Vulnerabilities

TI-2023-15364 CVE-2023-32060

Improper access control in dhis2-core

LOW 29

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00515 Published 2023-05-09 Fixed in 2.36.13, 2.37.8 +1 CWE-284

TI-2023-14849 CVE-2023-31139

DHIS2 Core unrestricted session cookies with Personal Access Tokens

LOW 34

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00629 Published 2023-05-09 Fixed in 2.37.9.1, 2.38.3.1 +1 CWE-613

TI-2023-14848 CVE-2023-31138

DHIS2 Core vulnerable to Improper Access Control with PATCH requests

LOW 32

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00609 Published 2023-05-09 Fixed in 2.37.9.1, 2.38.3.1 +1 CWE-284

TI-2022-20288 CVE-2022-41947

Cross-site Scripting with user-uploaded files in dhis2-core

LOW 25

DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0038 Published 2022-12-08 Fixed in 2.36.12.1, 2.37.8.1 +2 CWE-79

TI-2022-20289 CVE-2022-41948

Privilege Chaining with the user admin role in dhis2-core

LOW 35

DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0064 Published 2022-12-08 Fixed in 2.36.12.1, 2.37.8.1 +2 CWE-269

TI-2022-20290 CVE-2022-41949

Semi-blind Server-Side Request Forgery in dhis2-core

LOW 23

DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00434 Published 2022-12-08 Fixed in 2.36.12.1, 2.37.8.1 +2 CWE-918

TI-2022-08660 CVE-2022-24848

SQL Injection in DHIS2's in OrgUnit program association

MEDIUM 42

DHIS2 is an information system for data capture, management, validation, analytics and visualization.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01164 Published 2022-06-01 No fix listed CWE-89

TI-2021-18026 CVE-2021-41187

SQL Injection in DHIS2 Tracker API

MEDIUM 40

DHIS 2 is an information system for data capture, management, validation, analytics and visualization.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00854 Published 2021-11-01 Fixed in 2.32-EOS, 2.33-EOS +3 CWE-89

TI-2021-16565 CVE-2021-39179

SQL Injection in DHIS2 Tracker API

MEDIUM 42

DHIS 2 is an information system for data capture, management, validation, analytics and visualization.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0192 Published 2021-10-29 Fixed in 2.34.7, 2.35.7 +1 CWE-89

TI-2021-12372 CVE-2021-32704

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-core

LOW 39

DHIS 2 is an information system for data capture, management, validation, analytics and visualization.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00769 Published 2021-06-24 Fixed in 2.34.5, 2.35.5 +1 CWE-89

Vulnerabilities

Filters