Read the docs

Openclinic Ga Project

Records37All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical15CVSS 9.0–10.0
CVSS high19CVSS 7.0–8.9

Exploited now

Openclinic Ga Project records in CISA KEV

No Openclinic Ga Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Openclinic Ga 37 records HIGH

Records

37 records

TI-2020-16553 CVE-2020-27227 · GHSA-2m4j-6gvx-869p

Command injection in OpenClinic

Priority MEDIUM 47

An exploitable unatuhenticated command injection exists in the OpenClinic GA 5.173.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02894 Published 2021-04-13 No fix listed CWE-77
TI-2020-11337 CVE-2020-14485 · GHSA-x83r-934g-7qwg

Authentication bypass in OpenClinic GA

Priority MEDIUM 47

OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass client-side access controls or use a crafted request to initiate a session with limited functionality, which may allow execution of admin functi…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02545 Published 2020-07-20 No fix listed CWE-288
TI-2020-11346 CVE-2020-14494 · GHSA-xh8j-8x8h-3f2m

Improper authentication in OpenClinic GA

Priority MEDIUM 45

OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexity to protect against brute force attacks, which may allow unauthorized users to…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01307 Published 2020-07-20 No fix listed CWE-287
TI-2020-11336 CVE-2020-14484 · GHSA-rvw9-j33j-fm5j

Missing brute-force protection in OpenClinic GA

Priority MEDIUM 45

OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass the system’s account lockout protection, which may allow brute force password attacks.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01244 Published 2020-07-20 No fix listed CWE-307
TI-2020-16567 CVE-2020-27241 · GHSA-38mm-h2h2-77mm

SQL injection in OpenClinic

Priority MEDIUM 44

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00866 Published 2021-04-19 No fix listed CWE-89
TI-2020-16566 CVE-2020-27240 · GHSA-j7x2-649w-mxwh

SQL injection in OpenClinic

Priority MEDIUM 44

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00866 Published 2021-04-19 No fix listed CWE-89
TI-2020-16565 CVE-2020-27239 · GHSA-f896-64x6-54qp

SQL injection in OpenClinic

Priority MEDIUM 44

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00897 Published 2021-04-15 No fix listed CWE-89
TI-2020-16564 CVE-2020-27238 · GHSA-pqww-9fvq-hf8c

SQL injection in OpenClinic

Priority MEDIUM 44

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00897 Published 2021-04-15 No fix listed CWE-89
TI-2020-16563 CVE-2020-27237 · GHSA-fjh4-c964-7cc5

SQL injection in OpenClinic

Priority MEDIUM 44

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00897 Published 2021-04-15 No fix listed CWE-89
TI-2020-16562 CVE-2020-27236 · GHSA-qf52-pvgg-vmm3

SQL injection in OpenClinic

Priority MEDIUM 44

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the compnomenclature parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00908 Published 2021-04-13 No fix listed CWE-89
TI-2020-16561 CVE-2020-27235 · GHSA-g9wx-8wph-hmgw

SQL injection in OpenClinic

Priority MEDIUM 44

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the description parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00908 Published 2021-04-13 No fix listed CWE-89
TI-2020-16560 CVE-2020-27234 · GHSA-fw6q-gw8w-464v

SQL injection in OpenClinic

Priority MEDIUM 44

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00908 Published 2021-04-13 No fix listed CWE-89
TI-2020-16559 CVE-2020-27233 · GHSA-cp6g-8qmw-2h69

SQL injection in OpenClinic

Priority MEDIUM 44

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00908 Published 2021-04-13 No fix listed CWE-89
TI-2020-11342 CVE-2020-14490 · GHSA-p38c-f9r4-phgg

Path traversal in OpenClinic GA

Priority MEDIUM 43

OpenClinic GA 5.09.02 and 5.89.05b includes arbitrary local files specified within its parameter and executes some files, which may allow disclosure of sensitive files or the execution of malicious uploaded files.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02458 Published 2020-07-29 No fix listed CWE-22
TI-2020-11345 CVE-2020-14493 · GHSA-f9hx-r2xv-24c7

Improper privilege management in OpenClinic GA

Priority MEDIUM 41

A low-privilege user may use SQL syntax to write arbitrary files to the OpenClinic GA 5.09.02 and 5.89.05b server, which may allow the execution of arbitrary commands.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01684 Published 2020-07-29 No fix listed CWE-250
TI-2020-11338 CVE-2020-14486 · GHSA-457v-px4g-7qcg

Improper authorization in OpenClinic GA

Priority MEDIUM 41

An attacker may bypass permission/authorization checks in OpenClinic GA 5.09.02 and 5.89.05b by ignoring the redirect of a permission failure, which may allow unauthorized execution of commands.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0128 Published 2020-07-29 No fix listed CWE-285
TI-2020-16572 CVE-2020-27246 · GHSA-qgpp-26ch-wf83

SQL injection in OpenClinic GA

Priority MEDIUM 40

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00806 Published 2021-05-11 No fix listed CWE-89
TI-2020-16571 CVE-2020-27245 · GHSA-vpgm-r2pm-mcv7

SQL injection in OpenClinic GA

Priority MEDIUM 40

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00806 Published 2021-05-11 No fix listed CWE-89
TI-2020-16570 CVE-2020-27244 · GHSA-gfh5-jm3w-g7pr

SQL injection in OpenClinic GA

Priority MEDIUM 40

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00806 Published 2021-05-11 No fix listed CWE-89
Load more
Open these records in search →