2691 matches found
PT-2019-16813
Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.1 and earlier Description The issue concerns a reflected XSS vulnerability. This vulnerability is located in the controller.php file and is related to the doc id parameter. It could allow an attacker to execute arbitrary...
CVE-2019-3968: Improper Neutralization of Special Elements used in an OS Command
In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new form...
PT-2019-16817
Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.1 and earlier Description The issue allows an authenticated attacker to execute arbitrary commands on the host system through the Scanned Forms interface when creating a new form. Recommendations For OpenEMR versions 5.0.1...
CVE-2019-14530
An issue was discovered in custom/ajaxdownload.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file that is readable by the user www-data from server storage. If the requested file is writable for the www-data user and the directory...
CVE-2019-14530
An issue was discovered in custom/ajaxdownload.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file that is readable by the user www-data from server storage. If the requested file is writable for the www-data user and the directory...
Design/Logic Flaw
An issue was discovered in custom/ajaxdownload.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file that is readable by the user www-data from server storage. If the requested file is writable for the www-data user and the directory...
CVE-2019-14530
An issue was discovered in custom/ajaxdownload.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file that is readable by the user www-data from server storage. If the requested file is writable for the www-data user and the directory...
CVE-2019-14530
Summary: OpenEMR before 5.0.2 is vulnerable to a local file disclosure via the fileName parameter in custom/ajax_download.php, enabling an authenticated attacker to download files readable by the web server user (www-data) and potentially delete a target file in /var/www/openemr/sites/default/doc...
CVE-2019-14530
An issue was discovered in custom/ajaxdownload.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file that is readable by the user www-data from server storage. If the requested file is writable for the www-data user and the directory...
Exploit for Path Traversal in Open-Emr Openemr
CVE-2019-14530 Path traversal and DoS vulnerability in OpenEM...
PT-2019-13738
Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.2 Description An issue was discovered in the custom/ajax download.php file via the fileName parameter, allowing an attacker to download any file readable by the user www-data from server storage. If the requested...
CVE-2019-14530
An issue was discovered in custom/ajaxdownload.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file that is readable by the user www-data from server storage. If the requested file is writable for the www-data user and the directory...
CVE-2019-14530: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in custom/ajaxdownload.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file that is readable by the user www-data from server storage. If the requested file is writable for the www-data user and the directory...
OpenEMR SQL Injection Vulnerability (CNVD-2019-25999)
OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A SQL injection vulnerability exists in the interfaces/forms/eyemag/save.php file ...
OpenEMR < 5.0.2 Multiple Vulnerabilities
OpenEMR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:open-emr:openemr"; ifdescription...
CVE-2019-14529
OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eyemag/save.php...
CVE-2019-14529
OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eyemag/save.php...
Sql injection
OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eyemag/save.php...