 4.2.0 CWE-121
Priority HIGH 72
A denial-of-service vulnerability exists in the "GetWebLoginCredentials" function in "Sante PACS Server.exe".
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.06327 · Published 2025-03-13 · Fixed in 4.2.0 CWE-824
Priority HIGH 72
A Path Traversal Information Disclosure vulnerability exists in "Sante PACS Server.exe".
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.35383 · Published 2025-03-13 · Fixed in 4.2.0 CWE-22
Priority HIGH 69
The password of a web user in "Sante PACS Server.exe" is zero-padded to 0x2000 bytes, SHA1-hashed, base64-encoded, and stored in the USER table in the SQLite database HTTP.db.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00147 · Published 2025-03-13 · Fixed in 4.2.0 CWE-916
Priority MEDIUM 51
Sante PACS Server PG Patient Query SQL Injection Remote Code Execution Vulnerability.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00965 · Published 2024-05-22 · No fix listed CWE-89
Priority MEDIUM 47
This vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server 3.0.4.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02842 · Published 2022-08-03 · No fix listed CWE-89
Priority MEDIUM 45
The Sante PACS Server allows a remote attacker to crash the main thread by sending a crafted HL7 message, causing a denial-of-service condition.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00784 · Published 2025-08-18 · Fixed in 4.2.3 CWE-415
Priority MEDIUM 45
Sante PACS Server Token Endpoint SQL Injection Remote Code Execution Vulnerability.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01134 · Published 2024-04-01 · No fix listed CWE-89
Priority MEDIUM 41
The Sante PACS Server Web Portal sends credential information without encryption.
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00211 · Published 2025-08-18 · Fixed in 4.2.3 CWE-319
Priority MEDIUM 41
Sante PACS Server URL path Memory Corruption Denial-of-Service Vulnerability.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00915 · Published 2025-01-30 · No fix listed CWE-119
Priority MEDIUM 41
Sante PACS Server DCM File Parsing Memory Corruption Denial-of-Service Vulnerability.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01049 · Published 2025-01-30 · No fix listed CWE-119
Priority MEDIUM 41
Sante PACS Server DCM File Parsing Memory Corruption Denial-of-Service Vulnerability.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01049 · Published 2025-01-30 · No fix listed CWE-119
Priority MEDIUM 41
Sante DICOM Viewer Pro JP2 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.0068 · Published 2024-05-03 · No fix listed CWE-787
Priority MEDIUM 41
Sante DICOM Viewer Pro DCM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.0068 · Published 2024-05-03 · No fix listed CWE-787
Priority MEDIUM 41
Sante DICOM Viewer Pro DCM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.0068 · Published 2024-05-03 · No fix listed CWE-787
Priority MEDIUM 41
Sante DICOM Viewer Pro DCM File Parsing Use-After-Free Remote Code Execution Vulnerability.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00703 · Published 2024-05-03 · No fix listed CWE-416
Priority MEDIUM 41
Sante DICOM Viewer Pro J2K File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00669 · Published 2024-05-03 · No fix listed CWE-787
Priority MEDIUM 41
Sante DICOM Viewer Pro DCM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00669 · Published 2024-05-03 · No fix listed CWE-787
Priority MEDIUM 41
Sante DICOM Viewer Pro DCM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00669 · Published 2024-05-03 · No fix listed CWE-787
Priority MEDIUM 40
Sante PACS Server HTTP Content-Length Header Handling NULL Pointer Dereference Denial-of-Service Vulnerability.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.00764 · Published 2025-12-23 · No fix listed CWE-476
Priority LOW 39
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.7.0.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.02913 · Published 2022-02-18 · No fix listed CWE-787
Priority LOW 38
Santesoft Sante DICOM Viewer Pro contains a memory corruption vulnerability.
CVSS 4.0HIGH 8.4· Local · No auth · User interaction · EPSS 0.002 · Published 2025-05-29 · No fix listed CWE-125
Priority LOW 38
Santesoft Sante DICOM Viewer Pro is vulnerable to an out-of-bounds write, which requires a user to open a malicious DCM file, resulting in execution of arbitrary code by a local attacker.
CVSS 4.0HIGH 8.4· Local · No auth · User interaction · EPSS 0.0018 · Published 2025-03-20 · No fix listed CWE-787
Priority LOW 38
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 11.8.8.0.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.01848 · Published 2022-02-18 · No fix listed CWE-787
Priority LOW 38
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro 13.2.0.21165.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.0181 · Published 2022-02-18 · No fix listed CWE-119
Load more
THREATIST.IORead the docs