CVE-2020-14492: Improper Neutralization of Input During Web Page Generation

OpenClinic GA 5.09.02 and 5.89.05b does not properly neutralize user-controllable input, which may allow the execution of malicious code within the user’s browser...

CVE-2020-14488: Unrestricted Upload of File with Dangerous Type

OpenClinic GA 5.09.02 and 5.89.05b does not properly verify uploaded files, which may allow a low-privilege user to upload and execute arbitrary files on the system...

PT-2020-14034

Name of the Vulnerable Software and Affected Versions OpenClinic GA versions 5.09.02 through 5.89.05b Description The issue allows an attacker to bypass permission and authorization checks by ignoring the redirect of a permission failure, potentially enabling unauthorized execution of commands...

PT-2020-14040

Name of the Vulnerable Software and Affected Versions OpenClinic GA versions 5.09.02 through 5.89.05b Description The issue arises from the improper neutralization of user-controllable input, potentially allowing the execution of malicious code within the user's browser. Recommendations For...

PT-2020-14036

Name of the Vulnerable Software and Affected Versions OpenClinic GA versions 5.09.02 through 5.89.05b Description The issue is related to the improper verification of uploaded files, which may allow a low-privilege user to upload and execute arbitrary files on the system. Recommendations For...

PT-2020-14041

Name of the Vulnerable Software and Affected Versions OpenClinic GA versions 5.09.02 through 5.89.05b Description A low-privilege user may use SQL syntax to write arbitrary files to the server, potentially allowing the execution of arbitrary commands. Recommendations For versions 5.09.02 through...

PT-2020-14037

Name of the Vulnerable Software and Affected Versions OpenClinic GA versions 5.09.02 through 5.89.05b Description The issue concerns inadequate hashing complexity used for storing passwords, potentially allowing attackers to recover passwords using known password cracking techniques...

CVE-2020-14487: Hidden Functionality

OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitrary commands...

CVE-2020-14486: Improper Authorization

An attacker may bypass permission/authorization checks in OpenClinic GA 5.09.02 and 5.89.05b by ignoring the redirect of a permission failure, which may allow unauthorized execution of commands...

CVE-2020-14489: Insufficiently Protected Credentials

OpenClinic GA 5.09.02 and 5.89.05b stores passwords using inadequate hashing complexity, which may allow an attacker to recover passwords using known password cracking techniques...

PT-2020-14038

Name of the Vulnerable Software and Affected Versions OpenClinic GA versions 5.09.02 through 5.89.05b Description The issue allows for the disclosure of sensitive files or the execution of malicious uploaded files by executing arbitrary local files specified within its parameter. This could...

CVE-2020-14490: Improper Limitation of a Pathname to a Restricted Directory

OpenClinic GA 5.09.02 and 5.89.05b includes arbitrary local files specified within its parameter and executes some files, which may allow disclosure of sensitive files or the execution of malicious uploaded files...

CVE-2020-14493: Execution with Unnecessary Privileges

A low-privilege user may use SQL syntax to write arbitrary files to the OpenClinic GA 5.09.02 and 5.89.05b server, which may allow the execution of arbitrary commands...

PT-2020-14035

Name of the Vulnerable Software and Affected Versions OpenClinic GA version 5.09.02 Description The issue concerns a hidden default user account in OpenClinic GA. If an administrator has not explicitly disabled this account, it may be accessed by an attacker, potentially allowing them to log in a...

CVE-2020-14485

OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass client-side access controls or use a crafted request to initiate a session with limited functionality, which may allow execution of admin functions such as SQL queries...

CVE-2020-14484

OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass the system’s account lockout protection, which may allow brute force password attacks...

CVE-2020-14491

OpenClinic GA versions 5.09.02 and 5.89.05b do not properly check permissions before executing SQL queries, which may allow a low-privilege user to access privileged information...

CVE-2020-14484

OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass the system’s account lockout protection, which may allow brute force password attacks...

CVE-2020-14485

OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass client-side access controls or use a crafted request to initiate a session with limited functionality, which may allow execution of admin functions such as SQL queries...

CVE-2020-14491

OpenClinic GA versions 5.09.02 and 5.89.05b do not properly check permissions before executing SQL queries, which may allow a low-privilege user to access privileged information...