Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: Imaworldhealth Component: Bhima Clear all filters
TI-2023-00918 CVE-2023-0967 · GHSA-q287-hpw8-q93x

Authorization bypass in Bhima

Priority MEDIUM 62

Bhima version 1.27.0 allows an attacker authenticated with normal user permissions to view sensitive data of other application users and data that should only be viewed by the administrator.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00669 Published 2023-04-05 No fix listed CWE-639
TI-2023-00910 CVE-2023-0959 · GHSA-w6hx-w9fx-4g2r

Improper privilege management in Bhima

Priority LOW 30

Bhima version 1.27.0 allows a remote attacker to update the privileges of any account registered in the application via a malicious link sent to an administrator.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00749 Published 2023-04-05 No fix listed CWE-269
TI-2023-00895 CVE-2023-0944 · GHSA-hvrf-4ggv-8gj3

Incorrect permission assignment in Bhima

Priority LOW 21

Bhima version 1.27.0 allows an authenticated attacker with regular user permissions to update arbitrary user session data such as username, email and password.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00477 Published 2023-04-05 No fix listed CWE-732