ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.0.0, <=3.4.0) +1617 more potentially affected by CVE-2023-20861 via org.springframework:spring-expression (4.3.10.release)

org.springframework:spring-expression MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 3.4.0 -...

Relative Path Traversal

Relative Path Traversal in ca.uhn.hapi.fhir:org.hl7.fhir.r5...

at.crea-doo.util.toughswitch:toughswitch (>=1.0.0, <=1.0.2), ca.uhn.hapi.fhir.karaf:hapi-fhir (>=3.3.0, <=3.7.0) +2759 more potentially affected by CVE-2022-45047 via org.apache.sshd:sshd-core (>=0.1.0, <=2.9.1)

org.apache.sshd:sshd-core MAVEN version =0.1.0, =1.0.0, =3.3.0, =2.0.0, =1.0.3, =1.0.0, =1.0.0, =0.5.4, =0.8.0, =0.0.1-9045f42e1634ad6f74edf826b9c7c61d1a495a38, =0.8.0, =0.11, =0.12 and more Source cves: CVE-2022-45047 Source advisory: MEND:CVE-2022-45047...

ca.uhn.hapi.fhir:hapi-fhir-android (>=2.1, <=2.5), ca.uhn.hapi.fhir:hapi-fhir-client-okhttp (>=2.0, <=2.5) +411 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (3.4.1)

com.squareup.okhttp3:okhttp MAVEN version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.okhttp3:okhttp and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-android =2.1, =2.0, =2.0.5, =2.2.0, =2.0.8, =0.0.1, =0.0.4, =0.0.4, =0.0.4,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.1.0, <=5.2.1), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (>=5.1.0, <=5.2.1) +650 more potentially affected by CVE-2020-7019 via org.elasticsearch:elasticsearch (>=6.0.0-alpha1, <=6.8.11)

org.elasticsearch:elasticsearch MAVEN version =6.0.0-alpha1, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =0.1.0, =4.0.0-beta-1, =1.2.0.release, =1.1.1.release, =1.4.2.release and more Source cves: CVE-2020-7019 Source advisory: OSV:GHSA-C77J-P484-H84M...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.1.0, <=5.2.1), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (>=5.1.0, <=5.2.1) +650 more potentially affected by CVE-2020-7019 via org.elasticsearch:elasticsearch (>=6.0.0-alpha1, <=6.8.11)

org.elasticsearch:elasticsearch MAVEN version =6.0.0-alpha1, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =0.1.0, =4.0.0-beta-1, =1.2.0.release, =1.1.1.release, =1.4.2.release and more Source cves: CVE-2020-7019 Source advisory: GHSA-C77J-P484-H84M...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +79 more potentially affected by CVE-2016-1000027 via org.springframework:spring-web (4.3.0.release)

org.springframework:spring-web MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 - ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.3.0, <=3.4.0) +131 more potentially affected by CVE-2016-1000027 via org.springframework:spring-web (5.0.3.release)

org.springframework:spring-web MAVEN version 5.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 3.4.0 - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =3.3.0...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.1.0, <=5.2.1), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (>=5.1.0, <=5.2.1) +548 more potentially affected by CVE-2019-7614 via org.elasticsearch:elasticsearch (>=6.0.0-alpha1, <=6.8.1)

org.elasticsearch:elasticsearch MAVEN version =6.0.0-alpha1, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =0.1.0, =4.0.0-beta-1, =1.2.0.release, =1.1.1.release, =1.4.2.release - cn.patterncat:spring-boot-starter-elasticsearch 0.0.1 - cn.xphsc:elasticsearch-rest-plus 1.0.2 and...

br.jus.stf.digital:core (>=2.0.0, <=2.3.1), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.4, <=2.5) +325 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.7.release)

org.springframework:spring-messaging MAVEN version 4.3.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - br.jus.stf.digital:core =2.0.0, =2.4, =1.1.0, =1.1.0, =1.0.1-release,...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=2.0, <=2.2) +364 more potentially affected by CVE-2022-22968 via org.springframework:spring-context (4.3.1.release)

org.springframework:spring-context MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =2.0, =2.0, =2.1.0-release,...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=2.0, <=2.2) +348 more potentially affected by CVE-2022-22950 via org.springframework:spring-expression (4.3.1.release)

org.springframework:spring-expression MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =2.0, =2.0, =2.1.0-release,...

Uncontrolled Resource Consumption in JPA Server in HAPI FHIR

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

GHSA-67F6-C8MX-4Q2M Uncontrolled Resource Consumption in JPA Server in HAPI FHIR

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

Uncontrolled Resource Consumption

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

CVE-2021-32053

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

CVE-2021-32053

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

CVE-2021-32053

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

Hardcoded credentials

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service e.g., disable access to the database after the attack stops via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are...

CVE-2021-32053

CVE-2021-32053 affects HAPI FHIR’s JPA Server prior to 5.4.0. The issue allows denial of service through history requests: a SELECT COUNT triggers a full index scan, consuming server resources and potentially disabling access to the database when many concurrent history operations occur. Connecte...