3553 matches found
CVE-2023-24065
NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name of a physician, assistant, or billing user can have a JavaScript payload that is executed upon visiting the /users/2/1 page. This may allow attackers to steal Protected Health Information because the product is for...
CVE-2023-23637
IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH /modifyonto request to the ontology builder. This may allow attackers to steal Protected Health Information...
CVE-2023-21926
Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications component: Core. Supported versions that are affected are Prior to 6.3.1.3 and Prior to 7.0.0.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure wher...
CVE-2023-1180
A vulnerability has been found in SourceCodester Health Center Patient Record Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file hematologyprint.php. The manipulation of the argument hemid leads to cross site scripting. The...
CVE-2023-1253
A vulnerability, which was classified as critical, was found in SourceCodester Health Center Patient Record Management System 1.0. This affects an unknown part of the file login.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely...
CVE-2023-1156
A vulnerability classified as problematic was found in SourceCodester Health Center Patient Record Management System 1.0. This vulnerability affects unknown code of the file admin/fecalysisform.php. The manipulation of the argument itrno leads to cross site scripting. The attack can be initiated...
CVE-2023-24610
NOSH 4a5cfdb allows remote authenticated users to execute PHP arbitrary code via the "practice logo" upload feature. The client-side checks can be bypassed. This may allow attackers to steal Protected Health Information because the product is for health charting...
CVE-2023-20229
A vulnerability in the CryptoService function of Cisco Duo Device Health Application for Windows could allow an authenticated, local attacker with low privileges to conduct directory traversal attacks and overwrite arbitrary files on an affected system. This vulnerability is due to insufficient...
CVE-2022-46471
Online Health Care System v1.0 was discovered to contain a SQL injection vulnerability via the consultingid parameter at /healthcare/Admin/consultingdetail.php...
CVE-2022-22283
Improper session management vulnerability in Samsung Health prior to 6.20.1.005 prevents logging out from Samsung Health App...
CVE-2022-32350
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/classes/Master.php?f=deleteroomtype...
CVE-2022-21518
Vulnerability in the Oracle Health Sciences Data Management Workbench product of Oracle Health Sciences Applications component: User Interface. Supported versions that are affected are 2.4.8.7 and 2.5.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTT...
CVE-2022-47161
Cross-Site Request Forgery CSRF vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin = 1.5.1 versions...
CVE-2021-25401
Intent redirection vulnerability in Samsung Health prior to version 6.16 allows attacker to execute privileged action...
CVE-2021-25506
Non-existent provider in Samsung Health prior to 6.19.1.0001 allows attacker to access it via malicious content provider or lead to denial of service...
CVE-2021-25425
Improper check vulnerability in Samsung Health prior to version 6.17 allows attacker to read internal cache data via exported component...
CVE-2021-21985
The vSphere Client HTML5 contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with...
CVE-2021-21926
A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘healthfilter’ parameter...
CVE-2020-1324
An elevation of privilege user to user vulnerability exists in Windows Security Health Service when handling certain objects in memory.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from...