OpenEMR Access Control Error Vulnerability

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. An access control error vulnerability exists in OpenEMR version 5.0.2.1, which ste...

CVE-2021-30172

CVE-2021-30172 affects the Jun-He/Quan-Fang-Wei-Tong-Xun system: special characters on the image preview page input are not filtered, enabling a remote authenticated attacker to inject JavaScript via reflected XSS and access/manipulate customer information. Connected sources confirm the XSS vecto...

CVE-2021-30170

Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks, additionally access and manipulate customer’s information...

CVE-2021-32101

The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/machineconfig.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulat...

Code injection

The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/machineconfig.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulat...

CVE-2021-32101

The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/machineconfig.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulat...

CVE-2021-32101

The CVE-2021-32101 entry concerns OpenEMR 5.0.2.1’s Patient Portal, where an incorrect access control in portal/patient/_machine_config.php allows an unauthenticated attacker to register an account and bypass the portal API’s permission checks, enabling manipulation and reading of data for any re...

CVE-2021-32101: Incorrect Permission Assignment for Critical Resource

The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/machineconfig.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulat...

Vulnerabilities fixed in Cisco Unified Communications Manager

Vulnerabilities have been fixed in Cisco Unified Communications Manager. An authenticated malicious party could potentially exploit the vulnerability with CVE attribute CVE-2021-1478 potentially exploit it to cause a Denial-of-Service attack. To do so, the Java Management Extensions JMX network...

PT-2021-10281

Name of the Vulnerable Software and Affected Versions: Online Book Store version 1.0 Description: The issue allows a remote malicious user to execute arbitrary code via SQL Injection in the bookisbn parameter to the "book.php" endpoint. This could potentially lead to unauthorized access and data...

PT-2021-10279

Name of the Vulnerable Software and Affected Versions: Online Book Store version 1.0 Description: The issue allows a remote malicious user to execute arbitrary code via SQL Injection in the isbn parameter to the "edit book.php" endpoint. This could potentially lead to unauthorized access and data...

PT-2021-10285

Name of the Vulnerable Software and Affected Versions: Online Book Store version 1.0 Description: The issue allows a remote malicious user to execute arbitrary code via SQL Injection in the publisher parameter to the "edit book.php" API endpoint. This could potentially lead to unauthorized access...

Vulnerabilities fixed in Samsung products

Several vulnerabilities have been fixed in various Android-based products from Samsung. The vulnerabilities allow a malicious person, remotely or otherwise, to carry out attacks that lead to the following categories of damage: Manipulation of data Circumvention of security measure Remote code...

Design/Logic Flaw

NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager vGPU plugin, where there is the potential to write to a shared memory location and manipulate the data after the data has been validated, which may lead to denial of service and escalation of privileges and information...

CVE-2021-1085

NVIDIA vGPU driver contains a vulnerability in the Virtual GPU Manager vGPU plugin, where there is the potential to write to a shared memory location and manipulate the data after the data has been validated, which may lead to denial of service and escalation of privileges and information...

CVE-2021-1085

CVE-2021-1085 : NVIDIA vGPU software vulnerability in the Virtual GPU Manager (vGPU plugin) allows writing to a shared memory location and manipulating data after validation, with potential denial of service, privilege escalation, and information disclosure. Affected: vGPU versions 12.x (before 1...

Nvidia vGPU Software 输入验证错误漏洞

Nvidia vGPU Software is a management software from Nvidia, USA for providing GPU capabilities to virtual machines. The software supports multiple virtual machines to access the host's GPU, providing graphics performance and application compatibility for virtual machines. An input validation error...

Vulnerabilities fixed in F5 BIG-IP

Vulnerabilities have been fixed in F5 BIG-IP. The vulnerabilities allow a malicious party to launch attacks that lead to the following categories of damage: Denial-of-Service DoS. Manipulation of data Bypassing authentication Circumvention of security measure Remote code execution...

Vulnerabilities fixed in GitLab CE and EE

GitLab has fixed several vulnerabilities in GitLab Community Edition and Enterprise Edition. The vulnerabilities allow a malicious party to perform attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Bypassing authentication Accessing sensitive da...

PT-2021-19500

Name of the Vulnerable Software and Affected Versions dce extension versions 2.2.0 through 2.6.x before 2.6.2 dce extension versions 2.7.x before 2.7.1 Description The issue allows SQL Injection via a backend user account. This can be exploited to inject malicious SQL code, potentially leading to...