CVE-2019-12741

The CVE-2019-12741 issue is an XSS in the HAPI FHIR testpage overlay module of the HAPI FHIR library (pre-3.8.0). Unsanitized HTTP parameters are echoed in a form page, enabling leakage of cookies and other sensitive data from ca/uhn/fhir/to/BaseController.java via a crafted URL. Impact is limite...

CVE-2021-32053

CVE-2021-32053 affects HAPI FHIR’s JPA Server prior to 5.4.0. The issue allows denial of service through history requests: a SELECT COUNT triggers a full index scan, consuming server resources and potentially disabling access to the database when many concurrent history operations occur. Connecte...