L0stHeart

OpenEMR before 8.4.0 Missing Authorization in Portal Onsite-Document APIs

OpenEMR before 8.4.0 Remote Code Execution via ESign LFI and fax upload

OpenEMR before 8.3.0 IDOR via Portal OnsiteDocument Pid_Equals Mass-Assignment

A malformed Session header permanently orphans one packet-pool block per RTSP request

mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet

ICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permanent loop

Unbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stall

TFTP client and server copy the ERROR packet message without bounding the read against the packet

DHCP client option walk drifts one byte per skipped option, reading past the received message and past the saved options buffer