CVE-2021-40375

Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite OpenEyes returning a Forbidden error message, the contents of a patient's profile are still returned in the server response. This respons...

CVE-2021-40375

Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite OpenEyes returning a Forbidden error message, the contents of a patient's profile are still returned in the server response. This respons...

CVE-2021-40375: Exposure of Sensitive Information to an Unauthorized Actor

Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite OpenEyes returning a Forbidden error message, the contents of a patient's profile are still returned in the server response. This respons...

CVE-2021-40374: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patient's details allows remote attackers to inject arbitrary web script or HTML via the Address1 parameter. This JavaScript then executes when the patient profile is loaded, which coul...

PT-2022-11222

Name of the Vulnerable Software and Affected Versions Apperta Foundation OpenEyes version 3.5.1 Description A stored cross-site scripting issue was identified, allowing remote attackers to inject arbitrary web script or HTML via the Address1 parameter when updating a patient's details. This...

PT-2022-11223

Name of the Vulnerable Software and Affected Versions Apperta Foundation OpenEyes version 3.5.1 Description The issue allows remote attackers to view sensitive patient information without the intended level of privilege. Although OpenEyes returns a Forbidden error message, it still includes the...