CVE-2023-40279 | High | 7.5 | 2024-03-19 | An issue was discovered in OpenClinic GA 5.247.01. An attacker can perform a directory path traversal via the Page parameter in a GET request to main.do. |
CVE-2023-40278 | High | 7.5 | 2024-03-19 | An issue was discovered in OpenClinic GA 5.247.01. An Information Disclosure vulnerability has been identified in the printAppointmentPdf.jsp component of Open… |
CVE-2023-40280 | High | 7.5 | 2024-03-19 | An issue was discovered in OpenClinic GA 5.247.01. An attacker can perform a directory path traversal via the Page parameter in a GET request to popup.jsp. |
CVE-2023-40277 | Medium | 6.1 | 2024-03-19 | An issue was discovered in OpenClinic GA 5.247.01. A Reflected Cross-Site Scripting (XSS) vulnerability has been discovered in the login.jsp message parameter. |
CVE-2023-40276 | Critical | 9.1 | 2024-03-19 | An issue was discovered in OpenClinic GA 5.247.01. An Unauthenticated File Download vulnerability has been discovered in pharmacy/exportFile.jsp. |
CVE-2023-40275 | Critical | 9.1 | 2024-03-19 | An issue was discovered in OpenClinic GA 5.247.01. It allows retrieval of patient lists via queries such as findFirstname= to _common/search/searchByAjax/patie… |
CVE-2021-37364 | High | 7.8 | 2021-10-26 | OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has the modify permission to openclinic folders/files. A l… |
CVE-2020-27246 | High | 8.8 | 2021-05-11 | An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoComment parameter in the ‘listImmo… |
CVE-2020-27245 | High | 8.8 | 2021-05-11 | An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoBuyer parameter in the ‘listImmoLa… |
CVE-2020-27244 | High | 8.8 | 2021-05-11 | An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoCode parameter in the ‘listImmoLab… |
CVE-2020-27243 | High | 8.8 | 2021-05-11 | An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoService parameter in the ‘listImmo… |
CVE-2020-27242 | High | 8.8 | 2021-05-11 | An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoLocation parameter in the ‘listImm… |
CVE-2020-27232 | High | 8.8 | 2021-05-10 | An exploitable SQL injection vulnerability exists in ‘manageServiceStocks.jsp’ page of OpenClinic GA 5.173.3. A specially crafted HTTP request can lead to SQL… |
CVE-2020-27231 | High | 8.8 | 2021-05-10 | A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. The findDistrict parameter in ‘‘pa… |
CVE-2020-27230 | High | 8.8 | 2021-05-10 | A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. The findSector parameter in ‘‘pati… |
CVE-2020-27229 | High | 8.8 | 2021-05-10 | A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. The findPersonID parameter in ‘‘pa… |
CVE-2020-27226 | High | 8.8 | 2021-05-10 | An exploitable SQL injection vulnerability exists in ‘quickFile.jsp’ page of OpenClinic GA 5.173.3. A specially crafted HTTP request can lead to SQL injection… |
CVE-2020-27241 | Critical | 9.8 | 2021-04-19 | An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The serialnumber parameter in the getAssets.jsp page is vul… |
CVE-2020-27240 | Critical | 9.8 | 2021-04-19 | An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The componentStatus parameter in the getAssets.jsp page is… |
CVE-2020-27239 | Critical | 9.8 | 2021-04-15 | An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The assetStatus parameter in the getAssets.jsp page is vuln… |
CVE-2020-27238 | Critical | 9.8 | 2021-04-15 | An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The code parameter in the getAssets.jsp page is vulnerable… |
CVE-2020-27237 | Critical | 9.8 | 2021-04-15 | An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3. The code parameter in the The nomenclature parameter in the… |
CVE-2020-27236 | Critical | 9.8 | 2021-04-13 | An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the compnomenclature parameter. An attacker can make an a… |
CVE-2020-27235 | Critical | 9.8 | 2021-04-13 | An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the description parameter. An attacker can make an authen… |
CVE-2020-27234 | Critical | 9.8 | 2021-04-13 | An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID parameter. An attacker can make an authent… |
CVE-2020-27233 | Critical | 9.8 | 2021-04-13 | An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter. An attacker can make an authen… |
CVE-2020-27228 | High | 7.8 | 2021-04-13 | An incorrect default permissions vulnerability exists in the installation functionality of OpenClinic GA 5.173.3. Overwriting the binary can result in privileg… |
CVE-2020-27227 | Critical | 9.8 | 2021-04-13 | An exploitable unatuhenticated command injection exists in the OpenClinic GA 5.173.3. Specially crafted web requests can cause commands to be executed on the s… |
CVE-2020-14486 | Medium | 6.3 | 2020-07-29 | An attacker may bypass permission/authorization checks in OpenClinic GA 5.09.02 and 5.89.05b by ignoring the redirect of a permission failure, which may allow… |
CVE-2020-14493 | High | 8.8 | 2020-07-29 | A low-privilege user may use SQL syntax to write arbitrary files to the OpenClinic GA 5.09.02 and 5.89.05b server, which may allow the execution of arbitrary c… |
CVE-2020-14492 | Medium | 5.4 | 2020-07-29 | OpenClinic GA 5.09.02 and 5.89.05b does not properly neutralize user-controllable input, which may allow the execution of malicious code within the user’s brow… |
CVE-2020-14490 | High | 8.8 | 2020-07-29 | OpenClinic GA 5.09.02 and 5.89.05b includes arbitrary local files specified within its parameter and executes some files, which may allow disclosure of sensiti… |
CVE-2020-14489 | Medium | 6.2 | 2020-07-29 | OpenClinic GA 5.09.02 and 5.89.05b stores passwords using inadequate hashing complexity, which may allow an attacker to recover passwords using known password… |
CVE-2020-14494 | Critical | 9.8 | 2020-07-20 | OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexity to protect agains… |
CVE-2020-14491 | Medium | 6.5 | 2020-07-20 | OpenClinic GA versions 5.09.02 and 5.89.05b do not properly check permissions before executing SQL queries, which may allow a low-privilege user to access priv… |
CVE-2020-14485 | Critical | 9.8 | 2020-07-20 | OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass client-side access controls or use a crafted request to initiate a session with lim… |
CVE-2020-14484 | Critical | 9.8 | 2020-07-20 | OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass the system’s account lockout protection, which may allow brute force password attac… |