Xxe

An XML External Entity XXE vulnerability exists in HTML Form Entry 3.7.0, as distributed in OpenMRS Reference Application 2.8.0...

CVE-2018-16521

An XML External Entity XXE vulnerability exists in HTML Form Entry 3.7.0, as distributed in OpenMRS Reference Application 2.8.0...

CVE-2018-16521

An XML External Entity XXE vulnerability exists in HTML Form Entry 3.7.0, as distributed in OpenMRS Reference Application 2.8.0...

CVE-2018-16521

The CVE-2018-16521 entry describes an XML External Entity (XXE) vulnerability affecting OpenMRS HTML Form Entry 3.7.0 as distributed in OpenMRS Reference Application 2.8.0. The connected records confirm the affected software and the XXE root cause but do not provide additional exploit details, af...

The vulnerability of the Reporting Compatibility Add-On module of the OpenMRS Reference Application, which allows a violator to execute arbitrary code.

The vulnerability of the Reporting Compatibility Add-On module of the OpenMRS Reference Application, which is used for working with medical records, stems from the lack of an authentication process during deserialization of XML files into ReportSchema objects. Exploiting this vulnerability allows...

CVE-2017-12796

The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system...

CVE-2017-12796

The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system...

CVE-2017-12796

The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system...

Cross site request forgery (csrf)

The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system...

CVE-2017-12796

The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system...

CVE-2017-12796

The CVE-2017-12796 issue affects the OpenMRS Reporting Compatibility Add On prior to 2.0.4 (distributed in the OpenMRS Reference Application prior to 2.6.1). It does not authenticate users during XML deserialization into ReportSchema objects, allowing remote unauthenticated users to execute opera...

OpenMRS Remote Command Execution Vulnerability

OpenMRS Reference Application is a suite of open source EHR applications.Reporting Compatibility Add On is one of the compatibility reporting components. A remote command execution vulnerability exists in OpenMRS, which is caused by the application failing to authenticate the user when...

OpenMRS Reporting Module Cross-Site Request Forgery Vulnerability

OpenMRS is a collaborative open source project to develop software to support healthcare services in developing countries.Reporting Module is designed to provide a feature-rich and user-friendly web interface for managing reports in OpenMRS. A cross-site request forgery vulnerability exists in...

CVE-2017-7990

The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a name field in webapp/reports/manageReports.jsp...

CVE-2017-7990

The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a name field in webapp/reports/manageReports.jsp...

Cross site request forgery (csrf)

The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a name field in webapp/reports/manageReports.jsp...

CVE-2017-7990

The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS, in which administrative authentication is hijacked to insert JavaScript into a name field in webapp/reports/manageReports.jsp...

CVE-2017-7990

The CVE-2017-7990 entry involves the OpenMRS Reporting Module 1.12.0, where a CSRF vulnerability can be abused to perform cross-site scripting. An attacker could hijack an administrative session to inject JavaScript into the name field in webapp/reports/manageReports.jsp, yielding XSS. The affect...

OpenMRS Reporting Module 0.9.7 RCE

Remote command execution vulnerability in OpenMRS Reporting Module Vulnerability Type: Remote Command Execution For the exploit source code contact DSquare Security sales team...

OpenMRS Reporting Module 0.9.7 - Remote Code Execution

Title: Unauthenticated remote code execution in OpenMRS Product: OpenMRS Vendor: OpenMRS Inc. Tested versions: See summary Status: Fixed by vendor Reported by: Brian D. Hysell Product description: OpenMRS is "the world's leading open source enterprise electronic medical record system platform."...