deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-7227
Published: 2024-01-25
Description: 
SystemK NVR 504/508/516 versions 2.3.5SK.30084998 and prior are vulnerable to a command injection vulnerability in the dynamic domain name system (DDNS) settings that could allow an attacker to execute arbitrary commands with root privileges.





CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-02; https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-02
CVE: CVE-2024-0882
Published: 2024-01-25
Description: A vulnerability was found in qwdigital LinkWechat 5.1.0. It has been classified as problematic. This affects an unknown part of the file /linkwechat-api/common/download/resource of the component Universal Download Interface. The manipulation of the argument name with the input /profile/../../../../../etc/passwd leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252033 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-24, CWE-22
References: https://github.com/biantaibao/LinkWechat-Scrm_arbitrary-file-download-vulnerability/blob/main/report.md; https://vuldb.com/?ctiid.252033; https://vuldb.com/?id.252033
CVE: CVE-2024-0883
Published: 2024-01-25
Description: A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been declared as critical. This vulnerability affects the function prepare of the file admin/pay.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-252034 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://blog.csdn.net/weixin_56393356/article/details/135756616; https://vuldb.com/?ctiid.252034; https://vuldb.com/?id.252034
CVE: CVE-2023-41474
Published: 2024-01-25
Description: Directory Traversal vulnerability in Ivanti Avalanche 6.3.4.153 allows a remote authenticated attacker to obtain sensitive information via the javax.faces.resource component.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/JBalanza/CVE-2023-41474; https://github.com/JBalanza/CVE-2023-41474
CVE: CVE-2023-52355
Published: 2024-01-25
Description: An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://access.redhat.com/errata/RHSA-2025:20801; https://access.redhat.com/errata/RHSA-2025:21994; https://access.redhat.com/errata/RHSA-2025:23078
CVE: CVE-2023-52356
Published: 2024-01-25
Description: A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-122, CWE-787
References: https://access.redhat.com/errata/RHSA-2024:5079; https://access.redhat.com/errata/RHSA-2025:20801; https://access.redhat.com/errata/RHSA-2025:21994
CVE: CVE-2024-21630
Published: 2024-01-25
Description: Zulip is an open-source team collaboration tool. A vulnerability in version 8.0 is similar to CVE-2023-32677, but applies to multi-use invitations, not single-use invitation links as in the prior CVE. Specifically, it applies when the installation has configured non-admins to be able to invite users and create multi-use invitations, and has also configured only admins to be able to invite users to streams. As in CVE-2023-32677, this does not let users invite new users to arbitrary streams, only to streams that the inviter can already see. Version 8.1 fixes this issue. As a workaround, administrators can limit sending of invitations down to users who also have the permission to add users to streams.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://github.com/zulip/zulip/commit/0df7bd71f32f3b772e2646c6ab0d60c9b610addf; https://github.com/zulip/zulip/security/advisories/GHSA-87p9-wprh-7rm6; https://github.com/zulip/zulip/security/advisories/GHSA-mrvp-96q6-jpvc
CVE: CVE-2024-23655
Published: 2024-01-25
Description: Tuta is an encrypted email service. Starting in version 3.118.12 and prior to version 3.119.10, an attacker is able to send a manipulated email so that the user can no longer use the app to get access to received emails. By sending a manipulated email, an attacker could put the app into an unusable state. In this case, a user can no longer access received e-mails. Since the vulnerability affects not only the app, but also the web application, a user in this case has no way to access received emails. This issue was tested with iOS and the web app, but it is possible all clients are affected. Version 3.119.10 fixes this issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/tutao/tutanota/releases/tag/tutanota-release-3.119.10; https://github.com/tutao/tutanota/security/advisories/GHSA-5h47-g927-629g; https://github.com/tutao/tutanota/releases/tag/tutanota-release-3.119.10
CVE: CVE-2024-23656
Published: 2024-01-25
Description: Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex 2.37.0 serves HTTPS with insecure TLS 1.0 and TLS 1.1. `cmd/dex/serve.go` line 425 seemingly sets TLS 1.2 as minimum version, but the whole `tlsConfig` is ignored after `TLS cert reloader` was introduced in v2.37.0. Configured cipher suites are not respected either. This issue is fixed in Dex 2.38.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326, CWE-757, CWE-326
