387 matches found
Electronic Medical Records Cracked Open by Unpatched OpenClinic Bugs
Four vulnerabilities have been discovered in the OpenClinic application for sharing electronic medical records. The most concerning of them would allow a remote, unauthenticated attacker to read patients’ personal health information PHI from the application. OpenClinic is an open-source health...
CVE-2020-14488
OpenClinic GA 5.09.02 and 5.89.05b does not properly verify uploaded files, which may allow a low-privilege user to upload and execute arbitrary files on the system...
CVE-2020-14487
OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitrary commands...
CVE-2020-14487
OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitrary commands...
CVE-2020-14488
OpenClinic GA 5.09.02 and 5.89.05b does not properly verify uploaded files, which may allow a low-privilege user to upload and execute arbitrary files on the system...
CVE-2020-14486
An attacker may bypass permission/authorization checks in OpenClinic GA 5.09.02 and 5.89.05b by ignoring the redirect of a permission failure, which may allow unauthorized execution of commands...
CVE-2020-14486
An attacker may bypass permission/authorization checks in OpenClinic GA 5.09.02 and 5.89.05b by ignoring the redirect of a permission failure, which may allow unauthorized execution of commands...
Input validation
OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitrary commands...
Authorization
An attacker may bypass permission/authorization checks in OpenClinic GA 5.09.02 and 5.89.05b by ignoring the redirect of a permission failure, which may allow unauthorized execution of commands...
Design/Logic Flaw
OpenClinic GA 5.09.02 and 5.89.05b does not properly verify uploaded files, which may allow a low-privilege user to upload and execute arbitrary files on the system...
CVE-2020-14487
OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not turned it off, potentially allowing an attacker to login and execute arbitrary commands. The issue is discussed across multiple sources, with ICS advisories indicating remote exploitation...
CVE-2020-14487 OpenClinic GA
OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitrary commands...
CVE-2020-14486
OpenClinic GA is affected by CVE-2020-14486 via an Authorization bypass (CWE-285). Affected versions include 5.09.02 and 5.89.05b. The vulnerability arises from bypassing permission checks by ignoring the redirect of a permission failure, potentially enabling unauthorized execution of commands. T...
CVE-2020-14486 OpenClinic GA
An attacker may bypass permission/authorization checks in OpenClinic GA 5.09.02 and 5.89.05b by ignoring the redirect of a permission failure, which may allow unauthorized execution of commands...
CVE-2020-14488 OpenClinic GA
OpenClinic GA 5.09.02 and 5.89.05b does not properly verify uploaded files, which may allow a low-privilege user to upload and execute arbitrary files on the system...
CVE-2020-14488
OpenClinic GA versions 5.09.02 and 5.89.05b are affected by CVE-2020-14488, where improper validation of uploaded files may allow a low-privilege user to upload and execute arbitrary files on the system. The issue is documented with a high-impact CVSS baseline (3.1) of 8.8; exploitation is networ...
CVE-2020-14490
OpenClinic GA 5.09.02 and 5.89.05b includes arbitrary local files specified within its parameter and executes some files, which may allow disclosure of sensitive files or the execution of malicious uploaded files...
CVE-2020-14493
A low-privilege user may use SQL syntax to write arbitrary files to the OpenClinic GA 5.09.02 and 5.89.05b server, which may allow the execution of arbitrary commands...