CVE-2019-3967

CVE-2019-3967 affects OpenEMR 5.0.1 and earlier, where the patient file download interface contains a directory traversal flaw allowing authenticated attackers to download arbitrary files from the host system. The connected Red Hat and CNVD entries corroborate the affected product/version and the...

CVE-2019-3967

In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system...

CVE-2019-3967

In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system...

CVE-2019-3966

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreignid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3966

OpenEMR 5.0.1 and earlier is affected by a reflected XSS vulnerability in controller.php (parameter: foreign_id). The issue could allow an attacker to execute arbitrary code in the context of a user’s session. The provided documents do not include patch versions, fixes, or mitigations. No exploit...

CVE-2019-3965

OpenEMR

CVE-2019-3965

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the documentid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3964

OpenEMR 5.0.1 and earlier are affected by a reflected XSS in controller.php, triggered via the doc_id parameter. The Red Hat, CNVD, CVE, NVD and OSV entries corroborate that this allows an attacker to execute arbitrary code in the context of a user session. Concrete exploit details, affected subv...

CVE-2019-3964

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the docid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3963

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patientid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3963

CVE-2019-3963 affects OpenEMR 5.0.1 and earlier, where the vulnerable component is the controller.php handling the patient_id parameter. The root cause is a reflected XSS vulnerability in that parameter, enabling an attacker to execute arbitrary code in the context of a user’s session. Multiple c...

CVE-2019-3967: Improper Limitation of a Pathname to a Restricted Directory

In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system...

PT-2019-16816

Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.1 and earlier Description The patient file download interface in OpenEMR contains a directory traversal flaw. This flaw allows authenticated attackers to download arbitrary files from the host system. Recommendations For...

PT-2019-16815

Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.1 and earlier Description The issue concerns a reflected XSS vulnerability. This vulnerability is located in the controller.php file and is related to the foreign id parameter. It could allow an attacker to execute arbitra...

CVE-2019-3966: Improper Neutralization of Input During Web Page Generation

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreignid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

PT-2019-16813

Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.1 and earlier Description The issue concerns a reflected XSS vulnerability. This vulnerability is located in the controller.php file and is related to the doc id parameter. It could allow an attacker to execute arbitrary...

CVE-2019-3964: Improper Neutralization of Input During Web Page Generation

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the docid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3963: Improper Neutralization of Input During Web Page Generation

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patientid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

PT-2019-16812

Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.1 and earlier Description The issue is related to a reflected XSS vulnerability. This vulnerability is located in the controller.php file and is associated with the patient id parameter. It could allow an attacker to execu...

CVE-2019-3968: Improper Neutralization of Special Elements used in an OS Command

In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new form...