PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

LibreHealth Version 2.0.0

bishopfox.com | vulnerability | #sql-injection | #vulnerability | #advisory | #csrf | #healthcare | #lfi | #ehr
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A Bishop Fox advisory on five high-risk vulnerabilities in LibreHealth EHR 2.0.0, including LFI, SQL injection, XSS and CSRF, which could expose medical records and PII.
Published
Collected

Related coverage

research · slcyber.io
Advisory: Flarum LFI - CVE-2023-40033
# Advisory: Flarum LFI - CVE-2023-40033 Get research alerts Share on social August 28, 2023 1 min read ### Table of Contents TOC Element Summary Impact Affected Software Product Description...
blog · netspi.com
Security and Privacy Considerations in "Meaningful Use"
HIMSS buzzed about "Meaningful Use" requirements for EHR stimulus funds, tying eligibility to HIPAA compliance and risk assessments that must cover all PHI-handling apps and devices, not just EMRs.
vulnerability · bishopfox.com
Zamzar API Advisory
A Bishop Fox advisory on an SSRF flaw in the Zamzar file-conversion API: malicious XML in an ODT file let attackers read remote and local objects, achieving file inclusion as root.
vulnerability · bishopfox.com
Oracle WebLogic Node Manager allows arbitrary configuration via UNC path
Bishop Fox advisory: WebLogic Node Manager 10.3.3 and earlier let unauthenticated attackers redirect its config and password files to an attacker-controlled UNC path, then run commands; fixed in 2011.
vulnerability · portswigger.net
On-site request forgery
Stored on-site request forgery works even where XSS is blocked: controlling part of an image URL forces arbitrary on-site GET requests, e.g. creating a backdoor when an admin views the page.
vulnerability · portswigger.net
Exploiting XSS in POST requests
Reflected XSS reachable only via POST is exploitable: an attacker page auto-submits a crafted form cross-domain, CSRF-style, and the payload runs inside the vulnerable application's security context.
Back