Design/Logic Flaw

An issue was discovered in Echo ShareCare 8.15.5. The UnzipFile feature in Access/EligFeedParseSup/UnzipFileUpd.cfm is susceptible to a command argument injection vulnerability when processing remote input in the zippass parameter from an authenticated user, leading to the ability to inject...

Sql injection

An issue was discovered in Echo ShareCare 8.15.5. It does not perform authentication or authorization checks when accessing a subset of sensitive resources, leading to the ability for unauthenticated users to access pages that are vulnerable to attacks such as SQL injection...

CVE-2021-36122

An issue was discovered in Echo ShareCare 8.15.5. The UnzipFile feature in Access/EligFeedParseSup/UnzipFileUpd.cfm is susceptible to a command argument injection vulnerability when processing remote input in the zippass parameter from an authenticated user, leading to the ability to inject...

CVE-2021-36122

Echo ShareCare 8.15.5 contains a command argument injection in the UnzipFile feature (Access/EligFeedParse_Sup/UnzipFile_Upd.cfm) where remote input in the zippass parameter from an authenticated user can inject arbitrary arguments to 7z.exe. This is the concrete vulnerability described across CV...

CVE-2021-36121

Echo ShareCare 8.15.5 contains an unrestricted file upload vulnerability in Access/DownloadFeed_Mnt/FileUpload_Upd.cfm, exploitable via the name1 parameter. Processing remote input from an authenticated user allows writing arbitrary files to arbitrary filesystem locations through ../ Directory Tr...

CVE-2021-36121

An issue was discovered in Echo ShareCare 8.15.5. The file-upload feature in Access/DownloadFeedMnt/FileUploadUpd.cfm is susceptible to an unrestricted upload vulnerability via the name1 parameter, when processing remote input from an authenticated user, leading to the ability for arbitrary files...

CVE-2021-36124

CVE-2021-36124 affects Echo ShareCare 8.15.5. The root cause is missing authentication/authorization checks when accessing a subset of sensitive resources, allowing unauthenticated users to reach pages that are vulnerable to attacks such as SQL injection. The impact, as described, is that access ...

CVE-2021-36124

An issue was discovered in Echo ShareCare 8.15.5. It does not perform authentication or authorization checks when accessing a subset of sensitive resources, leading to the ability for unauthenticated users to access pages that are vulnerable to attacks such as SQL injection...

CVE-2021-36123

An issue was discovered in Echo ShareCare 8.15.5. The TextReader feature in General/TextReader/TextReader.cfm is susceptible to a local file inclusion vulnerability when processing remote input in the textFile parameter from an authenticated user, leading to the ability to read arbitrary files on...

CVE-2021-36123

The CVE concerns Echo ShareCare 8.15.5. The TextReader feature in General/TextReader/TextReader.cfm is vulnerable to local file inclusion when processing remote input in the textFile parameter from an authenticated user. This allows reading arbitrary files on the server filesystem and any files a...

CVE-2021-33578

Echo ShareCare 8.15.5 is susceptible to SQL injection vulnerabilities when processing remote input from both authenticated and unauthenticated users, leading to the ability to bypass authentication, exfiltrate Structured Query Language SQL records, and manipulate data...

CVE-2021-33578

Echo ShareCare 8.15.5 is affected by CVE-2021-33578 due to an SQL injection vulnerability in processing remote input from both authenticated and unauthenticated users. The vulnerability can allow bypassing authentication, exfiltrating SQL records, and manipulating data. References corroborate the...

CVE-2021-36121: Unrestricted Upload of File with Dangerous Type

An issue was discovered in Echo ShareCare 8.15.5. The file-upload feature in Access/DownloadFeedMnt/FileUploadUpd.cfm is susceptible to an unrestricted upload vulnerability via the name1 parameter, when processing remote input from an authenticated user, leading to the ability for arbitrary files...

CVE-2021-33578: Improper Neutralization of Special Elements used in an SQL Command

Echo ShareCare 8.15.5 is susceptible to SQL injection vulnerabilities when processing remote input from both authenticated and unauthenticated users, leading to the ability to bypass authentication, exfiltrate Structured Query Language SQL records, and manipulate data...

CVE-2021-36123: Undefined Security Weakness

An issue was discovered in Echo ShareCare 8.15.5. The TextReader feature in General/TextReader/TextReader.cfm is susceptible to a local file inclusion vulnerability when processing remote input in the textFile parameter from an authenticated user, leading to the ability to read arbitrary files on...

CVE-2021-36122: Improper Neutralization of Argument Delimiters in a Command

An issue was discovered in Echo ShareCare 8.15.5. The UnzipFile feature in Access/EligFeedParseSup/UnzipFileUpd.cfm is susceptible to a command argument injection vulnerability when processing remote input in the zippass parameter from an authenticated user, leading to the ability to inject...

ShareCare SQL注入漏洞

ShareCare is a clinical and financial software system of Echo Group. Echo ShareCare suffers from an SQL injection vulnerability that stems from ShareCare's susceptibility to SQL injection vulnerabilities when processing remote input from arbitrary users...

Echo ShareCare 安全漏洞

ShareCare is a clinical and financial software system from Echo Group. A security vulnerability exists in Echo ShareCare version 8.15.5 that stems from the TextReader function in General/TextReader/TextReader.cfm being susceptible to a local file inclusion vulnerability when processing remote inp...

CVE-2021-36124: Missing Authentication for Critical Function

An issue was discovered in Echo ShareCare 8.15.5. It does not perform authentication or authorization checks when accessing a subset of sensitive resources, leading to the ability for unauthenticated users to access pages that are vulnerable to attacks such as SQL injection...

Echo ShareCare 代码问题漏洞

ShareCare is a clinical and financial software system from Echo Group. A security vulnerability exists in Echo ShareCare version 8.15.5, which stems from the file upload functionality in "Access/DownloadFeedMnt/FileUploadUpd.cfm" that is susceptible to an unrestricted upload vulnerability via the...