164 matches found
CVE-2024-11730 KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection
The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to SQL Injection via the 'sort' parameter of the staticdatalist AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2024-11728 KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection
The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to SQL Injection via the 'visittypeserviceid' parameter of the taxcalculateddata AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of...
CVE-2024-11728
CVE-2024-11728 concerns the WordPress plugin KiviCare – Clinic & Patient Management System (EHR) , affected up to version 3.6.4 . The vulnerability is an unauthenticated SQL Injection via the parameter visit_type[service_id] in the tax_calculated_data AJAX action, caused by insufficient escaping ...
Change Healthcare outages reportedly caused by ransomware
On Wednesday February 21, 2024, Change Healthcare—a subsidiary of UnitedHealth Group—experienced serious system outages due to a cyberattack. In a Form 8-K filing the company said it: “identified a suspected nation-state associated cyber security threat actor had gained access to some of the Chan...
Healthcare Needs Risk-Based Cybersecurity for Comprehensive, Effective Protection
In the first blog post of this three-blog series, we discussed the extraordinarily powerful “perfect storm” of cyber risk faced by healthcare organizations. The second blog post reviews how data security risks persist despite HIPAA compliance. In this third blog, we will discuss how to get starte...
Unveiling the Cyber Threats to Healthcare: Beyond the Myths
Let's begin with a thought-provoking question: among a credit card number, a social security number, and an Electronic Health Record EHR, which commands the highest price on a dark web forum? Surprisingly, it's the EHR, and the difference is stark: according to a study, EHRs can sell for up to...
CVE-2023-6655
A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionality of the file /wselfservice/oauthservlet/%2e./.%2e/general/inform/org/loadhistroyorgtree of the component Login Interface. The manipulation of the argument...
PT-2023-5353 · Openemr · Openemr
Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 7.0.1 Description: The issue is related to incorrect code generation management in the OpenEMR software, which can be exploited by a remote attacker to redirect users to an arbitrary URL. Recommendations: For version...
Macroview eHR suffers from an arbitrary file read vulnerability
Beijing Hongjing Century Software Co., Ltd "Hongjing Software" has always been focusing on the research and development and application promotion of human resources and talent management digitalization digitalization and intelligence products for state-owned enterprises and institutions since its...
LibreHealth EHR Cross-Site Scripting Vulnerability (CNVD-2022-62205)
LibreHealth EHR is a clinically-focused electronic health record EHR system designed to be easy to use out of the box and customizable for use in a variety of healthcare settings. version 2.0.0 of LibreHealth EHR is vulnerable to a cross-site scripting vulnerability that originates in the...
LibreHealth EHR Access Control Error Vulnerability
LibreHealth EHR is a clinically-focused electronic health record EHR system designed to be easy to use out of the box and customizable for use in a variety of healthcare environments. version 2.0.0 of LibreHealth EHR is vulnerable to an access control error that could be exploited by an attacker ...
LibreHealth EHR Cross-Site Scripting Vulnerability (CNVD-2022-62206)
LibreHealth EHR is a clinically-focused electronic health record EHR system designed to be easy to use out of the box and customizable for use in a variety of healthcare settings. The navigation.php page lacks filtering and escaping for parameters. An attacker could exploit this vulnerability to...
CVE-2022-31496
LibreHealth EHR Base 2.0.0 allows incorrect interface/super/managesitefiles.php access...
CVE-2022-31496
LibreHealth EHR Base 2.0.0 allows incorrect interface/super/managesitefiles.php access...
Input validation
LibreHealth EHR Base 2.0.0 allows incorrect interface/super/managesitefiles.php access...
LibreHealth EHR Cross-Site Scripting Vulnerability (CNVD-2022-65032)
LibreHealth EHR is a clinically-focused electronic health record EHR system designed to be both easy to use out of the box and customizable for use in a variety of healthcare settings. version 2.0.0 of LibreHealth EHR is vulnerable to a cross-site scripting vulnerability, for which no detailed...
LibreHealth EHR Cross-Site Scripting Vulnerability (CNVD-2022-65031)
LibreHealth EHR is a clinically-focused electronic health record EHR system designed to be both easy to use out of the box and customizable for use in a variety of healthcare settings.LibreHealth EHR 2.0.0 is vulnerable to a cross-site scripting vulnerability for which no detailed vulnerability...
LibreHealth EHR Cross-Site Scripting Vulnerability (CNVD-2022-65030)
LibreHealth EHR is a clinically-focused electronic health record HER system designed to be both easy to use out of the box and customizable for use in a variety of healthcare settings. libreHealth EHR 2.0.0 is vulnerable to a cross-site scripting vulnerability for which no detailed vulnerability...
CVE-2022-31496
CVE-2022-31496 affects LibreHealth EHR Base 2.0.0. A misconfigured access control on the interface/super/manage_site_files.php endpoint allows unauthorized access, with sources noting possible remote code execution in some catalogs. The available documents do not specify a vendor-provided fix ver...