CVE-2021-40375

CVE-2021-40375 - Broken Access Control in OpenEyes 3.5.1 Description An improper access control vulnerability was identified in OpenEyes 3.5.1, developed by the Apperta Foundation. A low privileged user could load a patient's profile in their browser and access sensitive information without the...

CVE-2021-40374

CVE-2021-40374 - Stored Cross-site Scripting in OpenEyes 3.5.1 Description A stored cross-site scripting XSS vulnerability was identified in OpenEyes 3.5.1, developed by the Apperta Foundation. Improper input handling in the 'Address1' parameter allowed for JavaScript to be injected into a patien...

EUVD-2021-27551

Malicious code in bioql PyPI...

EUVD-2021-27552

Malicious code in bioql PyPI...

CVE-2021-40374

A stored cross-site scripting XSS vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patient's details allows remote attackers to inject arbitrary web script or HTML via the Address1 parameter. This JavaScript then executes when the patient profile is loaded, which coul...

CVE-2021-40375

Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite OpenEyes returning a Forbidden error message, the contents of a patient's profile are still returned in the server response. This respons...

CVE-2021-40375

Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite OpenEyes returning a Forbidden error message, the contents of a patient's profile are still returned in the server response. This respons...

CVE-2021-40375

Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite OpenEyes returning a Forbidden error message, the contents of a patient's profile are still returned in the server response. This respons...

Design/Logic Flaw

Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite OpenEyes returning a Forbidden error message, the contents of a patient's profile are still returned in the server response. This respons...

Cross site scripting

A stored cross-site scripting XSS vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patient's details allows remote attackers to inject arbitrary web script or HTML via the Address1 parameter. This JavaScript then executes when the patient profile is loaded, which coul...

CVE-2021-40375

Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite OpenEyes returning a Forbidden error message, the contents of a patient's profile are still returned in the server response. This respons...

CVE-2021-40375

CVE-2021-40375 affects OpenEyes 3.5.1 (Apperta Foundation). The vulnerability allows remote attackers to view sensitive patient information (PII, medication history) because the server responded with sensitive data in responses despite returning a Forbidden message. Underlying cause and mitigatio...

CVE-2021-40374

A stored cross-site scripting XSS vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patient's details allows remote attackers to inject arbitrary web script or HTML via the Address1 parameter. This JavaScript then executes when the patient profile is loaded, which coul...

CVE-2021-40374

CVE-2021-40374 describe a stored cross-site scripting (XSS) vulnerability in Apperta Foundation OpenEyes 3.5.1. The issue occurs when updating a patient’s details, where an attacker can inject arbitrary web script or HTML into the Address1 parameter. This injected script runs when the patient’s p...

PT-2022-11223

Name of the Vulnerable Software and Affected Versions Apperta Foundation OpenEyes version 3.5.1 Description The issue allows remote attackers to view sensitive patient information without the intended level of privilege. Although OpenEyes returns a Forbidden error message, it still includes the...

CVE-2021-40375: Exposure of Sensitive Information to an Unauthorized Actor

Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite OpenEyes returning a Forbidden error message, the contents of a patient's profile are still returned in the server response. This respons...

CVE-2021-40374: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patient's details allows remote attackers to inject arbitrary web script or HTML via the Address1 parameter. This JavaScript then executes when the patient profile is loaded, which coul...

Apperta Foundation OpenEyes Cross-site Scripting Vulnerability

Apperta Foundation OpenEyes is an open source electronic medical record ERP from the Apperta Foundation. A security vulnerability in Apperta Foundation OpenEyes 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the Address1 parameter...

PT-2022-11222

Name of the Vulnerable Software and Affected Versions Apperta Foundation OpenEyes version 3.5.1 Description A stored cross-site scripting issue was identified, allowing remote attackers to inject arbitrary web script or HTML via the Address1 parameter when updating a patient's details. This...

Apperta Foundation OpenEyes had a data breach vulnerability

Apperta Foundation OpenEyes is an open source electronic medical record ERP from the Apperta Foundation. A security vulnerability exists in Apperta Foundation OpenEyes 3.5.1 that allows remote attackers to view sensitive patient information without the expected privilege level...