CVE-2017-9380: Unrestricted Upload of File with Dangerous Type

OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within the context of the vulnerable application...

PT-2017-18890

Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.0 and prior Description The issue allows low-privilege users to upload files of dangerous types, which can result in arbitrary code execution within the context of the vulnerable application. Recommendations For OpenEMR...

OpenEMR Multiple Vulnerabilities

OpenEMR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:open-emr:openemr"; ifdescription...

Cross site scripting

Multiple Cross-Site Scripting XSS issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to the "openemr-master/gacl/admin/objectsearch.php" URL sectionvalue; srcform. An attacker could execute arbitrary HTML an...

CVE-2017-6394

Multiple Cross-Site Scripting XSS issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to the "openemr-master/gacl/admin/objectsearch.php" URL sectionvalue; srcform. An attacker could execute arbitrary HTML an...

CVE-2017-6394

Multiple Cross-Site Scripting XSS issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to the "openemr-master/gacl/admin/objectsearch.php" URL sectionvalue; srcform. An attacker could execute arbitrary HTML an...

CVE-2017-6394

Multiple Cross-Site Scripting XSS issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to the "openemr-master/gacl/admin/objectsearch.php" URL sectionvalue; srcform. An attacker could execute arbitrary HTML an...

CVE-2017-6394

CVE-2017-6394 relates to OpenEMR 5.0.0 and 5.0.1-dev, where XSS exists due to insufficient filtration of user-supplied data in the openemr-master/gacl/admin/object_search.php URL (section_value; src_form). An attacker could inject HTML/script to run in a victim’s browser within the site context. ...

CVE-2017-6394: Improper Neutralization of Input During Web Page Generation

Multiple Cross-Site Scripting XSS issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to the "openemr-master/gacl/admin/objectsearch.php" URL sectionvalue; srcform. An attacker could execute arbitrary HTML an...

PT-2017-17035

Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.0 through 5.0.1-dev Description Multiple Cross-Site Scripting XSS issues were discovered due to insufficient filtration of user-supplied data. An attacker could execute arbitrary HTML and script code in a browser in the...

OpenEMR globals.php Authentication Bypass (CVE-2015-4453)

An authentication weakness vulnerability exists in OpenEMR, specifically in the globals.php script. The vulnerability is due to variable name collision during HTTP parameter extraction. Successful exploitation will bypass authentication and allow the attacker to gain unauthorized access to the...

OpenEMR 'interface/globals.php' Security Bypass Vulnerability

OpenEMR is an open source medical management system maintained by the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A security vulnerability exists in the Web interface of OpenEMR. A remote...

OpenEMR 'interface/globals.php' Authentication Bypass Vulnerability - Active Check

OpenEMR is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:open-emr:openemr"; if...

Authentication flaw

interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by 1 interface/fax/faxdispatchnewpid.php and 2 interface/billing/sleobsearch.php...

CVE-2015-4453

interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by 1 interface/fax/faxdispatchnewpid.php and 2 interface/billing/sleobsearch.php...

CVE-2015-4453

OpenEMR vulnerable component: interface/globals.php. Root cause: a bug in the implementation of the legacy (fake) register_globals handling allows an ignoreAuth=1 parameter to bypass authentication. Affected versions: OpenEMR 2.x, 3.x, and 4.x up to 4.2.0 patch 2. Impact: remote attackers can acc...

CVE-2015-4453

interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by 1 interface/fax/faxdispatchnewpid.php and 2 interface/billing/sleobsearch.php...

PT-2015-6593

Name of the Vulnerable Software and Affected Versions OpenEMR versions 2.x through 4.1.1 OpenEMR version 4.2.0 before patch 2 Description The issue allows remote attackers to bypass authentication and obtain sensitive information by providing an ignoreAuth=1 value to certain scripts. This is...

CVE-2015-4453: Improper Authentication

interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by 1 interface/fax/faxdispatchnewpid.php and 2 interface/billing/sleobsearch.php...

OpenEMR vulnerable to authentication bypass

Overview OpenEMR is an electronic health records and medical practice management application. OpenEMR contains an authentication bypass vulnerability CWE-302. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...