Cross-site Scripting (XSS)

hapi-fhir-testpage-overlay is vulnerable to cross-site scripting XSS. The vulnerability exists due to the lack of sanitization of the PARAMRESOURCE value when processing requests in several controllers...

CVE-2020-24301

Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's browser. The impact of this vulnerability is believed to be low, as this module is intended for testin...

CVE-2020-24301

Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's browser. The impact of this vulnerability is believed to be low, as this module is intended for testin...

Design/Logic Flaw

Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's browser. The impact of this vulnerability is believed to be low, as this module is intended for testin...

CVE-2020-24301

The CVE-2020-24301 entry concerns the HAPI FHIR Testpage Overlay (v5.0.0 and below) with a cross-site scripting (XSS) vulnerability. Multiple connected sources (e.g., Veracode, Red Hat, NVD, OSV, and GitLab repo artifact) identify that the issue arises from lack of sanitization of the PARAM_RESOU...

CVE-2020-24301

Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's browser. The impact of this vulnerability is believed to be low, as this module is intended for testin...

Cross-site Scripting

Users of the HAPI FHIR Testpage Overlay can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's browser. The impact of this vulnerability is believed to be low, as this module is intended for testing and not believ...

am.ik.github:reactive-github-client (>=0.0.1 <=0.0.4), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.1.0 <=3.2.0) +218 more potentially affected by CVE-2018-15756 via org.springframework:spring-core (=5.0.0.RELEASE)

org.springframework:spring-core MAVEN version =5.0.0.RELEASE is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - am.ik.github:reactive-github-client =0.0.1, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0,...

XML External Entity (XXE)

jamesagnew/hapi-fhir is vulnerable to XML External Entity XXE attacks. This attack occurs because the function FhirInstanceValidator accepts and processes XML input containing a reference to an external entity, allowing a remote attacker to access local or remote files and service conditions...

Information Disclosure

hapi-fhir-server is vulnerable to information disclosure. When using the Consent Service and denying a resource via the Will See Resource method, the resource ID and version were still returned to the user...

ca.uhn.hapi.example:restful-server-example (=0.7), ca.uhn.hapi.fhir.karaf:hapi-fhir (>=3.3.0 <=3.7.0) +228 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (>=0.1 <=3.7.0)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version =0.1, =3.3.0, =1.3, =3.4.0, =3.0.0, =2.0, =2.3, =3.6.0, =1.4, =0.9, =3.5.0, =3.3.0, =3.7.0 and more Source cves: CVE-2019-12741 Source advisory: OSV:GHSA-52MH-P2M2-W625...

Cross-site Scripting in HAPI FHIR

XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafte...

GHSA-52MH-P2M2-W625 Cross-site Scripting in HAPI FHIR

XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafte...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafte...

Cross-site Scripting (XSS)

HAPI FHIR TestPage Overlay is vulnerable to cross-site scripting XSS. The parameters passed through the HTTP request to be displayed in a form page are not sanitized, allowing an attacker to inject a malicious script...

CVE-2019-12741

XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafte...

CVE-2019-12741

XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafte...

Cross site scripting

XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafte...

CVE-2019-12741

The CVE-2019-12741 issue is an XSS in the HAPI FHIR testpage overlay module of the HAPI FHIR library (pre-3.8.0). Unsanitized HTTP parameters are echoed in a form page, enabling leakage of cookies and other sensitive data from ca/uhn/fhir/to/BaseController.java via a crafted URL. Impact is limite...

CVE-2019-12741

XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafte...