CVE-2011-5160

Cross-site scripting XSS vulnerability in setup.php in OpenEMR 4 allows remote attackers to inject arbitrary web script or HTML via the site parameter...

CVE-2011-5160

CVE-2011-5160 is a cross-site scripting (XSS) vulnerability in OpenEMR 4, affecting the file setup.php. The vulnerability allows remote attackers to inject arbitrary web script or HTML by supplying a crafted value in the site parameter. Multiple sources (NVD, CVE lists, and related records) corro...

CVE-2011-5161

OpenEMR 4 is affected by an Unrestricted file upload vulnerability in the patient photograph feature. An attacker can upload a file with an executable extension followed by a safe extension and then access it via a direct request to the documents/ patient directory, allowing remote code execution...

CVE-2012-2115

SQL injection vulnerability in interface/login/validateUser.php in OpenEMR 4.1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the u parameter...

CVE-2011-5160

Cross-site scripting XSS vulnerability in setup.php in OpenEMR 4 allows remote attackers to inject arbitrary web script or HTML via the site parameter...

CVE-2011-5161

Unrestricted file upload vulnerability in the patient photograph functionality in OpenEMR 4 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the patient directory under...

CVE-2012-2115

CVE-2012-2115 affects OpenEMR (interface/login/validateUser.php) where SQL injection via the u parameter allows remote attackers to execute arbitrary SQL commands. Affected: OpenEMR 4.1.0 and possibly earlier. Root cause: unsafely constructed SQL from user input. Impact: partial confidentiality/i...

PT-2012-2139

Name of the Vulnerable Software and Affected Versions OpenEMR version 4 Description The issue concerns an unrestricted file upload vulnerability in the patient photograph functionality. This allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension...

PT-2012-2138

Name of the Vulnerable Software and Affected Versions OpenEMR version 4 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the site parameter in setup.php. Recommendations For OpenEMR version 4, update to a newer version that...

PT-2012-3815

Name of the Vulnerable Software and Affected Versions OpenEMR versions 4.1.0 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands via the u parameter in the interface/login/validateUser.php file. Recommendations For OpenEMR versions 4.1.0 and earlier, consid...

CVE-2012-2115: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in interface/login/validateUser.php in OpenEMR 4.1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the u parameter...

CVE-2011-5160: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in setup.php in OpenEMR 4 allows remote attackers to inject arbitrary web script or HTML via the site parameter...

CVE-2011-5161: Undefined Security Weakness

Unrestricted file upload vulnerability in the patient photograph functionality in OpenEMR 4 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the patient directory under...

Multiple vulnerabilities in OpenEMR

Advisory ID: HTB23069 Product: OpenEMR Vendor: OEMR Vulnerable Version: 4.1.0 and probably prior Tested Version: 4.1.0 Vendor Notification: 11 January 2012 Vendor Patch: 29 January 2012 Public Disclosure: 01 February 2012 Vulnerability Type: Local File Inclusion, Arbitrary Command Execution...

CVE-2012-0991

Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. dot dot in the formname parameter to 1 contrib/acog/printform.php; or 2 loadform.php, 3 viewform.php, or 4 trendform.php in interface/patientfile/encounter...

CVE-2012-0992

interface/fax/faxdispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter...

Directory traversal

Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. dot dot in the formname parameter to 1 contrib/acog/printform.php; or 2 loadform.php, 3 viewform.php, or 4 trendform.php in interface/patientfile/encounter...

Code injection

interface/fax/faxdispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter...

CVE-2012-0991

Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. dot dot in the formname parameter to 1 contrib/acog/printform.php; or 2 loadform.php, 3 viewform.php, or 4 trendform.php in interface/patientfile/encounter...

CVE-2012-0992

interface/fax/faxdispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter...