CVE-2020-28402

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access Launcher Configuration Panel.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-28402
https://excellium-services.com/cert-xlm-advisory/CVE-2020-28402Third Party Advisory
https://www.starpracticemanagement.com/Product
https://excellium-services.com/cert-xlm-advisory/CVE-2020-28402Third Party Advisory
https://www.starpracticemanagement.com/Product

Timeline

Published: Jan 29, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-284038.8A Cross-Site Request Forgery (CSRF) vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an attacker to change CVE-2020-284046.5An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access t CVE-2020-284058.8An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to change t CVE-2020-284066.5An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access d CVE-2020-284077.1In swtpm before 0.4.2 and 0.5.x before 0.5.1, a local attacker may be able to overwrite arbitrary files via a symlink attack against a tempo CVE-2020-284085.4The server in Dundas BI through 8.0.0.1001 allows XSS via an HTML label when creating or editing a dashboard.CVE-2020-284095.4The server in Dundas BI through 8.0.0.1001 allows XSS via addition of a Component (e.g., a button) when events such as click, hover, etc. oc CVE-2020-28418.2Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Setup, Admin). Supported versions that are a CVE-2020-284136.5In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP.CVE-2020-284146.1A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker i CVE-2020-284156.1A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker i CVE-2020-284167.8HP has identified a security vulnerability with the I.R.I.S. OCR (Optical Character Recognition) software available with HP PageWide and Off