CVE-2023-40278

OpenClinic GA 5.247.01 is affected in the printAppointmentPdf.jsp component. The issue is an information-disclosure vulnerability triggered by manipulating the AppointmentUid parameter, allowing an attacker to determine whether a specific appointment exists via the error message. The root cause i...

CVE-2023-40276

OpenClinic GA 5.247.01 contains an unauthenticated file download vulnerability in pharmacy/exportFile.jsp. The issue allows unauthorized access to files, with CVSS v3.1 base score 9.1 (CRITICAL; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). No exploitation details are provided in the primary CVE entry. R...

CVE-2023-40275

OpenClinic GA 5.247.01 is affected by CVE-2023-40275. The issue allows retrieval of patient lists via queries like findFirstname= to the endpoint _common/search/searchByAjax/patientslistShow.jsp, indicating a exposure of sensitive patient data. Technical details across sources confirm the affecte...

CVE-2023-40277

An issue was discovered in OpenClinic GA 5.247.01. A Reflected Cross-Site Scripting XSS vulnerability has been discovered in the login.jsp message parameter...

CVE-2023-40279

An issue was discovered in OpenClinic GA 5.247.01. An attacker can perform a directory path traversal via the Page parameter in a GET request to main.do...

PT-2024-12883 · Unknown · Openclinic Ga

Name of the Vulnerable Software and Affected Versions: OpenClinic GA version 5.247.01 Description: An issue was discovered in OpenClinic GA, allowing an attacker to perform a directory path traversal via the Page parameter in a GET request to "popup.jsp". Recommendations: For OpenClinic GA versio...

PT-2024-12879 · Unknown · Openclinic Ga

Name of the Vulnerable Software and Affected Versions: OpenClinic GA version 5.247.01 Description: An Unauthenticated File Download issue has been discovered in the pharmacy/exportFile.jsp file. This allows unauthorized access to sensitive files. Recommendations: For OpenClinic GA version 5.247.0...

PT-2024-12880 · Unknown · Openclinic Ga

Name of the Vulnerable Software and Affected Versions: OpenClinic GA version 5.247.01 Description: A Reflected Cross-Site Scripting XSS issue has been discovered. The message parameter in the login.jsp is vulnerable. Recommendations: For OpenClinic GA version 5.247.01, avoid using the message...

PT-2024-12878 · Unknown · Openclinic Ga

Name of the Vulnerable Software and Affected Versions: OpenClinic GA version 5.247.01 Description: An issue was discovered in OpenClinic GA, allowing retrieval of patient lists via queries such as findFirstname= to "/ common/search/searchByAjax/patientslistShow.jsp". Recommendations: For OpenClin...

CVE-2021-37364

OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has the modify permission to openclinic folders/files. A low privilege account is able to rename mysqld.exe or tomcat8.exe files located in bin folders and replace with a malicious file that would...

CVE-2021-37364

OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has the modify permission to openclinic folders/files. A low privilege account is able to rename mysqld.exe or tomcat8.exe files located in bin folders and replace with a malicious file that would...

Path traversal

OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has the modify permission to openclinic folders/files. A low privilege account is able to rename mysqld.exe or tomcat8.exe files located in bin folders and replace with a malicious file that would...

CVE-2021-37364

OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has the modify permission to openclinic folders/files. A low privilege account is able to rename mysqld.exe or tomcat8.exe files located in bin folders and replace with a malicious file that would...

CVE-2021-37364

OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has modify permission to openclinic folders/files, enabling a low-privilege account to rename binaries (mysqld.exe or tomcat8.exe) in bin folders and substitute a malicious file that connects back...

OpenClinic GA 安全漏洞

OpenClinic GA is an open source hospital information management system. The system supports financial management, clinical management and laboratory management. A security vulnerability exists in OpenClinic GA, which stems from the fact that by default, the Authenticated Users group has permissio...

OpenClinic GA 5.194.18 - Local Privilege Escalation Vulnerability

Exploit Title: OpenClinic GA 5.194.18 - Local Privilege Escalation Author: Alessandro Salzano Vendor Homepage: https://sourceforge.net/projects/open-clinic/ Software Homepage: https://sourceforge.net/projects/open-clinic/ Software Link:...

OpenClinic GA 5.194.18 Privilege Escalation

Exploit Title: OpenClinic GA 5.194.18 - Local Privilege Escalation Date: 2021-07-24 Author: Alessandro Salzano Vendor Homepage: https://sourceforge.net/projects/open-clinic/ Software Homepage: https://sourceforge.net/projects/open-clinic/ Software Link:...

OpenClinic GA 5.194.18 - Local Privilege Escalation

Exploit Title: OpenClinic GA 5.194.18 - Local Privilege Escalation Date: 2021-07-24 Author: Alessandro Salzano Vendor Homepage: https://sourceforge.net/projects/open-clinic/ Software Homepage: https://sourceforge.net/projects/open-clinic/ Software Link:...

The vulnerability of the shared/view_source.php component in the OpenClinic medical record management software allows a hacker to execute arbitrary code.

The vulnerability of the shared/viewsource.php component in the OpenClinic medical record management software is related to authentication errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2020-20444

Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infected 'file' GET parameter in '/shared/viewsource.php' which "could" lead to RCE vulnerability...