See how ais compares to other vendors in security performance
Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection.
Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations.
The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials.
A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials.
ais-ltd strategyen v0.4.0 was discovered to contain a prototype pollution via the function mergeObjects. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous attacker to execute arbitrary code in the context of the user of the MSSQL database. The default user for the database is the 'sa' user.