310 matches found
HAPI FHIR HTTP authentication leak in redirects
When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers ...
HAPI FHIR HTTP authentication leak in redirects
When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers ...
HAPI FHIR HTTP authentication leak in redirects
When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers ...
Malicious Package
Overview fhir.base.template is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2026-24487 OpenEMR has FHIR Patient Compartment Bypass in CareTeam Resource
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorization bypass vulnerability in the FHIR CareTeam resource endpoint allows patient-scoped FHIR tokens to access care team data for all patients instead of bein...
CVE-2026-24487
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorization bypass vulnerability in the FHIR CareTeam resource endpoint allows patient-scoped FHIR tokens to access care team data for all patients instead of bein...
CVE-2026-24487
OpenEMR before 8.0.0 contains an authorization bypass in the FHIR CareTeam resource endpoint. The root cause is that FhirCareTeamService does not implement IPatientCompartmentResourceService and does not pass the patient binding parameter to the underlying service, bypassing patient compartment f...
PT-2026-21971
Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0 Description OpenEMR is an electronic health records and medical practice management application. A flaw exists where patient-scoped FHIR tokens can access care team data for all patients instead of being limited...
CVE-2019-12741
XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafte...
EUVD-2021-1274
Malware in sbrugna...
EUVD-2020-17036
Malware in sbrugna...
EUVD-2019-0503
Malware in sbrugna...
EUVD-2024-2732
Malicious code in bioql PyPI...
EUVD-2025-0136
Malicious code in bioql PyPI...
EUVD-2025-0146
Malicious code in bioql PyPI...
EUVD-2024-2731
Malicious code in bioql PyPI...
EUVD-2025-16400
Malicious code in bioql PyPI...
EUVD-2023-0498
Malicious code in bioql PyPI...