Open Source Vulnerabilities
OpenEMR: Unauthenticated Open Redirect via OIDC End Session Endpoint
OpenEMR: Unauthenticated Open Redirect via OIDC End Session Endpoint
OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)
OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)
OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory
OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory
OpenEMR: Missing authorization on QRDA Category I/III download endpoints
OpenEMR: Missing authorization on QRDA Category I/III download endpoints
org.springframework:spring-expression, org.springframework:spring-web
TuxCare security update for org.springframework (2 CVEs)
org.springframework:spring-expression/ org.springframework:spring-web
TuxCare security update for org.springframework (2 CVEs)
OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration
OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration
OpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstall
OpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstall
OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attribute
OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attribute
OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth
OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth
OpenEMR: Arbitrary Patient Recall and Contact Detail Read
OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operations
OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operations
OpenEMR: Patient Data Search Without Sufficient ACL
OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHI
OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHI
org.springframework:spring-web
TuxCare security update for org.springframework:spring-web (1 CVE)
org.springframework:spring-web
TuxCare security update for org.springframework:spring-web (1 CVE)
OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot
OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot
org.springframework:spring-web, org.springframework:spring-webflux, org.springframework:spring-webmvc
TuxCare security update for org.springframework (2 CVEs)
org.springframework:spring-web/ org.springframework:spring-webflux/ org.springframework:spring-webmvc
TuxCare security update for org.springframework (2 CVEs)
FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling
FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling
FreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery data
FreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery data
FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY
FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY
FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding
FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding
org.springframework:spring-web
TuxCare security update for org.springframework:spring-web (1 CVE)
org.springframework:spring-web
TuxCare security update for org.springframework:spring-web (1 CVE)
FreeSWITCH: Heap out-of-bounds read in FreeSWITCH core variable expansion via `${variable:offset}` slicing
FreeSWITCH: Heap out-of-bounds read in FreeSWITCH core variable expansion via `${variable:offset}` slicing
FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing
FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands
FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands
FreeSWITCH: DTLS-SRTP peer certificate is not bound to the SDP fingerprint when FreeSWITCH is the DTLS server
FreeSWITCH: DTLS-SRTP peer certificate is not bound to the SDP fingerprint when FreeSWITCH is the DTLS server
FreeSWITCH: Pre-authentication out-of-bounds writes in mod_xml_rpc WebSocket frame parsing
FreeSWITCH: Pre-authentication out-of-bounds writes in mod_xml_rpc WebSocket frame parsing
FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling
FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling
FreeSWITCH: Channel-variable injection via SIP REFER leads to command execution in mod_sofia
FreeSWITCH: Channel-variable injection via SIP REFER leads to command execution in mod_sofia
FreeSWITCH: Pre-authentication process termination in the Event Socket via an unbounded Content-Length
FreeSWITCH: Pre-authentication process termination in the Event Socket via an unbounded Content-Length
FreeSWITCH: Pre-authentication stack buffer overflow in mod_rtmp control-message handling
FreeSWITCH: Pre-authentication stack buffer overflow in mod_rtmp control-message handling
FreeSWITCH: Stack buffer overflow in mod_rtmp AVC sequence-header construction
FreeSWITCH: Stack buffer overflow in mod_rtmp AVC sequence-header construction
FreeSWITCH: Pre-authentication stack buffer overflow in mod_xml_rpc HTTP directory authentication
FreeSWITCH: Pre-authentication stack buffer overflow in mod_xml_rpc HTTP directory authentication
FreeSWITCH: Pre-authentication out-of-bounds write in MSRP message body parsing
FreeSWITCH: Pre-authentication out-of-bounds write in MSRP message body parsing
org.springframework:spring-expression, org.springframework:spring-web, org.springframework:spring-webmvc
TuxCare security update for org.springframework (3 CVEs)
org.springframework:spring-expression/ org.springframework:spring-web/ org.springframework:spring-webmvc
TuxCare security update for org.springframework (3 CVEs)
FreeSWITCH: Out-of-bounds read in mod_rtmp H.264 video message parsing
FreeSWITCH: Out-of-bounds read in mod_rtmp H.264 video message parsing
FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP Contact display-name
FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP Contact display-name
