OpenClinic GA Security Vulnerability

OpenClinic GA is an open source hospital information management system. The system supports financial management, clinical management and laboratory management. A security vulnerability exists in OpenClinic GA version 5.247.01, which stems from an unauthenticated file download vulnerability...

OpenClinic GA Security Vulnerability

OpenClinic GA is an open source hospital information management system. The system supports financial management, clinical management and laboratory management. A security vulnerability exists in OpenClinic GA version 5.247.01, which originates from a directory path traversal attack that can be...

CVE-2023-40278: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in OpenClinic GA 5.247.01. An Information Disclosure vulnerability has been identified in the printAppointmentPdf.jsp component of OpenClinic GA. By changing the AppointmentUid parameter, an attacker can determine whether a specific appointment exists based on the error...

CVE-2023-40275

An issue was discovered in OpenClinic GA 5.247.01. It allows retrieval of patient lists via queries such as findFirstname= to common/search/searchByAjax/patientslistShow.jsp...

CVE-2023-40279

An issue was discovered in OpenClinic GA 5.247.01. An attacker can perform a directory path traversal via the Page parameter in a GET request to main.do...

CVE-2023-40276

An Unauthenticated File Download vulnerability exists in OpenClinic GA version 5.247.01 within the pharmacy/exportFile.jsp component. This flaw allows unauthorized actors to gain access to sensitive files . To mitigate this risk, it is recommended to restrict access to the pharmacy/exportFile.jsp...

CVE-2023-40275

An issue was discovered in OpenClinic GA 5.247.01. It allows retrieval of patient lists via queries such as findFirstname= to common/search/searchByAjax/patientslistShow.jsp...

CVE-2023-40276

An issue was discovered in OpenClinic GA 5.247.01. An Unauthenticated File Download vulnerability has been discovered in pharmacy/exportFile.jsp...

CVE-2023-40277

An issue was discovered in OpenClinic GA 5.247.01. A Reflected Cross-Site Scripting XSS vulnerability has been discovered in the login.jsp message parameter...

CVE-2023-40278

An issue was discovered in OpenClinic GA 5.247.01. An Information Disclosure vulnerability has been identified in the printAppointmentPdf.jsp component of OpenClinic GA. By changing the AppointmentUid parameter, an attacker can determine whether a specific appointment exists based on the error...

CVE-2023-40278

OpenClinic GA 5.247.01 is vulnerable to an Information Disclosure flaw in the printAppointmentPdf.jsp component. The root cause is improper handling of error messages when the AppointmentUid parameter is manipulated, which allows an attacker to determine if a specific appointment exists. Practica...

CVE-2023-40277

OpenClinic GA version 5.247.01 is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability. The flaw exists in the message parameter of the login.jsp page, where improper neutralization of input during web page generation allows for script injection. Exploitation could lead to unauthor...

CVE-2023-40280

An issue was discovered in OpenClinic GA 5.247.01. An attacker can perform a directory path traversal via the Page parameter in a GET request to popup.jsp...

CVE-2023-40280

OpenClinic GA version 5.247.01 is vulnerable to a directory path traversal flaw. An attacker can exploit this by manipulating the Page parameter in a GET request sent to the popup.jsp endpoint. This vulnerability could allow unauthorized access to restricted directories. As a temporary workaround...

CVE-2023-40277: Improper Neutralization of Input During Web Page Generation

An issue was discovered in OpenClinic GA 5.247.01. A Reflected Cross-Site Scripting XSS vulnerability has been discovered in the login.jsp message parameter...

CVE-2023-40279

A directory path traversal vulnerability exists in OpenClinic GA 5.247.01 . An attacker can exploit the Page parameter in a GET request to the main.do endpoint to traverse directories. This flaw allows for the retrieval and execution of files from arbitrary directories. Proof of concepts are avai...

CVE-2023-40275

The open-source hospital information management system OpenClinic GA version 5.247.01 is vulnerable to an issue that allows the retrieval of patient lists by an unauthorized actor. The vulnerability stems from the ability to execute queries, such as findFirstname=, against the _common/search/sear...

OpenClinic GA Security Vulnerability

OpenClinic GA is an open source hospital information management system. The system supports financial management, clinical management and laboratory management. A security vulnerability exists in OpenClinic GA version 5.247.01, which stems from allowing patient lists to be retrieved via a query...

CVE-2023-40276

An issue was discovered in OpenClinic GA 5.247.01. An Unauthenticated File Download vulnerability has been discovered in pharmacy/exportFile.jsp...

CVE-2023-40275: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in OpenClinic GA 5.247.01. It allows retrieval of patient lists via queries such as findFirstname= to common/search/searchByAjax/patientslistShow.jsp...