Advisories · Technology
CGM CLININET.
Every CVE that names CGM CLININET among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.1 Medium
Reflected Cross-Site Scripting (XSS) in CGM CLININET
- CGM CLININET
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Local Privilege Escalation in CGM CLININET
- CGM CLININET
- Broken access control
- CVSS 6.9 Medium
Missing Authentication in CGM CLININET
- CGM CLININET
- Authentication bypass
- CVSS 8.8 High
Authentication Bypass via IP Spoofing in CGM CLININET rsyncd
- CGM CLININET
- Authentication bypass
- CVSS 6.8 Medium
Insecure File Permissions in CGM CLININET
- CGM CLININET
- Broken access control
- CVSS 9.4 CriticalCritical · CVSS 9+
Remote Code Execution in CGM CLININET
- CGM CLININET
- Code injection
- CVSS 8.2 High
Use of Unsalted MD5 Password Hashes in CGM CLININET
- CGM CLININET
- Weak cryptography or TLS
- CVSS 9.4 CriticalCritical · CVSS 9+
Remote Code Execution via Java Deserialization in CGM CLININET
- CGM CLININET
- Insecure deserialization
- CVSS 9.0 CriticalCritical · CVSS 9+
Remote Code Execution in CGM CLININET
- CGM CLININET
- Privilege escalation
- CVSS 8.6 High
Code Injection in CGM CLININET
- CGM CLININET
- Code injection
- CVSS 7.1 High
Missing Authentication in CGM CLININET
- CGM CLININET
- Authentication bypass
- CVSS 5.3 Medium
Lack of HTTP Response Headers
- CGM CLININET
- CWE-693
- CVSS 5.3 Medium
Lack of protection mechanisms against Clickjacking attacks
- CGM CLININET
- CWE-1021
- CVSS 7.1 High
Insecure Direct Object Reference Message ID
- CGM CLININET
- Broken access control
- CVSS 6.9 Medium
SQL injection in CheckUnitCodeAndKey.pl
- CGM CLININET
- SQL injection
- CVSS 9.4 CriticalCritical · CVSS 9+
RCE on uhcapache user permissions
- CGM CLININET
- Command injection
- CVSS 9.0 CriticalCritical · CVSS 9+
Session generation possible with certificate number only
- CGM CLININET
- CWE-603
- CVSS 9.0 CriticalCritical · CVSS 9+
Lack of API authentication allowing session generation for any user
- CGM CLININET
- Authentication bypass
- CVSS 8.8 High
Possibility to generate a session for any user via the "ex:action" parameter after obtaining access to the JWT key
- CGM CLININET
- Weak cryptography or TLS
- CWE-912
- CVSS 9.4 CriticalCritical · CVSS 9+
Excessive permissions on configuration files containing database logins and passwords
- CGM CLININET
- Broken access control
- CVSS 6.9 Medium
SQL injection in utils/Reporter/OpenReportWindow.pl via the UserID parameter
- CGM CLININET
- SQL injection
- CVSS 6.9 Medium
SQL injection in ReturnUserUnitsXML.pl via the UserID parameter
- CGM CLININET
- SQL injection
- CVSS 6.9 Medium
Authenticated SQL injection in PrepareCDExportJSON.pl
- CGM CLININET
- SQL injection
- CVSS 6.9 Medium
SQL injection in getPatientIdentifier function of PatientService.pl
- CGM CLININET
- SQL injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Authenticated RCE with uhcapache privileges in ConvertToPDF
- CGM CLININET
- Code injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Calling system commands via RunCommand
- CGM CLININET
- Code injection
- CVSS 9.0 CriticalCritical · CVSS 9+
Conditional RCE via the "system" function
- CGM CLININET
- Code injection
- CVSS 5.3 Medium
Unauthenticated access to module configuration endpoint
- CGM CLININET
- Authentication bypass
- CVSS 9.0 CriticalCritical · CVSS 9+
Missing authentication in APIs returning statistical data along with session IDs
- CGM CLININET
- Authentication bypass
- CVSS 9.0 CriticalCritical · CVSS 9+
Missing authentication in API returning request logs containing session IDs
- CGM CLININET
- Authentication bypass
- CVSS 9.0 CriticalCritical · CVSS 9+
Missing authentication in API returning a list of all active sessions
- CGM CLININET
- Authentication bypass
- CVSS 7.3 High
Session ID leakage in Zone.Identifier of downloaded files
- CGM CLININET
- CWE-1230
- CVSS 8.8 High
Missing authentication in APIs allowing data retrieval and modification
- CGM CLININET
- Authentication bypass
- CVSS 8.8 High
Stored XSS permitting session takeover of arbitrary user
- CGM CLININET
- Cross-site scripting (XSS)
- CVSS 9.4 CriticalCritical · CVSS 9+
RCE via Print.pl in uhcPrintServerPrint
- CGM CLININET
- Code injection