References: https://github.com/dexidp/dex/blob/70d7a2c7c1bb2646b1a540e49616cbc39622fb83/cmd/dex/serve.go#L425; https://github.com/dexidp/dex/commit/5bbdb4420254ba73b9c4df4775fe7bdacf233b17; https://github.com/dexidp/dex/issues/2848
CVE: CVE-2024-23817
Published: 2024-01-25
Description: Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Version 18.0.4 has a HTML Injection vulnerability in the Home page of the Dolibarr Application. This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendered content in the application's response. Specifically, I was able to successfully inject a new HTML tag into the returned document and, as a result, was able to comment out some part of the Dolibarr App Home page HTML code. This behavior can be exploited to perform various attacks like Cross-Site Scripting (XSS). To remediate the issue, validate and sanitize all user-supplied input, especially within HTML attributes, to prevent HTML injection attacks; and implement proper output encoding when rendering user-provided data to ensure it is treated as plain text rather than executable HTML.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-80, CWE-79
References: https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-7947-48q7-cp5m; https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-7947-48q7-cp5m
CVE: CVE-2023-52046
Published: 2024-01-25
Description: Cross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted payload to the "Execute cron job as" tab Input field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/Acklee/webadmin_xss/blob/main/xss.md; https://github.com/Acklee/webadmin_xss/blob/main/xss.md
CVE: CVE-2023-52251
Published: 2024-01-25
Description: An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: http://packetstormsecurity.com/files/177214/Kafka-UI-0.7.1-Command-Injection.html; https://github.com/BobTheShoplifter/CVE-2023-52251-POC; http://packetstormsecurity.com/files/177214/Kafka-UI-0.7.1-Command-Injection.html
CVE: CVE-2024-0884
Published: 2024-01-25
Description: A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical. This issue affects the function exec of the file payment.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252035.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://blog.csdn.net/Q_M_0_9/article/details/135846415; https://vuldb.com/?ctiid.252035; https://vuldb.com/?id.252035
CVE: CVE-2024-0885
Published: 2024-01-25
Description: A vulnerability classified as problematic has been found in SpyCamLizard 1.230. Affected is an unknown function of the component HTTP GET Request Handler. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252036.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://packetstormsecurity.com/files/176633/SpyCamLizard-1.230-Denial-Of-Service.html; https://vuldb.com/?ctiid.252036; https://vuldb.com/?id.252036
CVE: CVE-2024-22635
Published: 2024-01-25
Description: WebCalendar v1.3.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /WebCalendarvqsmnseug2/edit_entry.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://packetstormsecurity.com/files/176365/WebCalendar-1.3.0-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/176365/WebCalendar-1.3.0-Cross-Site-Scripting.html
CVE: CVE-2024-22636
Published: 2024-01-25
Description: PluXml Blog v5.8.9 was discovered to contain a remote code execution (RCE) vulnerability in the Static Pages feature. This vulnerability is exploited via injecting a crafted payload into the Content field.
CVSS Score: 8.8 (HIGH)
References: https://github.com/capture0x/PluXml-RCE/blob/main/PluXml.txt; https://github.com/capture0x/PluXml-RCE/blob/main/PluXml.txt
CVE: CVE-2024-22637
Published: 2024-01-25
Description: Form Tools v3.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /form_builder/preview.php?form_id=2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://packetstormsecurity.com/files/176403/Form-Tools-3.1.1-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/176403/Form-Tools-3.1.1-Cross-Site-Scripting.html
CVE: CVE-2024-22638
Published: 2024-01-25
Description: liveSite v2019.1 was discovered to contain a remote code execution (RCE) vulenrabiity via the component /livesite/edit_designer_region.php or /livesite/add_email_campaign.php.
CVSS Score: 9.8 (CRITICAL)
References: https://packetstormsecurity.com/files/176420/liveSite-2019.1-Remote-Code-Execution.html; https://www.exploit-db.com/exploits/51936; https://packetstormsecurity.com/files/176420/liveSite-2019.1-Remote-Code-Execution.html
CVE: CVE-2024-22639
Published: 2024-01-25
Description: iGalerie v3.0.22 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Titre (Title) field in the editing interface.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://packetstormsecurity.com/files/176411/iGalerie-3.0.22-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/176411/iGalerie-3.0.22-Cross-Site-Scripting.html
