OpenEMR Access Restriction Bypass Vulnerability (CNVD-2018-10222)

OpenEMR is an open source medical management system maintained by the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A security vulnerability exists in the interface/patientfile/letter.php...

CVE-2018-10572

interface/patientfile/letter.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the newtemplatename and formbody parameters...

CVE-2018-10572

interface/patientfile/letter.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the newtemplatename and formbody parameters...

Design/Logic Flaw

interface/patientfile/letter.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the newtemplatename and formbody parameters...

CVE-2018-10571

Multiple reflected cross-site scripting XSS vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 patient parameter to interface/main/finder/findernavigation.php; 2 key parameter to interface/billing/getclaimfile.php; 3 formid or 4 formseq...

CVE-2018-10573

interface/fax/faxdispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the scan parameter...

CVE-2018-10573

interface/fax/faxdispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the scan parameter...

Cross site scripting

Multiple reflected cross-site scripting XSS vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 patient parameter to interface/main/finder/findernavigation.php; 2 key parameter to interface/billing/getclaimfile.php; 3 formid or 4 formseq...

Design/Logic Flaw

interface/fax/faxdispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the scan parameter...

CVE-2018-10571

Multiple reflected cross-site scripting XSS vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 patient parameter to interface/main/finder/findernavigation.php; 2 key parameter to interface/billing/getclaimfile.php; 3 formid or 4 formseq...

CVE-2018-10571

CVE-2018-10571 covers multiple reflected XSS vulnerabilities in OpenEMR prior to version 5.0.1 . The issues allow remote attackers to inject arbitrary scripts/HTML via a long list of parameters across various endpoints (e.g., finder_navigation.php, get_claim_file.php, sl_eob_*.php, find_code_popu...

CVE-2018-10573

OpenEMR before 5.0.1 is vulnerable in interfaces/fax/fax_dispatch.php: remote authenticated users can bypass access restrictions via the scan parameter. Affected software is OpenEMR prior to 5.0.1; exploitation would require authenticated access. Impact includes bypassing authorization controls (...

CVE-2018-10572

OpenEMR

CVE-2018-10572

interface/patientfile/letter.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the newtemplatename and formbody parameters...

CVE-2018-10573

interface/fax/faxdispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the scan parameter...

CVE-2018-10571

Multiple reflected cross-site scripting XSS vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 patient parameter to interface/main/finder/findernavigation.php; 2 key parameter to interface/billing/getclaimfile.php; 3 formid or 4 formseq...

OpenEMR <= 5.0.0 Multiple Vulnerabilities - Active Check

OpenEMR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:open-emr:openemr"; ifdescription...

OpenEMR open-flash-chart.swf and _posteddata.php files cross-site scripting vulnerability

OpenEMR is an open source medical management system maintained by the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A cross-site scripting vulnerability exists in the open-flash-chart.swf a...

OpenEMR fax_dispatch.php file OS command injection vulnerability

OpenEMR is an open source medical management system maintained by the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. An operating system command injection vulnerability exists in the...

CVE-2018-1000020

OpenEMR version 5.0.0 contains a Cross Site Scripting XSS vulnerability in open-flash-chart.swf and posteddata.php that can result in . This vulnerability appears to have been fixed in 5.0.0 Patch 2 or higher...