Filtered by vendor Apperta Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-40375 1 Apperta 1 Openeyes 2024-11-21 6.5 Medium
Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level of privilege. Despite OpenEyes returning a Forbidden error message, the contents of a patient's profile are still returned in the server response. This response can be read in an intercepting proxy or by viewing the page source. Sensitive information returned in responses includes patient PII and medication records or history.
CVE-2021-40374 1 Apperta 1 Openeye 2024-11-21 5.4 Medium
A stored cross-site scripting (XSS) vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patient's details allows remote attackers to inject arbitrary web script or HTML via the Address1 parameter. This JavaScript then executes when the patient profile is loaded, which could be used in a XSS attack.