CVE-2019-3967

CVE-2019-3967 affects OpenEMR 5.0.1 and earlier, where the patient file download interface contains a directory traversal flaw allowing authenticated attackers to download arbitrary files from the host system. The connected Red Hat and CNVD entries corroborate the affected product/version and the...

CVE-2019-3967

In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system...

CVE-2019-3967

In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system...

CVE-2019-3966

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreignid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3966

OpenEMR 5.0.1 and earlier is affected by a reflected XSS vulnerability in controller.php (parameter: foreign_id). The issue could allow an attacker to execute arbitrary code in the context of a user’s session. The provided documents do not include patch versions, fixes, or mitigations. No exploit...

CVE-2019-3965

OpenEMR

CVE-2019-3965

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the documentid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3964

OpenEMR 5.0.1 and earlier are affected by a reflected XSS in controller.php, triggered via the doc_id parameter. The Red Hat, CNVD, CVE, NVD and OSV entries corroborate that this allows an attacker to execute arbitrary code in the context of a user session. Concrete exploit details, affected subv...

CVE-2019-3964

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the docid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3963

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patientid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3963

CVE-2019-3963 affects OpenEMR 5.0.1 and earlier, where the vulnerable component is the controller.php handling the patient_id parameter. The root cause is a reflected XSS vulnerability in that parameter, enabling an attacker to execute arbitrary code in the context of a user’s session. Multiple c...

CVE-2019-3963: Improper Neutralization of Input During Web Page Generation

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patientid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3964: Improper Neutralization of Input During Web Page Generation

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the docid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3967: Improper Limitation of a Pathname to a Restricted Directory

In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system...

PT-2019-16816

Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.1 and earlier Description The patient file download interface in OpenEMR contains a directory traversal flaw. This flaw allows authenticated attackers to download arbitrary files from the host system. Recommendations For...

PT-2019-16815

Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.1 and earlier Description The issue concerns a reflected XSS vulnerability. This vulnerability is located in the controller.php file and is related to the foreign id parameter. It could allow an attacker to execute arbitra...

PT-2019-16812

Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.1 and earlier Description The issue is related to a reflected XSS vulnerability. This vulnerability is located in the controller.php file and is associated with the patient id parameter. It could allow an attacker to execu...

PT-2019-16814

Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.1 and earlier Description The issue is related to a reflected XSS vulnerability. This vulnerability is located in the controller.php file and is associated with the document id parameter. It could allow an attacker to...

CVE-2019-3966: Improper Neutralization of Input During Web Page Generation

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreignid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3965: Improper Neutralization of Input During Web Page Generation

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the documentid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...