CVE-2017-16540

OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter...

Code injection

OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter...

CVE-2017-16540

OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter...

CVE-2017-16540

OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter...

CVE-2017-16540

OpenEMR before 5.0.0 Patch 5 is vulnerable. setup.php exposes a cloning function that allows unauthenticated remote copying of the OpenEMR database to an attacker-controlled MySQL server via a crafted state parameter. Affected: OpenEMR

CVE-2017-16540: Exposure of Sensitive Information to an Unauthorized Actor

OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter...

PT-2017-14441

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.0 Patch 5 Description The issue allows unauthenticated remote database copying. This is possible because setup.php exposes functionality for cloning an existing site to an arbitrary attacker-controlled MySQL serve...

OpenEMR <= 5.0.0 Multiple Vulnerabilities

OpenEMR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:open-emr:openemr"; ifdescription...

OpenEMR Security Bypass Vulnerability

OpenEMR is an open source medical management system maintained by the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A security bypass vulnerability exists in the 'csvloghtml' function in th...

Design/Logic Flaw

The csvloghtml function in library/edihistory/edihcsvinc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restrictions via a crafted name...

CVE-2017-12064

The csvloghtml function in library/edihistory/edihcsvinc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restrictions via a crafted name...

CVE-2017-12064

The csvloghtml function in library/edihistory/edihcsvinc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restrictions via a crafted name...

CVE-2017-12064

The csvloghtml function in library/edihistory/edihcsvinc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restrictions via a crafted name...

CVE-2017-12064

The CVE-2017-12064 vulnerability affects OpenEMR 5.0.0 and earlier, arising from the csv_log_html function in library/edihistory/edih_csv_inc.php. Attackers can bypass access restrictions using a specially crafted name, exposing restricted information. Public sources in the connected documents co...

PT-2017-12329

Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.0 and prior Description The issue allows attackers to bypass intended access restrictions. This is achieved via a crafted name in the csv log html function, located in the library/edihistory/edih csv inc.php file...

CVE-2017-12064: Improper Encoding or Escaping of Output

The csvloghtml function in library/edihistory/edihcsvinc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restrictions via a crafted name...

OpenEMR Arbitrary Code Execution Vulnerability

OpenEMR is an open source medical management system maintained by the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. An arbitrary code execution vulnerability vulnerability exists in OpenEMR...

Code injection

OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within the context of the vulnerable application...

CVE-2017-9380

OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within the context of the vulnerable application...

CVE-2017-9380

OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within the context of the vulnerable application...