Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-15901 State: PUBLISHED Published: 2020-07-22T21:29:11 Last Updated: 2024-08-04T13:30:22.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-xi/change-log/ - https://www.nagios.com/products/security/ - https://insinuator.net/2020/07/security-advisories-for-nagios-xi/
CVE ID: CVE-2020-15902 State: PUBLISHED Published: 2020-07-22T21:28:59 Last Updated: 2024-08-04T13:30:23.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-xi/change-log/ - https://www.nagios.com/products/security/ - https://insinuator.net/2020/07/security-advisories-for-nagios-xi/
CVE ID: CVE-2020-15903 State: PUBLISHED Published: 2020-09-09T20:29:24 Last Updated: 2024-08-04T13:30:23.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was found in Nagios XI before 5.7.3. There is a privilege escalation vulnerability in backend scripts that ran as root where some included files were editable by nagios user. This issue was fixed in version 5.7.3. Additional Analyst Notes: - CVE Program Container: References: - https://www.nagios.com/downloads/nagios-xi/change-log/
CVE ID: CVE-2020-15904 State: PUBLISHED Published: 2020-07-22T22:25:51 Last Updated: 2024-08-04T13:30:23.224Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a crafted patch file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ilanschnell/bsdiff4/commit/49a4cee2feef7deaf9d89e5e793a8824930284d7 - https://github.com/ilanschnell/bsdiff4/blob/master/CHANGELOG.txt
CVE ID: CVE-2020-15906 State: PUBLISHED Published: 2020-10-22T17:26:11 Last Updated: 2024-08-04T13:30:23.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/159663/Tiki-Wiki-CMS-Groupware-21.1-Authentication-Bypass.html - https://info.tiki.org/article473-Security-Releases-of-all-Tiki-versions-since-16-3
CVE ID: CVE-2020-15907 State: PUBLISHED Published: 2020-08-07T19:39:08 Last Updated: 2024-08-04T13:30:23.229Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Mahara 19.04 before 19.04.6, 19.10 before 19.10.4, and 20.04 before 20.04.1, certain places could execute file or folder names containing JavaScript. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mahara/+bug/1888163 - https://mahara.org/interaction/forum/topic.php?id=8668
CVE ID: CVE-2020-15908 State: PUBLISHED Published: 2020-07-23T03:56:37 Last Updated: 2024-08-04T13:30:22.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: tar/TarFileReader.cpp in Cauldron cbang (aka C-Bang or C!) before 1.6.0 allows Directory Traversal during extraction from a TAR archive. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CauldronDevelopmentLLC/cbang/compare/1.5.1...1.6.0 - https://github.com/CauldronDevelopmentLLC/cbang/commit/1c1dba62bd3e6fa9d0d0c0aa21926043b75382c7
CVE ID: CVE-2020-15909 State: PUBLISHED Published: 2020-10-19T12:57:26 Last Updated: 2024-08-04T13:30:22.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in within N-Central. To take advantage of this, cookie could be stolen and the JSESSIONID can be captured. On its own this is not a surprising result; low security tools allow the cookie to roam from machine to machine. The JSESSION cookie can then be used on the attac
; low security tools allow the cookie to roam from machine to machine. The JSESSION cookie can then be used on the attackers’ workstation by browsing to the victim’s NCentral server URL and replacing the JSESSIONID attribute value by the captured value. Expected behavior would be to check this against a second source and enforce at least a reauthentication or multi factor request as N-Central is a highly privileged service. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwindsmsp.com/products/n-central - https://limenetworks.nl/wp-content/uploads/CVE-934261-v-1.2.pdf
CVE ID: CVE-2020-15910 State: PUBLISHED Published: 2020-10-19T12:57:26 Last Updated: 2024-08-04T13:30:23.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be forwarded to the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://www.solarwindsmsp.com/products/n-central - https://limenetworks.nl/wp-content/uploads/CVE-934261-v-1.2.pdf
CVE ID: CVE-2020-15912 State: PUBLISHED Published: 2020-07-23T14:40:19 Last Updated: 2024-08-04T13:30:23.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tesla Model 3 vehicles allow attackers to open a door by leveraging access to a legitimate key card, and then using NFC Relay. NOTE: the vendor has developed Pin2Drive to mitigate this issue Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cansecwest.com/post/2020-03-09-22:00:00_2020_Speakers - https://www.youtube.com/watch?v=kQWg-Ywv3S4 - https://www.youtube.com/watch?v=VYKsfgox-bs - https://twitter.com/Kevin2600/status/1218892338182836224 - https://www.youtube.com/watch?v=nn-
com/watch?v=VYKsfgox-bs - https://twitter.com/Kevin2600/status/1218892338182836224 - https://www.youtube.com/watch?v=nn-_3AbtEkI - https://www.carhackingvillage.com/speaker-bios#htm3nrr
CVE ID: CVE-2020-15914 State: PUBLISHED Published: 2020-10-30T16:27:18 Last Updated: 2024-08-04T13:30:23.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability exists in the Origin Client for Mac and PC 10.5.86 or earlier that could allow a remote attacker to execute arbitrary Javascript in a target user’s Origin client. An attacker could use this vulnerability to access sensitive data related to the target user’s Origin account, or to control or monitor the Origin text chat window. Additional Analyst Notes: - CVE Program Container: References: - https://www.ea.com/security/news/easec-2020-003-cross-site-scripting-vulnerability-in-origin-cl
Container: References: - https://www.ea.com/security/news/easec-2020-003-cross-site-scripting-vulnerability-in-origin-client - https://github.com/Monairy/Security-Advisories/blob/master/CVE%202020-15914
CVE ID: CVE-2020-15916 State: PUBLISHED Published: 2020-07-23T17:53:48 Last Updated: 2024-08-04T13:30:22.771Z Vendors: n/a Products: n/a Problem Types: n/a Description: goform/AdvSetLanip endpoint on Tenda AC15 AC1900 15.03.05.19 devices allows remote attackers to execute arbitrary system commands via shell metacharacters in the lanIp POST parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68
CVE ID: CVE-2020-15917 State: PUBLISHED Published: 2020-07-23T18:06:26 Last Updated: 2024-08-04T13:30:23.272Z Vendors: n/a Products: n/a Problem Types: n/a Description: common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled. Additional Analyst Notes: - CVE Program Container: References: - https://git.claws-mail.org/?p=claws.git%3Ba=commit%3Bh=fcc25329049b6f9bd8d890f1197ed61eb12e14d5 - https://git.claws-mail.org/?p=claws.git%3Ba=blob%3Bf=RELEASE_NOTES - https://security.gentoo.org/glsa/202007-56 - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00090.html - https://lists.fedoraproject.org/archives/list/package-ann
pensuse.org/opensuse-security-announce/2020-07/msg00090.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G7UX65342HRVDQML4G4GEVEUB764EUM5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6YVQB7NRBHO67Q74RS7RZCMW4ENRVBB4/ - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00002.html - http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00060.html - http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00051.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00013.html
CVE ID: CVE-2020-15918 State: PUBLISHED Published: 2020-07-24T00:59:10 Last Updated: 2024-08-04T13:30:23.182Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Stored Cross Site Scripting (XSS) vulnerabilities were discovered in Mida eFramework through 2.9.0. Additional Analyst Notes: - CVE Program Container: References: - https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
CVE ID: CVE-2020-15919 State: PUBLISHED Published: 2020-07-24T00:58:59 Last Updated: 2024-08-04T13:30:23.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross Site Scripting (XSS) vulnerability was discovered in Mida eFramework through 2.9.0. Additional Analyst Notes: - CVE Program Container: References: - https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
CVE ID: CVE-2020-15920 State: PUBLISHED Published: 2020-07-24T00:58:51 Last Updated: 2024-08-04T13:30:23.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. No authentication is required. Additional Analyst Notes: - CVE Program Container: References: - https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html - http://packetstormsecurity.com/files/158991/Mida-eFramework-2.9.0-Remote-Code-Execution.html - http://packetstormsecurity.com/files/159194/Mida-Solutions-eFramework-ajaxreq.php-Command-Injection.html
CVE ID: CVE-2020-15921 State: PUBLISHED Published: 2020-07-24T00:58:43 Last Updated: 2024-08-04T13:30:22.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted functionalities, such as Code Execution. Additional Analyst Notes: - CVE Program Container: References: - https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html - http://packetstormsecurity.com/files/159239/Mida-eFramework-2.9.0-Backdoor-Access.html
CVE ID: CVE-2020-15922 State: PUBLISHED Published: 2020-07-24T00:58:32 Last Updated: 2024-08-04T13:30:23.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. Authentication is required. Additional Analyst Notes: - CVE Program Container: References: - https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html - http://packetstormsecurity.com/files/159314/Mida-eFramework-2.8.9-Remote-Code-Execution.html
