CVE-2024-50591

The Elefant Software Updater (ESU) , a component of the HASOMED Elefant exercise software, contains a command injection vulnerability. An attacker with local access to a medical office computer can escalate privileges to NT AUTHORITYSYSTEM by communicating with the ESU service via Windows Named P...

CVE-2024-50590 Local Privilege Escalation via Weak Service Binary Permissions

Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elefant service binaries with weak permissions. The default installation directory of Elefant is "C:\Elefant1" which is writable for all users. ...

CVE-2024-50590 Local Privilege Escalation via Weak Service Binary Permissions

Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITY\SYSTEM" by overwriting one of two Elefant service binaries with weak permissions. The default installation directory of Elefant is "C:\Elefant1" which is writable for all users. ...

CVE-2024-50590

The HASOMED Elefant medical office software is vulnerable to local privilege escalation due to incorrect default permissions (CWE-276, CWE-732, CWE-250). The default installation directory, C:\Elefant1, is writable by all users. The installer registers two Firebird database services —fbserver.exe...

CVE-2024-50588

An unauthenticated attacker with access to the local network of the medical office can use known default credentials to gain remote DBA access to the Elefant Firebird database. The data in the database includes patient data and login credentials among other sensitive data. In addition, this enabl...

CVE-2024-50588

The HASOMED Elefant exercise software (specifically the Elefant Firebird database ) is vulnerable to unauthorized access due to the use of known default credentials . Attackers with local network access can gain remote DBA access , allowing them to view sensitive information such as patient data ...

HASOMED Elefant 安全漏洞

HASOMED Elefant is an exercise software from the German company HASOMED. It specializes in meeting the needs of psychotherapists, child and adolescent psychotherapists, and medical psychotherapists. HASOMED Elefant has a security vulnerability. An attacker with local access to a medical office...

PT-2024-34343 · Hasomed · Hasomed Elefant

Name of the Vulnerable Software and Affected Versions: Hasomed Elefant version 1.4.2.1811/24.03.03 Description: An unauthenticated attacker with access to the local network of a medical office can query an unprotected Fast Healthcare Interoperability Resources FHIR API to get access to sensitive...

PT-2024-34347 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Elefant versions prior to 1.4.2.1811 Description: An attacker with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITYSYSTEM" by exploiting a race condition in the Elefant Update Service...

HASOMED Elefant 安全漏洞

HASOMED Elefant is an exercise software from the German company HASOMED. It specializes in meeting the needs of psychotherapists, child and adolescent psychotherapists, and medical psychotherapists. A security vulnerability exists in HASOMED Elefant, which arises from the fact that an attacker wi...

HASOMED Elefant 安全漏洞

HASOMED Elefant is an exercise software from the German company HASOMED. It specializes in meeting the needs of psychotherapists, child and adolescent psychotherapists, and medical psychotherapists. A security vulnerability exists in HASOMED Elefant versions prior to 24.04.00 and Elefant Software...

PT-2024-34345 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Elefant affected versions not specified Description: Attackers with local access to the medical office computer can escalate their Windows user privileges to "NT AUTHORITYSYSTEM" by overwriting one of two Elefant service binaries with weak...

CVE-2024-50592: Time-of-check Time-of-use (TOCTOU) Race Condition

An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a race condition in the Elefant Update Service during the repair or update process. When using the repair function, the service queries the server for a lis...

HASOMED Elefant 安全漏洞

HASOMED Elefant is an exercise software from the German company HASOMED. It specializes in meeting the needs of psychotherapists, child and adolescent psychotherapists, and medical psychotherapists. HASOMED Elefant has a security vulnerability. An attacker with local access to a medical office...

PT-2024-34342 · Unknown · Elefant Firebird

Name of the Vulnerable Software and Affected Versions: Elefant Firebird database versions prior to 24.03.03 Description: An unauthenticated attacker with access to the local network of a medical office can use known default credentials to gain remote DBA access to the Elefant Firebird database...

PT-2024-34348 · Unknown · Elefant Service Tool

Name of the Vulnerable Software and Affected Versions: Elefant Service tool affected versions not specified Description: An attacker with local access to the medical office computer can access restricted functions of the Elefant Service tool by using a hard-coded Hotline password in the Elefant...

CVE-2024-50588: Use of Default Password

An unauthenticated attacker with access to the local network of the medical office can use known default credentials to gain remote DBA access to the Elefant Firebird database. The data in the database includes patient data and login credentials among other sensitive data. In addition, this enabl...

CVE-2024-50591: Improper Neutralization of Special Elements used in a Command

An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a command injection vulnerability in the Elefant Update Service. The command injection can be exploited by communicating with the Elefant Update Service whi...

HASOMED Elefant 安全漏洞

HASOMED Elefant is an exercise software from the German company HASOMED. It specializes in meeting the needs of psychotherapists, child and adolescent psychotherapists, and medical psychotherapists. A security vulnerability exists in HASOMED Elefant versions prior to 24.04.00 and Elefant Software...

CVE-2024-50593: Use of Hard-coded Credentials

An attacker with local access to the medical office computer can access restricted functions of the Elefant Service tool by using a hard-coded "Hotline" password in the Elefant service binary, which is shipped with the software...