Vulnerabilities > Vanderbilt

DATE CVE VULNERABILITY TITLE RISK
2019-10-04 CVE-2019-17121 Cross-site Scripting vulnerability in Vanderbilt Redcap
REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values.
network
vanderbilt CWE-79
3.5
2019-08-21 CVE-2019-15127 Cross-site Scripting vulnerability in Vanderbilt Redcap
REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file.
network
vanderbilt CWE-79
3.5
2019-08-17 CVE-2019-14937 SQL Injection vulnerability in Vanderbilt Redcap
REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter, such as cal_id=55 and sleep(3) to Calendar/calendar_popup_ajax.php.
network
vanderbilt CWE-89
6.0
2019-07-11 CVE-2019-13029 Cross-site Scripting vulnerability in Vanderbilt Redcap
Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to inject arbitrary malicious HTML or JavaScript code into a user's web browser.
network
vanderbilt CWE-79
3.5
2018-02-08 CVE-2017-7351 SQL Injection vulnerability in Vanderbilt Redcap 7.0.0
A SQL injection issue exists in a file upload handler in REDCap 7.x before 7.0.11 via a trailing substring to SendITController:upload.
network
low complexity
vanderbilt CWE-89
4.0
2017-07-18 CVE-2017-10962 Cross-site Scripting vulnerability in Vanderbilt Redcap
REDCap before 7.5.1 has XSS via the query string.
network
vanderbilt CWE-79
4.3
2017-07-18 CVE-2017-10961 Cross-Site Request Forgery (CSRF) vulnerability in Vanderbilt Redcap
REDCap before 7.5.1 has CSRF in the deletion feature of the File Repository and File Upload components.
6.8
2013-06-17 CVE-2013-4612 Cross-Site Scripting vulnerability in multiple products
Multiple cross-site scripting (XSS) vulnerabilities in REDCap before 5.1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving different modules.
4.3
2013-06-17 CVE-2013-4611 Multiple unspecified vulnerabilities in REDCap before 5.1.1 allow remote attackers to have an unknown impact via vectors involving (1) the Online Designer page or (2) the Manage Survey Participants page.
network
low complexity
project-redcap vanderbilt
critical
10.0
2013-06-17 CVE-2013-4610 Unspecified vulnerability in the Data Search utility in data-entry forms in REDCap before 5.0.3 and 5.1.x before 5.1.2 has unknown impact and remote attack vectors.
network
low complexity
project-redcap vanderbilt
critical
10.0