CVE ID: CVE-2020-15923 State: PUBLISHED Published: 2020-07-24T00:58:17 Last Updated: 2024-08-04T13:30:23.200Z Vendors: n/a Products: n/a Problem Types: n/a Description: Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
CVE ID: CVE-2020-15924 State: PUBLISHED Published: 2020-07-24T00:58:06 Last Updated: 2024-08-04T13:30:23.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a SQL Injection in Mida eFramework through 2.9.0 that leads to Information Disclosure. No authentication is required. The injection point resides in one of the authentication parameters. Additional Analyst Notes: - CVE Program Container: References: - https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
CVE ID: CVE-2020-15925 State: PUBLISHED Published: 2020-08-13T13:46:47 Last Updated: 2024-08-04T13:30:22.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability at a tpf URI in Loway QueueMetrics before 19.10.21 allows remote authenticated attackers to execute arbitrary SQL commands via the TPF_XPAR1 parameter. Additional Analyst Notes: - CVE Program Container: References: - https://blog.divisionzero.co/2020/08/12/cve-2020-15925/
CVE ID: CVE-2020-15926 State: PUBLISHED Published: 2020-08-18T20:50:27 Last Updated: 2024-08-04T13:30:23.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rocket.Chat through 3.4.2 allows XSS where an attacker can send a specially crafted message to a channel or in a direct message to the client which results in remote code execution on the client side. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RocketChat/Rocket.Chat/commits/develop - https://github.com/RocketChat/Rocket.Chat/pull/18356 - https://blog.redteam.pl/2020/08/rocket-chat-xss-rce-cve-2020-15926.html
CVE ID: CVE-2020-15927 State: PUBLISHED Published: 2020-10-06T18:56:15 Last Updated: 2024-08-04T13:30:22.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP module. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com - https://www.manageengine.com/products/applications_manager/issues.html#v14750 - https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2020-15927.html
CVE ID: CVE-2020-15928 State: PUBLISHED Published: 2020-11-24T01:41:01 Last Updated: 2024-08-04T13:30:23.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Ortus TestBox 2.4.0 through 4.1.0, unvalidated query string parameters to test-browser/index.cfm allow directory traversal. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49078
CVE ID: CVE-2020-15929 State: PUBLISHED Published: 2020-11-24T01:32:48 Last Updated: 2024-08-04T13:30:23.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Ortus TestBox 2.4.0 through 4.1.0, unvalidated query string parameters passed to system/runners/HTMLRunner.cfm allow an attacker to write an arbitrary CFM file (within the application's context) containing attacker-defined CFML tags, leading to Remote Code Execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49077
CVE ID: CVE-2020-15930 State: PUBLISHED Published: 2020-09-24T18:41:38 Last Updated: 2024-08-04T13:30:23.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/laurent22/joplin/issues/3552 - https://github.com/laurent22/joplin/releases/tag/v1.1.4 - http://packetstormsecurity.com/files/159316/Joplin-1.0.245-Cross-Site-Scripting-Code-Execution.html
CVE ID: CVE-2020-15931 State: PUBLISHED Published: 2020-10-20T19:23:17 Last Updated: 2024-08-04T13:30:23.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain Administrator (that is configured within the product in its installation state) by generating a single Kerberos Pre-Authentication Failed (ID 4771) event on a Domain Controller. Additional Analyst Notes: - CVE Program Container: References: - https://www.optiv.com/explore-optiv-insights/source-zero/netwrix-account-lockout-examiner-41-disclosure-vulnerability - https://www.netwrix.com/net
re-optiv-insights/source-zero/netwrix-account-lockout-examiner-41-disclosure-vulnerability - https://www.netwrix.com/netwrix_reports_vulnerability_in_netwrix_account_lockout_examiner_4_1.html
CVE ID: CVE-2020-15932 State: PUBLISHED Published: 2020-07-24T16:15:40 Last Updated: 2024-08-04T13:30:23.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: Overwolf before 0.149.2.30 mishandles Symbolic Links during updates, causing elevation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/active-labs/Advisories/blob/master/2020/ACTIVE-2020-005.md
