Vulnerabilidades en hapifhir
15 resultadosAnálisis Vexday
O HAPI FHIR apresenta um perfil moderado de risco com 10 vulnerabilidades catalogadas, sendo 1 crítica e 4 publicadas recentemente (últimos 90 dias), indicando desenvolvimento ativo de novos riscos. Nenhuma vulnerabilidade está sob exploração ativa no momento, mas a fraqueza dominante em CWE-1333 (Improper Initialization) demanda atenção em ciclos de atualização próximos para mitigar o risco crescente.
CVE-2024-45294HIGH`org.hl7.fhir.core` XXE vulnerability in XSLT transformsEPSS 1.0%CVE-2024-52007HIGHXXE vulnerability in XSLT parsing in `org.hl7.fhir.core`EPSS 0.9%CVE-2026-49485HIGHHAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP EndpointEPSS 0.7%CVE-2026-45367HIGHHAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP EndpointEPSS 0.7%CVE-2026-55470HIGHHAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoSEPSS 0.7%CVE-2026-81875HIGHHAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of serviceEPSS 0.6%CVE-2026-81876HIGHHAPI FHIR: SHCParser DEFLATE infinite loop causes denial of serviceEPSS 0.6%CVE-2026-55471HIGHHAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactoryEPSS 0.6%CVE-2026-62295HIGHHAPI FHIR: JSON utility parser unbounded recursion causes StackOverflow denial of serviceEPSS 0.5%CVE-2026-62296HIGHHAPI FHIR: XHTML narrative parser unbounded recursion causes StackOverflow denial of serviceEPSS 0.5%CVE-2026-33180HIGHHAPI FHIR HTTP authentication leak in redirectsEPSS 0.5%CVE-2026-34361CRITICALHAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token TheftEPSS 0.4%CVE-2026-34360MEDIUMHAPI FHIR: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network ProbingEPSS 0.3%CVE-2026-34359HIGHHAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR CoreEPSS 0.2%CVE-2026-62293MEDIUMHAPI FHIR: Stored XSS in scan report via unescaped IG and profile titlesEPSS 0.2%