ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.100), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.100) +6 more potentially affected by CVE-2024-45294 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (5.6.100)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version 5.6.100 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.utilities and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.100 -...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.98), ca.uhn.hapi.fhir:org.hl7.fhir.dstu2 (5.6.98) +9 more potentially affected by CVE-2024-45294 +1 more via ca.uhn.hapi.fhir:org.hl7.fhir.utilities (5.6.98)

ca.uhn.hapi.fhir:org.hl7.fhir.utilities MAVEN version 5.6.98 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.utilities and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.98 -...

ca.uhn.hapi.fhir:hapi-fhir-base-test-jaxrsserver-kotlin (>=5.6.5, <=6.8.0), ca.uhn.hapi.fhir:hapi-fhir-base-test-mindeps-client (>=5.6.5, <=7.4.3) +249 more potentially affected by CVE-2024-45294 via ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 (>=0.0.1, <=6.3.22)

ca.uhn.hapi.fhir:org.hl7.fhir.dstu3 MAVEN version =0.0.1, =5.6.5, =5.6.5, =5.6.5, =4.0.0, =5.6.5, =4.1.0, =4.0.3, =4.1.0, =4.0.0, =4.0.0, =5.0.0, =4.0.0, =5.3.0, =6.2.0, =5.1.0, =5.2.1 and more Source cves: CVE-2024-45294 Source advisory: MEND:CVE-2024-45294...

PT-2024-35091

Name of the Vulnerable Software and Affected Versions HAPI FHIR versions prior to 6.4.0 Description The XSLT parsing performed by various components in HAPI FHIR is vulnerable to XML external entity injections. This issue can be exploited by submitting a malicious XML file with a DTD tag,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (3.4.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=3.0.0, <=3.4.0) +1617 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (4.3.10.release)

org.springframework:spring-expression MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api 3.4.0 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=2.0, <=2.2) +348 more potentially affected by CVE-2024-38808 via org.springframework:spring-expression (4.3.1.release)

org.springframework:spring-expression MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =2.0, =2.0, =2.1.0-release,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.1.0, <=5.2.1), ca.uhn.hapi.fhir:hapi-fhir-cli-jpaserver (>=5.1.0, <=5.2.1) +59 more potentially affected by CVE-2024-23444 via org.elasticsearch:elasticsearch (6.5.4)

org.elasticsearch:elasticsearch MAVEN version 6.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.2.0, <=6.2.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.2.0, <=6.2.5) +20 more potentially affected by CVE-2024-40094 via com.graphql-java:graphql-java (17.4)

com.graphql-java:graphql-java MAVEN version 17.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.0.0, <=6.1.3), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.0.3, <=6.1.3) +216 more potentially affected by CVE-2024-40094 via com.graphql-java:graphql-java (17.3)

com.graphql-java:graphql-java MAVEN version 17.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-cli-api =6.0.0, =6.0.3, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0,...

br.com.m4rc310:br-com-m4rc310-cups (1.0.16), br.com.m4rc310:br-com-m4rc310-gql (>=v1.0.26, <=1.0.41) +370 more potentially affected by CVE-2024-40094 via com.graphql-java:graphql-java (>=21.0, <=21.4)

com.graphql-java:graphql-java MAVEN version =21.0, =v1.0.26, =v1.0.26, =v1.0.26, =v1.0.26, =v1.0.26, =6.8.0, =6.8.0, =6.8.0, =6.8.0, =6.8.0, =6.8.0, =6.8.0, =6.8.0, =7.2.3 - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-uhnfhirtest 6.8.0 and more Source cves: CVE-2024-40094 Source advisory:...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.4.0, <=6.6.2), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.4.0, <=6.6.2) +343 more potentially affected by CVE-2024-40094 via com.graphql-java:graphql-java (>=19.0, <=19.8)

com.graphql-java:graphql-java MAVEN version =19.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =2.0.4, =1.6.9, =14.3.0, =17.7.0 - com.datasqrl:sqrl-base 0.6.0 and more Source cves: CVE-2024-40094 Source advisory: GHSA-H9MQ-F6Q5-6C8M...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=6.4.0, <=6.6.2), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=6.4.0, <=6.6.2) +343 more potentially affected by CVE-2024-40094 via com.graphql-java:graphql-java (>=19.0, <=19.8)

com.graphql-java:graphql-java MAVEN version =19.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =2.0.4, =1.6.9, =14.3.0, =17.7.0 - com.datasqrl:sqrl-base 0.6.0 and more Source cves: CVE-2024-40094 Source advisory: OSV:GHSA-H9MQ-F6Q5-6C8M...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=7.2.0, <=7.4.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=7.2.0, <=7.4.5) +409 more potentially affected by CVE-2023-7272 via org.eclipse.parsson:parsson (>=1.0.0, <=1.0.3)

org.eclipse.parsson:parsson MAVEN version =1.0.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =1.0, =0.3.8, =0.3.0, =0.2.3, =1.1.0, =1.4.4 and more Source cves: CVE-2023-7272 Source advisory: OSV:GHSA-2RWM-XV5J-777P...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=7.2.0, <=7.4.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=7.2.0, <=7.4.5) +409 more potentially affected by CVE-2023-7272 via org.eclipse.parsson:parsson (>=1.0.0, <=1.0.3)

org.eclipse.parsson:parsson MAVEN version =1.0.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =1.0, =0.3.8, =0.3.0, =0.2.3, =1.1.0, =1.4.4 and more Source cves: CVE-2023-7272 Source advisory: GHSA-2RWM-XV5J-777P...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=7.2.0, <=7.4.5), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=7.2.0, <=7.4.5) +409 more potentially affected by CVE-2023-7272 via org.eclipse.parsson:parsson (>=1.0.0, <=1.0.3)

org.eclipse.parsson:parsson MAVEN version =1.0.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =7.2.0, =1.0, =0.3.8, =0.3.0, =0.2.3, =1.1.0, =1.4.4 and more Source cves: CVE-2023-7272 Source advisory: MEND:CVE-2023-7272...

Malicious code in falcor-hapi-demo (npm)

--- -= Per source details. Do not edit below this line.=-...

am.ik.home:uaa-client (1.9.0), am.ik.home:uaa-integration-test (1.9.0) +904 more potentially affected by CVE-2024-22262 via org.springframework:spring-web (4.3.7.release)

org.springframework:spring-web MAVEN version 4.3.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - am.ik.home:uaa-client 1.9.0 - am.ik.home:uaa-integration-test 1.9.0 - am.ik.home:uaa-server...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (3.0.0), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (3.0.0) +863 more potentially affected by CVE-2024-22259 via org.springframework:spring-web (4.3.10.release)

org.springframework:spring-web MAVEN version 4.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 3.0.0 -...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=5.7.0, <=6.4.1), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=5.7.7, <=6.4.1) +111 more potentially affected by CVE-2023-28465 via ca.uhn.hapi.fhir:org.hl7.fhir.r4b (>=5.6.22, <=5.6.105)

ca.uhn.hapi.fhir:org.hl7.fhir.r4b MAVEN version =5.6.22, =5.7.0, =5.7.7, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =6.2.0, =5.7.0, =5.7.0, =5.7.0, =5.7.0, =5.7.7, =5.7.0, =6.4.1 and more Source cves: CVE-2023-28465 Source advisory: MEND:CVE-2023-28465...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=4.0.0, <=6.4.1), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=5.6.5, <=6.4.1) +163 more potentially affected by CVE-2023-28465 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (>=0.0.1, <=5.6.105)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version =0.0.1, =4.0.0, =5.6.5, =4.1.0, =4.0.3, =4.1.0, =4.0.0, =5.0.0, =4.0.0, =5.3.0, =6.2.0, =5.1.0, =5.3.0, =4.0.0, =4.1.0, =6.4.1 and more Source cves: CVE-2023-28465 Source advisory: MEND:CVE-2023-28465...