CVE ID: CVE-2020-15933 State: PUBLISHED Published: 2022-01-05T11:29:04 Last Updated: 2024-10-25T13:36:17.605Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiMail Problem Types: Information disclosure Description: A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and below FortiMail versions 6.4.1 and 6.4.0 allows attacker to obtain potentially sensitive software-version information via client-side resources inspection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.co
pection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-20-105
CVE ID: CVE-2020-15934 State: PUBLISHED Published: 2024-12-19T10:57:39.255Z Last Updated: 2024-12-20T17:23:40.395Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiClientLinux Problem Types: CWE-269 Description: An execution with unnecessary privileges vulnerability in the VCM engine of FortiClient for Linux versions 6.2.7 and below, version 6.4.0. may allow local users to elevate their privileges to root by creating a malicious script or program on the target machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.fortiguard.com/psirt/FG-IR-20-110
CVE ID: CVE-2020-15935 State: PUBLISHED Published: 2021-11-02T19:00:53 Last Updated: 2024-10-25T13:43:30.629Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiADC Problem Types: Information disclosure Description: A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and below may allow a remote authenticated attacker to retrieve some sensitive information such as users LDAP passwords and RADIUS shared secret by deobfuscating the passwords entry fields. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisor
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-044
CVE ID: CVE-2020-15936 State: PUBLISHED Published: 2022-03-01T18:25:27 Last Updated: 2024-10-22T21:00:50.381Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N/E:X/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Improper access control Description: A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version 6.0.11 and below, version 5.6.13 and below allows attacker to disclose sensitive information via SNI Client Hello TLS packets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-091
CVE ID: CVE-2020-15937 State: PUBLISHED Published: 2021-03-03T15:45:56 Last Updated: 2024-10-25T14:00:13.471Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Execute unauthorized code or commands Description: An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack (XSS) via the IPS and WAF logs dashboard. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-068
CVE ID: CVE-2020-15938 State: PUBLISHED Published: 2021-03-04T17:28:59 Last Updated: 2024-10-25T13:59:43.087Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Operational Risk, Traffic Bypass Description: When traffic other than HTTP/S (eg: SSH traffic, etc...) traverses the FortiGate in version below 6.2.5 and below 6.4.2 on port 80/443, it is not redirected to the transparent proxy policy for processing, as it doesn't have a valid HTTP header. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-172
CVE ID: CVE-2020-15939 State: PUBLISHED Published: 2021-09-06T15:19:38 Last Updated: 2024-10-25T13:50:54.036Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiSandbox Problem Types: Improper Access Control Description: An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1.4 and below may allow an authenticated, unprivileged attacker to download the device configuration file via the recovery URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-071
CVE ID: CVE-2020-15940 State: PUBLISHED Published: 2021-11-02T17:49:37 Last Updated: 2024-10-25T13:48:08.458Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiClientEMS Problem Types: Execute unauthorized code or commands Description: An improper neutralization of input vulnerability [CWE-79] in FortiClientEMS versions 6.4.1 and below and 6.2.9 and below may allow a remote authenticated attacker to inject malicious script/tags via the name parameter of various sections of the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-067
CVE ID: CVE-2020-15941 State: PUBLISHED Published: 2021-10-06T09:27:32 Last Updated: 2024-10-25T13:49:17.665Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:F/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiClientEMS Problem Types: Escalation of privilege Description: A path traversal vulnerability [CWE-22] in FortiClientEMS versions 6.4.1 and below; 6.2.8 and below may allow an authenticated attacker to inject directory traversal character sequences to add/delete the files of the server via the name parameter of Deployment Packages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-074