Rainbowfishsoftware Pacsone Server vulnerabilities

CVE-2020-29164 [MEDIUM] CWE-79 CVE-2020-29164: PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by cross-site scripting (XSS). PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by cross-site scripting (XSS).

CVE-2020-29165 [CRITICAL] CWE-306 CVE-2020-29165: PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by incorrect access control, which c PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by incorrect access control, which can result in remotely gaining administrator privileges.

CVE-2020-12870 [CRITICAL] CWE-89 CVE-2020-12870: RainbowFish PacsOne Server 6.8.4 allows SQL injection on the username parameter in the signup page. RainbowFish PacsOne Server 6.8.4 allows SQL injection on the username parameter in the signup page.

CVE-2020-29163 [HIGH] CWE-89 CVE-2020-29163: PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by SQL injection. PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by SQL injection.

CVE-2020-12715 [HIGH] CWE-434 CVE-2020-12715: RainbowFish PacsOne Server 6.8.4 has Incorrect Access Control. RainbowFish PacsOne Server 6.8.4 has Incorrect Access Control.

CVE-2020-29166 [HIGH] CWE-22 CVE-2020-29166: PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by file read/manipulation, which can PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by file read/manipulation, which can result in remote information disclosure.