CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-1000020
https://notcve.org/view.php?id=CVE-2018-1000020
09 Feb 2018 — OpenEMR version 5.0.0 contains a Cross Site Scripting (XSS) vulnerability in open-flash-chart.swf and _posteddata.php that can result in . This vulnerability appears to have been fixed in 5.0.0 Patch 2 or higher. OpenEMR 5.0.0 contiene una vulnerabilidad de Cross Site Scripting (XSS) en open-flash-chart.swf y _posteddata.php. Parece ser que la vulnerabilidad se ha solucionado en la versión 5.0.0 Patch 2 y siguientes. • http://www.open-emr.org/wiki/index.php/OpenEMR_Patches • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2018-1000019
https://notcve.org/view.php?id=CVE-2018-1000019
09 Feb 2018 — OpenEMR version 5.0.0 contains a OS Command Injection vulnerability in fax_dispatch.php that can result in OS command injection by an authenticated attacker with any role. This vulnerability appears to have been fixed in 5.0.0 Patch 2 or higher. OpenEMR 5.0.0 contiene una vulnerabilidad de inyección de comandos del sistema operativo en fax_dispatch.php que puede resultar en la inyección de comandos del sistema operativo por parte de un atacante autenticado con cualquier rol. Parece ser que la vulnerabilidad... • http://www.open-emr.org/wiki/index.php/OpenEMR_Patches • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000241
https://notcve.org/view.php?id=CVE-2017-1000241
17 Nov 2017 — The application OpenEMR version 5.0.0, 5.0.1-dev and prior is affected by vertical privilege escalation vulnerability. This vulnerability can allow an authenticated non-administrator users to view and modify information only accessible to administrators. La aplicación OpenEMR en versiones 5.0.0, 5.0.1-dev y anteriores se ve afectada por una vulnerabilidad de escalado vertical de privilegios. Esta vulnerabilidad puede permitir que los usuarios no administradores autenticados visualicen y modifiquen informaci... • https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-004 • CWE-269: Improper Privilege Management •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000240
https://notcve.org/view.php?id=CVE-2017-1000240
17 Nov 2017 — The application OpenEMR is affected by multiple reflected & stored Cross-Site Scripting (XSS) vulnerabilities affecting version 5.0.0 and prior versions. These vulnerabilities could allow remote authenticated attackers to inject arbitrary web script or HTML. La aplicación OpenEMR se ve afectada por múltiples vulnerabilidades de Cross-Site Scripting (XSS) reflejado que afectan a las versiones 5.0.0 y anteriores. Estas vulnerabilidades podrían permitir que atacantes remotos autenticados inyecten scripts web o... • https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-001 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2017-16540
https://notcve.org/view.php?id=CVE-2017-16540
04 Nov 2017 — OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter. OpenEMR en versiones anteriores a la 5.0.0 Patch 5 permite la copia remota sin autenticar de bases de datos debido a que setup.php expone la funcionalidad de clonado para un sitio OpenEMR existente a un servidor arbitrario controlado por el atacante, mediante v... • http://www.open-emr.org/wiki/index.php/OpenEMR_Patches • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12064
https://notcve.org/view.php?id=CVE-2017-12064
01 Aug 2017 — The csv_log_html function in library/edihistory/edih_csv_inc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restrictions via a crafted name. La función csv_log_html en library/edihistory/edih_csv_inc.php en OpenEMR 5.0.0 y anteriores permite a los atacantes evadir las restricciones de acceso mediante un nombre manipulado. • https://github.com/openemr/openemr/commit/b8963a5ca483211ed8de71f18227a0e66a2582ad • CWE-116: Improper Encoding or Escaping of Output •
CVSS: 8.8EPSS: 2%CPEs: 1EXPL: 4CVE-2017-9380 – OpenEMR 5.0.0 - Remote Code Execution (Authenticated)
https://notcve.org/view.php?id=CVE-2017-9380
02 Jun 2017 — OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within the context of the vulnerable application. OpenEMR versión 5.0.0 y anteriores, permite a los usuarios poco privilegiados cargar archivos de tipos peligrosos, lo que puede resultar en la ejecución de código arbitraria en el contexto de la aplicación vulnerable. • https://packetstorm.news/files/id/163087 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-6394
https://notcve.org/view.php?id=CVE-2017-6394
02 Mar 2017 — Multiple Cross-Site Scripting (XSS) issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to the "openemr-master/gacl/admin/object_search.php" URL (section_value; src_form). An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. Se ha descubierto un problema en OpenEMR 5.0.1-dev. La vulnerabilidad existe debido a filtración insuficiente de datos suministrados por el... • http://www.securityfocus.com/bid/96539 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 21%CPEs: 10EXPL: 0CVE-2015-4453 – OpenEMR 4.2.0 Authentication Bypass
https://notcve.org/view.php?id=CVE-2015-4453
19 Jun 2015 — interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by (1) interface/fax/fax_dispatch_newpid.php and (2) interface/billing/sl_eob_search.php. interface/globals.php en OpenEMR 2.x, 3.x y 4.x en versiones anteriores a 4.2.0 patch 2 permite a atacantes remotos eludir la autenticación y obtener información sensible a través de un valor ignoreAuth=1 a... • http://jvn.jp/en/jp/JVN22677713/index.html • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 5CVE-2014-5462 – OpenEMR 4.1.2 - Multiple SQL Injections
https://notcve.org/view.php?id=CVE-2014-5462
05 Dec 2014 — Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 (Patch 7) and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) layout_id parameter to interface/super/edit_layout.php; (2) form_patient_id, (3) form_drug_name, or (4) form_lot_number parameter to interface/reports/prescriptions_report.php; (5) payment_id parameter to interface/billing/edit_payment.php; (6) id parameter to interface/forms_admin/forms_admin.php; (7) form_pid or (8) form_encounter parameter to interfa... • https://packetstorm.news/files/id/129403 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •