Maven package
org.opencrx/opencrx-core-models
pkg:maven/org.opencrx/opencrx-core-models
Vulnerabilities (9)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-40817 | Med | 6.1 | <= 5.2.0 | — | Nov 18, 2023 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field. | |
| CVE-2023-40816 | Med | 6.1 | <= 5.2.0 | — | Nov 18, 2023 | OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field. | |
| CVE-2023-40815 | Med | 6.1 | <= 5.2.0 | — | Nov 18, 2023 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field. | |
| CVE-2023-40814 | Med | 6.1 | <= 5.2.0 | — | Nov 18, 2023 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field. | |
| CVE-2023-40813 | Med | 6.1 | <= 5.2.0 | — | Nov 18, 2023 | OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation. | |
| CVE-2023-40812 | Med | 6.1 | <= 5.2.0 | — | Nov 18, 2023 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field. | |
| CVE-2023-40810 | Med | 6.1 | <= 5.2.0 | — | Nov 18, 2023 | OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field. | |
| CVE-2023-40809 | Med | 6.1 | <= 5.2.0 | — | Nov 18, 2023 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number. | |
| CVE-2021-25959 | Med | 6.1 | >= 4.0.0, < 5.2.0 | 5.2.0 | Sep 29, 2021 | In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance. |
- affected <= 5.2.0
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field.
- affected <= 5.2.0
OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field.
- affected <= 5.2.0
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field.
- affected <= 5.2.0
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field.
- affected <= 5.2.0
OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation.
- affected <= 5.2.0
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field.
- affected <= 5.2.0
OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field.
- affected <= 5.2.0
OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number.
- affected >= 4.0.0, < 5.2.0fixed 5.2.0
In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance.