deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-24377
Published: 2024-02-16
Description: An issue in idocv v.14.1.3_20231228 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted script.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://zhuabapa.top/2024/01/18/idocv_20231228_rce/#more; https://zhuabapa.top/2024/01/18/idocv_20231228_rce/#more
CVE: CVE-2024-25466
Published: 2024-02-16
Description: Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component.
CVSS Score: 7.8 (HIGH)
CWE: CWE-26
References: https://github.com/FixedOctocat/CVE-2024-25466/tree/main; https://github.com/rnmods/react-native-document-picker/blob/0be5a70c3b456e35c2454aaf4dc8c2d40eb2ab47/android/src/main/java/com/reactnativedocumentpicker/RNDocumentPickerModule.java; https://github.com/FixedOctocat/CVE-2024-25466/tree/main
CVE: CVE-2023-45860
Published: 2024-02-16
Description: In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. This issue arises from inadequate permission checking, which could enable unauthorized clients to access data from files stored on a member's filesystem.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/hazelcast/hazelcast/pull/25348; https://github.com/hazelcast/hazelcast/security/advisories/GHSA-8h4x-xvjp-vf99; https://github.com/hazelcast/hazelcast/pull/25348
CVE: CVE-2024-22425
Published: 2024-02-16
Description: Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to launch a brute force attack or a dictionary attack against the RecoverPoint login form. This allows attackers to brute-force the password of valid users in an automated manner.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-307
References: https://www.dell.com/support/kbdoc/en-us/000222133/dsa-2024-092-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000228154/dsa-2024-369-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222133/dsa-2024-092-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities
CVE: CVE-2024-22426
Published: 2024-02-16
Description: Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains an OS Command injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to execute arbitrary operating system commands, which will get executed in the context of the root user, resulting in a complete system compromise.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434, CWE-78
References: https://www.dell.com/support/kbdoc/en-us/000222133/dsa-2024-092-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000228154/dsa-2024-369-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities; https://www.dell.com/support/kbdoc/en-us/000222133/dsa-2024-092-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities
CVE: CVE-2024-21775
Published: 2024-02-16
Description: Zoho ManageEngine Exchange Reporter Plus versions 5714 and below are vulnerable to the Authenticated SQL injection in report exporting feature.
CVSS Score: 8.3 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.manageengine.com/products/exchange-reports/advisory/CVE-2024-21775.html; https://www.manageengine.com/products/exchange-reports/advisory/CVE-2024-21775.html
CVE: CVE-2024-25320
Published: 2024-02-16
Description: Tongda OA v2017 and up to v11.9 was discovered to contain a SQL injection vulnerability via the $AFF_ID parameter at /affair/delete.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/cqliuke/cve/blob/main/sql.md; https://github.com/cqliuke/cve/blob/main/sql.md
CVE: CVE-2024-1342
Published: 2024-02-16
Description: Rejected reason: Unable to reproduce.
CVE: CVE-2024-1444
Published: 2024-02-16
Description: Rejected reason: Erroneous assignment
CVE: CVE-2024-23591
Published: 2024-02-16
Description: ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow 

an attacker with privileged logical access to the host or physical access to server internals to modify or disable Intel Boot Guard firmware integrity, SPS security, and other SPS configuration setting. The server’s NIST SP
800-193-compliant Platform Firmware Resiliency (PFR) security subsystem
significantly mitigates this issue.
CVSS Score: 2.0 (LOW)
CWE: CWE-1269
References: https://support.lenovo.com/us/en/product_security/LEN-150020; https://https://support.lenovo.com/us/en/product_security/LEN-150020
CVE: CVE-2024-1515
Published: 2024-02-16
Description: Rejected reason: Erroneous assignement
CVE: CVE-2023-21165
Published: 2024-02-16
Description: In DevmemIntUnmapPMR of devicemem_server.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://source.android.com/security/bulletin/2024-01-01; https://source.android.com/security/bulletin/2024-01-01
CVE: CVE-2023-40085
Published: 2024-02-16
Description: In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/ed6ee1f7eca7b33160e36ac6d730a9ef395ca4f1; https://source.android.com/security/bulletin/2024-01-01; https://android.googlesource.com/platform/packages/modules/NeuralNetworks/+/ed6ee1f7eca7b33160e36ac6d730a9ef395ca4f1
CVE: CVE-2024-0015
Published: 2024-02-16
Description: In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-280
References: https://android.googlesource.com/platform/frameworks/base/+/2ce1b7fd37273ea19fbbb6daeeaa6212357b9a70; https://source.android.com/security/bulletin/2024-01-01; https://android.googlesource.com/platform/frameworks/base/+/2ce1b7fd37273ea19fbbb6daeeaa6212357b9a70
CVE: CVE-2024-1591
Published: 2024-02-16
Description: Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy. This allows them to view the policy and potentially find configuration issues.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://www.beyondtrust.com/trust-center/security-advisories/bt24-02; https://www.beyondtrust.com/trust-center/security-advisories/bt24-02
CVE: CVE-2024-21915
Published: 2024-02-16
Description: 
A privilege escalation vulnerability exists in Rockwell Automation FactoryTalk® Service Platform (FTSP). If exploited, a malicious user with basic user group privileges could potentially sign into the software and receive FTSP Administrator Group privileges. A threat actor could potentially read and modify sensitive data, delete data and render the FTSP system unavailable.