CVE: CVE-2024-24399
Published: 2024-01-25
Description: An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PHP code by uploading this code to the backend/languages/index.php languages area.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-434
References: https://github.com/capture0x/leptoncms; https://github.com/capture0x/leptoncms/blob/main/README.md; https://packetstormsecurity.com/files/176647/Lepton-CMS-7.0.0-Remote-Code-Execution.html
CVE: CVE-2023-51833
Published: 2024-01-25
Description: A command injection issue in TRENDnet TEW-411BRPplus v.2.07_eu that allows a local attacker to execute arbitrary code via the data1 parameter in the debug.cgi page.
CVSS Score: 8.1 (HIGH)
CWE: CWE-77, CWE-77
References: https://warp-desk-89d.notion.site/TEW-411BRPplus-9bafe26e48964be3be12eab47f77203d; https://www.trendnet.com/support/support-detail.asp?prod=160_TEW-411BRPplus; https://warp-desk-89d.notion.site/TEW-411BRPplus-9bafe26e48964be3be12eab47f77203d
CVE: CVE-2024-0886
Published: 2024-01-25
Description: A vulnerability classified as problematic was found in Poikosoft EZ CD Audio Converter 8.0.7. Affected by this vulnerability is an unknown functionality of the component Activation Handler. The manipulation of the argument Key leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-252037 was assigned to this vulnerability.
CVSS Score: 3.3 (LOW)
CWE: CWE-404
References: https://fitoxs.com/vuldb/09-exploit-perl.txt; https://vuldb.com/?ctiid.252037; https://vuldb.com/?id.252037
CVE: CVE-2024-0887
Published: 2024-01-25
Description: A vulnerability, which was classified as problematic, has been found in Mafiatic Blue Server 1.1. Affected by this issue is some unknown functionality of the component Connection Handler. The manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252038 is the identifier assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://fitoxs.com/vuldb/18-exploit-perl.txt; https://vuldb.com/?ctiid.252038; https://vuldb.com/?id.252038
CVE: CVE-2024-0888
Published: 2024-01-25
Description: A vulnerability, which was classified as problematic, was found in BORGChat 1.0.0 Build 438. This affects an unknown part of the component Service Port 7551. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252039.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: https://fitoxs.com/vuldb/27-exploit-perl.txt; https://vuldb.com/?ctiid.252039; https://vuldb.com/?id.252039
CVE: CVE-2024-22922
Published: 2024-01-25
Description: An issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker to escalate privileges via a crafted script to the login page in the POST/index.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269, CWE-269
References: http://projectworlds.com; http://visitor.com; https://github.com/keru6k/CVE-2024-22922/blob/main/CVE-2024-22922.md
CVE: CVE-2024-23055
Published: 2024-01-25
Description: An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validation of input by the HOST headers.
CVSS Score: 6.1 (MEDIUM)
References: http://plone.com; http://ploneorg.com; https://github.com/c0d3x27/CVEs/tree/main/CVE-2024-23055
CVE: CVE-2024-0889
Published: 2024-01-25
Description: A vulnerability was found in Kmint21 Golden FTP Server 2.02b and classified as problematic. This issue affects some unknown processing of the component PASV Command Handler. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252041 was assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://packetstormsecurity.com/files/176661/Golden-FTP-Server-2.02b-Denial-Of-Service.html; https://vuldb.com/?ctiid.252041; https://vuldb.com/?id.252041
CVE: CVE-2024-0890
Published: 2024-01-25
Description: A vulnerability was found in hongmaple octopus 1.0. It has been classified as critical. Affected is an unknown function of the file /system/dept/edit. The manipulation of the argument ancestors leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. VDB-252042 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/biantaibao/octopus_SQL2/blob/main/report.md; https://vuldb.com/?ctiid.252042; https://vuldb.com/?id.252042
CVE: CVE-2024-0891
Published: 2024-01-25
Description: A vulnerability was found in hongmaple octopus 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument description with the input <script>alert(document.cookie)</script> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-252043.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/biantaibao/octopus_XSS/blob/main/report.md; https://vuldb.com/?ctiid.252043; https://vuldb.com/?id.252043
CVE: CVE-2024-21619
Published: 2024-01-25
Description: A Missing Authentication for Critical Function vulnerability combined with a Generation of Error Message Containing Sensitive Information vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to access sensitive system information.

