CVE-2021-40375

Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite OpenEyes returning a Forbidden error message, the contents of a patient's profile are still returned in the server response. This respons...

CVE-2021-40375

Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite OpenEyes returning a Forbidden error message, the contents of a patient's profile are still returned in the server response. This respons...

Mindoktor: Lack of CSRF in App allows attackers to change patient PII data

Due to the lack of CSRF it's possible for an attacker to change PII data on a user account. The vulnerable endpoint is: https://app.pentestapi.mindoktor.io/api/v1/user/profile A example request: POST /api/v1/user/profile HTTP/1.1 Host: app.pentestapi.mindoktor.io User-Agent: Mozilla/5.0 Macintosh...