CVSS Score: 9.0 (CRITICAL)
CWE: CWE-732, CWE-732
References: https://www.rockwellautomation.com/en-us/support/advisory.SD1662.html; https://www.rockwellautomation.com/en-us/support/advisory.SD1662.html
CVE: CVE-2024-0016
Published: 2024-02-16
Description: In multiple locations, there is a possible out of bounds read due to a missing bounds check. This could lead to paired device information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://android.googlesource.com/platform/packages/modules/Bluetooth/+/1d7ba7c8a205522f384e8d5c7c9f26a421cab5f1; https://source.android.com/security/bulletin/2024-01-01; https://android.googlesource.com/platform/packages/modules/Bluetooth/+/1d7ba7c8a205522f384e8d5c7c9f26a421cab5f1
CVE: CVE-2024-0017
Published: 2024-02-16
Description: In shouldUseNoOpLocation of CameraActivity.java, there is a possible confused deputy due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://android.googlesource.com/platform/packages/apps/Camera2/+/5c4c4b35754eef319dcd69c422f0b1ac0c823f6e; https://source.android.com/security/bulletin/2024-01-01; https://android.googlesource.com/platform/packages/apps/Camera2/+/5c4c4b35754eef319dcd69c422f0b1ac0c823f6e
CVE: CVE-2024-0018
Published: 2024-02-16
Description: In convertYUV420Planar16ToY410 of ColorConverter.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-122
References: https://android.googlesource.com/platform/frameworks/av/+/bf[PII_REDACTED]f67219fd1829438dda28845d4c23; https://source.android.com/security/bulletin/2024-01-01; https://android.googlesource.com/platform/frameworks/av/+/bf[PII_REDACTED]f67219fd1829438dda28845d4c23
CVE: CVE-2024-0019
Published: 2024-02-16
Description: In setListening of AppOpsControllerImpl.java, there is a possible way to hide the microphone privacy indicator when restarting systemUI due to a missing check for active recordings. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-732
References: https://android.googlesource.com/platform/frameworks/base/+/707fc94ec3df4cf6b985e6d06c2588690d1a025a; https://source.android.com/security/bulletin/2024-01-01; https://android.googlesource.com/platform/frameworks/base/+/707fc94ec3df4cf6b985e6d06c2588690d1a025a
CVE: CVE-2024-0020
Published: 2024-02-16
Description: In onActivityResult of NotificationSoundPreference.java, there is a possible way to hear audio files belonging to a different user due to a confused deputy. This could lead to local information disclosure across users of a device with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://android.googlesource.com/platform/packages/apps/Settings/+/87f791f2351e366f842a0fd6fcb744069160d9a1; https://source.android.com/security/bulletin/2024-01-01; https://android.googlesource.com/platform/packages/apps/Settings/+/87f791f2351e366f842a0fd6fcb744069160d9a1
CVE: CVE-2024-0021
Published: 2024-02-16
Description: In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way for an app in the work profile to enable notification listener services due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://android.googlesource.com/platform/packages/apps/Settings/+/53ea491d276f9a7c586c7983c08105a9bb7051f1; https://source.android.com/security/bulletin/2024-01-01; https://android.googlesource.com/platform/packages/apps/Settings/+/53ea491d276f9a7c586c7983c08105a9bb7051f1
CVE: CVE-2024-0023
Published: 2024-02-16
Description: In ConvertRGBToPlanarYUV of Codec2BufferUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://android.googlesource.com/platform/frameworks/av/+/30b1b34cfd5abfcfee759e7d13167d368ac6c268; https://source.android.com/security/bulletin/2024-01-01; https://android.googlesource.com/platform/frameworks/av/+/30b1b34cfd5abfcfee759e7d13167d368ac6c268
CVE: CVE-2024-21987
Published: 2024-02-16
Description: SnapCenter versions 4.8 prior to 5.0 are susceptible to a 
vulnerability which could allow an authenticated SnapCenter Server user 
to modify system logging configuration settings


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-285, CWE-863
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-25083
Published: 2024-02-16
Description: An issue was discovered in BeyondTrust Privilege Management for Windows before 24.1. When an low-privileged user initiates a repair, there is an attack vector through which the user is able to execute any program with elevated privileges.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-266
References: https://www.beyondtrust.com/trust-center/security-advisories/bt24-01; https://www.beyondtrust.com/trust-center/security-advisories/bt24-01
CVE: CVE-2024-25627
Published: 2024-02-16
Description: Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaScript payloads. As such, an attacker gaining administrative access to the alf.io application may be able to persist access by planting an XSS payload. This issue has been addressed in version 2.0-M4-2402. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-434, CWE-79
References: https://github.com/alfio-event/alf.io/security/advisories/GHSA-gpmg-8f92-37cf; https://github.com/alfio-event/alf.io/security/advisories/GHSA-gpmg-8f92-37cf
CVE: CVE-2024-25628
Published: 2024-02-16
Description: Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even after being invalidated/deleted. This issue has been addressed in version 2.0-M4-2402. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.6 (HIGH)
CWE: CWE-613, CWE-613
