CVE-2022-37461

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary web script or HTML via (1) the input after the error subdirectory to the /vitrea-view/error/ subdirectory, or the (2) groupID, (3) offset, or (4) limit parameter to an Administrative Panel (Group and Users) page. There is a risk of an attacker retrieving patient information.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=30693Exploit, Third Party Advisory
https://www.vitalimages.com/customer-success-support-program/vital-images-software-security-updates/Vendor Advisory
https://www.vitalimages.com/vitrea-vision/vitrea-view/Product, Vendor Advisory
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=30693Exploit, Third Party Advisory
https://www.vitalimages.com/customer-success-support-program/vital-images-software-security-updates/Vendor Advisory
https://www.vitalimages.com/vitrea-vision/vitrea-view/Product, Vendor Advisory

Timeline

Published: Sep 30, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-374625.4A stored Cross-Site Scripting (XSS) vulnerability in the Chat gadget in Upstream Works Agent Desktop for Cisco Finesse through 4.2.12 and 5.CVE-2022-37476.5The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to miss CVE-2022-37489.8Improper Authorization vulnerability in ForgeRock Inc. Access Management allows Authentication Bypass. This issue affects Access Management:CVE-2022-37504.7The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation.CVE-2022-37519.8SQL Injection in GitHub repository owncast/owncast prior to 0.0.13.CVE-2022-37527.5An unauthorized user could use a specially crafted sequence of Ethernet/IP messages, combined with heavy traffic loading to cause a denial-CVE-2022-37534.8The Evaluate WordPress plugin through 1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as CVE-2022-37549.8Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.CVE-2022-37585.4An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.CVE-2022-37597.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before CVE-2022-375989.8Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor CVE-2022-375997.5A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.