XML External Entity (XXE)

jamesagnew/hapi-fhir is vulnerable to XML External Entity XXE attacks. This attack occurs because the function FhirInstanceValidator accepts and processes XML input containing a reference to an external entity, allowing a remote attacker to access local or remote files and service conditions...

Information Disclosure

hapi-fhir-server is vulnerable to information disclosure. When using the Consent Service and denying a resource via the Will See Resource method, the resource ID and version were still returned to the user...

Cross-site Scripting in HAPI FHIR

XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafte...

GHSA-52MH-P2M2-W625 Cross-site Scripting in HAPI FHIR

XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafte...

ca.uhn.hapi.fhir:hapi-tinder-plugin (0.1) potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (0.1)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-tinder-plugin 0.1 Source cves: CVE-2019-12741 Source advisory:...

ca.uhn.hapi.fhir:hapi-tinder-plugin (0.2) potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (0.2)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 0.2 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-tinder-plugin 0.2 Source cves: CVE-2019-12741 Source advisory:...

ca.uhn.hapi.fhir:hapi-tinder-plugin (0.3) potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (0.3)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 0.3 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-tinder-plugin 0.3 Source cves: CVE-2019-12741 Source advisory:...

ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (0.4), ca.uhn.hapi.fhir:hapi-tinder-plugin (0.4) potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (0.4)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 0.4 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay 0.4 - ca.uhn.hapi.fhir:hapi-tinder-plugin 0.4 Source...

ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (0.5), ca.uhn.hapi.fhir:hapi-tinder-plugin (0.5) potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (0.5)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 0.5 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay 0.5 - ca.uhn.hapi.fhir:hapi-tinder-plugin 0.5 Source...

ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (0.6), ca.uhn.hapi.fhir:hapi-tinder-plugin (0.6) +50 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (0.6)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 0.6 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay 0.6 - ca.uhn.hapi.fhir:hapi-tinder-plugin 0.6 -...

ca.uhn.hapi.example:restful-server-example (0.7), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (0.7) +1 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (0.7)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 0.7 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.example:restful-server-example 0.7 - ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay 0.7 -...

ca.uhn.hapi.fhir:hapi-fhir-structures-dev (0.8), ca.uhn.hapi.fhir:hapi-fhir-structures-dstu (0.8) +2 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (0.8)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 0.8 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-structures-dev 0.8 - ca.uhn.hapi.fhir:hapi-fhir-structures-dstu 0.8 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.0), ca.uhn.hapi.fhir:hapi-fhir-structures-dstu (1.0) +3 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (1.0)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.0 - ca.uhn.hapi.fhir:hapi-fhir-structures-dstu 1.0 -...

org.carewebframework:org.carewebframework.cal.api.core (4.0.0), org.carewebframework:org.carewebframework.cal.api.documents (4.0.0) +34 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (1.1)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 1.1 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - org.carewebframework:org.carewebframework.cal.api.core 4.0.0 -...

org.carewebframework:org.carewebframework.fhir.client (1.2), org.carewebframework:org.carewebframework.fhir.core (1.2) +2 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (1.2)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 1.2 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - org.carewebframework:org.carewebframework.fhir.client 1.2 -...

ca.uhn.hapi.fhir:hapi-fhir-android (1.3), org.carewebframework:org.carewebframework.fhir.client (1.3) +7 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (1.3)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 1.3 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-android 1.3 - org.carewebframework:org.carewebframework.fhir.client 1.3 ...

ca.uhn.hapi.fhir:hapi-fhir-android (1.4), ca.uhn.hapi.fhir:hapi-fhir-jaxrsserver-base (1.4) +27 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (1.4)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-android 1.4 - ca.uhn.hapi.fhir:hapi-fhir-jaxrsserver-base 1.4 -...

ca.uhn.hapi.fhir:hapi-fhir-android (1.5), ca.uhn.hapi.fhir:hapi-fhir-jaxrsserver-base (1.5) +14 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (1.5)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 1.5 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-android 1.5 - ca.uhn.hapi.fhir:hapi-fhir-jaxrsserver-base 1.5 -...

ca.uhn.hapi.fhir:hapi-fhir-android (1.6), ca.uhn.hapi.fhir:hapi-fhir-jaxrsserver-base (1.6) +10 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (1.6)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 1.6 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-android 1.6 - ca.uhn.hapi.fhir:hapi-fhir-jaxrsserver-base 1.6 -...

ca.uhn.hapi.fhir:hapi-fhir-android (2.0), ca.uhn.hapi.fhir:hapi-fhir-client-okhttp (2.0) +25 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (2.0)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-android 2.0 - ca.uhn.hapi.fhir:hapi-fhir-client-okhttp 2.0 -...