References: https://github.com/alfio-event/alf.io/security/advisories/GHSA-8p6m-mm22-q893; https://github.com/alfio-event/alf.io/security/advisories/GHSA-8p6m-mm22-q893
CVE: CVE-2023-45918
Published: 2024-02-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2024-24750
Published: 2024-02-16
Description: Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling `fetch(url)` and not consuming the incoming body ((or consuming it very slowing) will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade should make sure to always consume the incoming body.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-401
References: https://github.com/nodejs/undici/commit/87a48113f1f68f60aa09abb07276d7c35467c663; https://github.com/nodejs/undici/security/advisories/GHSA-9f24-jqhm-jfcw; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-24758
Published: 2024-02-16
Description: Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 3.9 (LOW)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2024/03/11/1; https://github.com/nodejs/undici/commit/b9da3e40f1f096a06b4caedbb27c[PII_REDACTED]ef; https://github.com/nodejs/undici/security/advisories/GHSA-3787-6prv-h9w3
CVE: CVE-2024-21983
Published: 2024-02-16
Description: StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 
are susceptible to a Denial of Service (DoS) vulnerability. Successful 
exploit by an authenticated attacker could lead to an out of memory 
condition or node reboot.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-248
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-21984
Published: 2024-02-16
Description: StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8 
are susceptible to a difficult to exploit Reflected Cross-Site Scripting
 (XSS) vulnerability. Successful exploit requires the attacker to know 
specific information about the target instance and trick a privileged 
user into clicking a specially crafted link. This could allow the 
attacker to view or modify configuration settings or add or modify user 
accounts. 





CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2023-21833
Published: 2024-02-17
Description: Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Object Store).   The supported version that is affected is 8.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle ZFS Storage Appliance Kit accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://www.oracle.com/security-alerts/cpujan2024.html; https://www.oracle.com/security-alerts/cpujan2024.html
CVE: CVE-2024-20903
Published: 2024-02-17
Description: Vulnerability in the Java VM component of Oracle Database Server.  Supported versions that are affected are 19.3-19.21 and  21.3-21.12. Easily exploitable vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via Oracle Net to compromise Java VM.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Java VM accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
CVSS Score: 6.5 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujan2024.html; https://www.oracle.com/security-alerts/cpujan2024.html
CVE: CVE-2024-20905
Published: 2024-02-17
Description: Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are Prior to 9.2.8.0. Easily exploitable vulnerability allows high privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).
CVSS Score: 2.7 (LOW)
CWE: CWE-404
References: https://www.oracle.com/security-alerts/cpujan2024.html; https://www.oracle.com/security-alerts/cpujan2024.html
CVE: CVE-2024-20907
Published: 2024-02-17
Description: Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File download).  Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Web Applications Desktop Integrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Web Applications Desktop Integrator accessible data as well as  unauthorized read access to a subset of Oracle Web Applications Desktop Integrator accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 6.1 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujan2024.html; https://www.oracle.com/security-alerts/cpujan2024.html
CVE: CVE-2024-20909
Published: 2024-02-17
Description: Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall).  Supported versions that are affected are 20.1-20.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Audit Vault and Database Firewall.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Audit Vault and Database Firewall accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
CVSS Score: 7.5 (HIGH)
References: https://www.oracle.com/security-alerts/cpujan2024.html; https://www.oracle.com/security-alerts/cpujan2024.html
CVE: CVE-2024-20911
Published: 2024-02-17
Description: Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall).  Supported versions that are affected are 20.1-20.9. Difficult to exploit vulnerability allows high privileged attacker with network access via Oracle Net to compromise Oracle Audit Vault and Database Firewall.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Audit Vault and Database Firewall, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Audit Vault and Database Firewall accessible data. CVSS 3.1 Base Score 2.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N).
CVSS Score: 2.6 (LOW)
CWE: CWE-284
References: https://www.oracle.com/security-alerts/cpujan2024.html; https://www.oracle.com/security-alerts/cpujan2024.html
CVE: CVE-2024-20913
Published: 2024-02-17
Description: Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
References: https://www.oracle.com/security-alerts/cpujan2024.html; https://www.oracle.com/security-alerts/cpujan2024.html