Page 20 of 106 results (0.003 seconds)

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2018-15144

https://notcve.org/view.php?id=CVE-2018-15144

SQL injection vulnerability in interface/de_identification_forms/find_drug_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the search_term parameter. Vulnerabilidad de inyección SQL en interface/de_identification_forms/find_drug_popup.php en versiones de OpenEMR anteriores a la 5.0.1.4 permite que un atacante remoto autenticado ejecute comandos SQL mediante el parámetro search_term. • https://github.com/openemr/openemr/pull/1757/files https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1

CVE-2018-15141 – OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions

https://notcve.org/view.php?id=CVE-2018-15141

Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to delete arbitrary files via the "docid" parameter when the mode is set to delete. Salto de directorio en portal/import_template.php en versiones de OpenEMR anteriores a la 5.0.1.4 permite que un atacante remoto autenticado en el portal patient borre archivos arbitrarios mediante el parámetro "docid" cuando el modo está configurado en delete. OpenEMR version 5.0.1.3 suffers from arbitrary file read, write, and delete vulnerabilities. • https://www.exploit-db.com/exploits/45202 https://github.com/openemr/openemr/pull/1765/files https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1

CVE-2018-15140 – OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions

https://notcve.org/view.php?id=CVE-2018-15140

Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to read arbitrary files via the "docid" parameter when the mode is set to get. Salto de directorio en portal/import_template.php en versiones de OpenEMR anteriores a la 5.0.1.4 permite que un atacante remoto autenticado en el portal patient lea archivos arbitrarios mediante el parámetro "docid" cuando el modo está configurado en get. OpenEMR version 5.0.1.3 suffers from arbitrary file read, write, and delete vulnerabilities. • https://www.exploit-db.com/exploits/45202 https://github.com/openemr/openemr/pull/1765/files https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2018-15143

https://notcve.org/view.php?id=CVE-2018-15143

Multiple SQL injection vulnerabilities in portal/find_appt_popup_user.php in versions of OpenEMR before 5.0.1.4 allow a remote attacker to execute arbitrary SQL commands via the (1) catid or (2) providerid parameter. Múltiples vulnerabilidades de inyección SQL en portal/find_appt_popup_user.php en versiones de OpenEMR anteriores a la 5.0.1.4 permiten que un atacante remoto ejecute comandos SQL mediante los parámetros (1) catid o (2) providerid. • https://github.com/openemr/openemr/pull/1758/files https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2018-15142 – OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions

https://notcve.org/view.php?id=CVE-2018-15142

Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to execute arbitrary PHP code by writing a file with a PHP extension via the "docid" and "content" parameters and accessing it in the traversed directory. Salto de directorio en portal/import_template.php en versiones de OpenEMR anteriores a la 5.0.1.4 permite que un atacante autenticado remoto ejecute código PHP arbitrario escribiendo un archivo con una extensión PHP mediante los parámetros "docid" y "content" y accediendo a él en el directorio saltado. OpenEMR version 5.0.1.3 suffers from arbitrary file read, write, and delete vulnerabilities. • https://www.exploit-db.com/exploits/45202 https://github.com/openemr/openemr/pull/1765/files https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •