CVE-2020-24621

A remote code execution RCE vulnerability was discovered in the htmlformentry aka HTML Form Entry module before 3.11.0 for OpenMRS. By leveraging path traversal, a malicious Velocity Template Language file could be written to a directory. This file could then be accessed and executed...

Path traversal

A remote code execution RCE vulnerability was discovered in the htmlformentry aka HTML Form Entry module before 3.11.0 for OpenMRS. By leveraging path traversal, a malicious Velocity Template Language file could be written to a directory. This file could then be accessed and executed...

CVE-2020-24621

The CVE concerns OpenMRS htmlformentry module prior to version 3.11.0. A path traversal flaw could allow writing a malicious Velocity Template Language file to a directory, which could then be accessed and executed, enabling remote code execution. Affected component: htmlformentry module in OpenM...

CVE-2020-24621

A remote code execution RCE vulnerability was discovered in the htmlformentry aka HTML Form Entry module before 3.11.0 for OpenMRS. By leveraging path traversal, a malicious Velocity Template Language file could be written to a directory. This file could then be accessed and executed...

wiki.openmrs.org Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1156562 Security Researcher Gh05tPT Helped patch 6892 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting wiki.openmrs.org website...

OpenMRS Input Validation Error Vulnerability

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. OpenMRS suffers from an input validation error vulnerability that stems from the export function of the data exchange module not properly redirecting to the login page. An attacker could exploit th...

OpenMRS Input Validation Error Vulnerability (CNVD-2020-26248)

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. An input validation error vulnerability exists in OpenMRS. The vulnerability originates from a network system or product that does not properly validate input data. Detailed vulnerability details a...

OpenMRS Cross-Site Scripting Vulnerability (CNVD-2020-24049)

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. A cross-site scripting vulnerability exists in OpenMRS. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerabili...

OpenMRS Cross-Site Scripting Vulnerability (CNVD-2020-26249)

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. OpenMRS suffers from a cross-site scripting vulnerability that stems from a UI framework error page reflecting arbitrary user-supplied input back to the browser. An attacker can exploit this...

OpenMRS Input Validation Error Vulnerability (CNVD-2020-26250)

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. OpenMRS suffers from an input validation error vulnerability that stems from the import function of the data exchange module not properly redirecting to the login page. An attacker could exploit th...

OpenMRS Cross-Site Scripting Vulnerability (CNVD-2020-24048)

OpenMRS is an open source electronic medical record system from OpenMRS, Inc. in the United States. A cross-site scripting vulnerability exists in OpenMRS. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerabili...

CVE-2020-5733

In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. This allows the export of potentially sensitive information...

CVE-2020-5732

In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. This allows unauthenticated users to use a feature typically restricted to administrators...

CVE-2020-5733

In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. This allows the export of potentially sensitive information...

CVE-2020-5732

In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. This allows unauthenticated users to use a feature typically restricted to administrators...

CVE-2020-5729

In OpenMRS 2.9 and prior, the UI Framework Error Page reflects arbitrary, user-supplied input back to the browser, which can result in XSS. Any page that is able to trigger a UI Framework Error is susceptible to this issue...

CVE-2020-5729

In OpenMRS 2.9 and prior, the UI Framework Error Page reflects arbitrary, user-supplied input back to the browser, which can result in XSS. Any page that is able to trigger a UI Framework Error is susceptible to this issue...

CVE-2020-5730

In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting...

CVE-2020-5730

In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting...

CVE-2020-5728

OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages such as login.htm. There is insufficient validation for this parameter, which allows for the possibility of cross-site scripting...