When a user logs in, a temporary file which contains the configuration of the device (as visible to that user) is created in the /cache folder. An unauthenticated attacker can then attempt to access such a file by sending a specific request to the device trying to guess the name of such a file. Successful exploitation will reveal configuration information.

This issue affects Juniper Networks Junos OS on SRX Series and EX Series:
  *  All versions earlier than 20.4R3-S9;
  *  21.2 versions earlier than 21.2R3-S7;
  *  21.3 versions earlier than 21.3R3-S5;
  *  21.4 versions earlier than 21.4R3-S6;
  *  22.1 versions earlier than 22.1R3-S5;
  *  22.2 versions earlier than 22.2R3-S3;
  *  22.3 versions earlier than 22.3R3-S2;
  *  22.4 versions earlier than 22.4R3;
  *  23.2 versions earlier than 23.2R1-S2, 23.2R2.



CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-306, CWE-209, CWE-306
References: https://supportportal.juniper.net/JSA76390; https://supportportal.juniper.net/JSA76390
CVE: CVE-2024-21620
Published: 2024-01-25
Description: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an attacker to construct a URL that when visited by another user enables the attacker to execute commands with the target's permissions, including an administrator.

A specific invocation of the emit_debug_note method in webauth_operation.php will echo back the data it receives.

This issue affects Juniper Networks Junos OS on SRX Series and EX Series:
  *  All versions earlier than 20.4R3-S10;
  *  21.2 versions earlier than 21.2R3-S8;
  *  21.4 versions earlier than 21.4R3-S6;
  *  22.1 versions earlier than 22.1R3-S5;
  *  22.2 versions earlier than 22.2R3-S3;
  *  22.3 versions earlier than 22.3R3-S2;
  *  22.4 versions earlier than 22.4R3-S1;
  *  23.2 versions earlier than 23.2R2;
  *  23.4 versions earlier than 23.4R2.



CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://supportportal.juniper.net/JSA76390; https://supportportal.juniper.net/JSA76390
CVE: CVE-2024-23613
Published: 2024-01-26
Description: A buffer overflow vulnerability exists in Symantec Deployment Solution version 7.9 when parsing UpdateComputer tokens. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as SYSTEM.

CVSS Score: 10.0 (CRITICAL)
CWE: CWE-119, CWE-120
References: https://blog.exodusintel.com/2024/01/25/symantec-deployment-solution-axengine-exe-buffer-overflow-remote-code-execution; https://blog.exodusintel.com/2024/01/25/symantec-deployment-solution-axengine-exe-buffer-overflow-remote-code-execution
CVE: CVE-2024-23614
Published: 2024-01-26
Description: A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 9.5 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as root.

CVSS Score: 10.0 (CRITICAL)
CWE: CWE-119, CWE-120
References: https://blog.exodusintel.com/2024/01/25/symantec-messaging-gateway-stack-buffer-overflow-remote-code-execution/; https://blog.exodusintel.com/2024/01/25/symantec-messaging-gateway-stack-buffer-overflow-remote-code-execution/
CVE: CVE-2024-23615
Published: 2024-01-26
Description: A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 10.5 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as root.

CVSS Score: 10.0 (CRITICAL)
CWE: CWE-119, CWE-120
References: https://blog.exodusintel.com/2024/01/25/symantec-messaging-gateway-libdec2lha-so-stack-buffer-overflow-remote-code-execution/; https://blog.exodusintel.com/2024/01/25/symantec-messaging-gateway-libdec2lha-so-stack-buffer-overflow-remote-code-execution/
CVE: CVE-2024-23616
Published: 2024-01-26
Description: A buffer overflow vulnerability exists in Symantec Server Management Suite version 7.9 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as SYSTEM.

CVSS Score: 10.0 (CRITICAL)
CWE: CWE-119, CWE-120
References: https://blog.exodusintel.com/2024/01/25/symantec-server-management-suite-axengine-exe-buffer-overflow-remote-code-execution/; https://blog.exodusintel.com/2024/01/25/symantec-server-management-suite-axengine-exe-buffer-overflow-remote-code-execution/
CVE: CVE-2024-23617
Published: 2024-01-26
Description: A buffer overflow vulnerability exists in Symantec Data Loss Prevention version 14.0.2 and before. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a crafted document to achieve code execution.

CVSS Score: 9.6 (CRITICAL)
CWE: CWE-119, CWE-120
References: https://blog.exodusintel.com/2024/01/25/symantec-data-loss-prevention-wp6sr-dll-stack-buffer-overflow-remote-code-execution/; https://blog.exodusintel.com/2024/01/25/symantec-data-loss-prevention-wp6sr-dll-stack-buffer-overflow-remote-code-execution/
CVE: CVE-2024-23618
Published: 2024-01-26
Description: An arbitrary code execution vulnerability exists in Arris SURFboard SGB6950AC2 devices. An unauthenticated attacker can exploit this vulnerability to achieve code execution as root.

CVSS Score: 9.6 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://blog.exodusintel.com/2024/01/25/arris-surfboard-sbg6950ac2-arbitrary-command-execution-vulnerability/; https://blog.exodusintel.com/2024/01/25/arris-surfboard-sbg6950ac2-arbitrary-command-execution-vulnerability/
CVE: CVE-2024-23619
Published: 2024-01-26
Description: A hardcoded credential vulnerability exists in IBM Merge Healthcare eFilm Workstation. A remote, unauthenticated attacker can exploit this vulnerability to achieve information disclosure or remote code execution.

CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://blog.exodusintel.com/2024/01/25/ibm-merge-healthcare-efilm-workstation-information-disclosure/; https://blog.exodusintel.com/2024/01/25/ibm-merge-healthcare-efilm-workstation-information-disclosure/
CVE: CVE-2024-23620
Published: 2024-01-26
Description: An improper privilege management vulnerability exists in IBM Merge Healthcare eFilm Workstation. A local, authenticated attacker can exploit this vulnerability to escalate privileges to SYSTEM.

CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://blog.exodusintel.com/2024/01/25/ibm-merge-healthcare-efilm-workstation-system-privilege-escalation/; https://blog.exodusintel.com/2024/01/25/ibm-merge-healthcare-efilm-workstation-system-privilege-escalation/