Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-25583 State: PUBLISHED Published: 2023-07-06T14:53:22.122Z Last Updated: 2025-11-04T19:15:41.583Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Milesight Products: UR32L Problem Types: CWE-78 Description: Two OS command injection vulnerabilities exist in the zebra vlan_name functionality of Milesight UR32L v32.3.0.5. A specially crafted network request can lead to command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is in the code branch that manages a new vlan configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosinte
nfiguration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1723
CVE ID: CVE-2023-25584 State: PUBLISHED Published: 2023-09-14T20:50:58.267Z Last Updated: 2025-02-13T16:44:31.939Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: binutils, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Extra Packages for Enterprise Linux 8, Fedora 37, Fedora 36, Fedora, Extra Packages for Enterprise Linux 7 Problem Types: CWE-125 Description: An out-of-bounds read flaw was found in the parse_module function in bfd/vms-alpha.c in Binutils. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redh
Binutils. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-25584 - https://bugzilla.redhat.com/show_bug.cgi?id=2167467 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=77c225bdeb410cf60da804879ad41622f5f1aa44 - https://security.netapp.com/advisory/ntap-20231103-0002/
CVE ID: CVE-2023-25585 State: PUBLISHED Published: 2023-09-14T20:50:09.526Z Last Updated: 2025-02-13T16:44:32.455Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: binutils, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora 37, Fedora 36, Extra Packages for Enterprise Linux 8, Extra Packages for Enterprise Linux 7, Fedora Problem Types: CWE-457 Description: A flaw was found in Binutils. The use of an uninitialized field in the struct module *module may lead to application crash and local denial of service. Additional Analyst Notes: - CVE Program Container: - CI
odule may lead to application crash and local denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-25585 - https://bugzilla.redhat.com/show_bug.cgi?id=2167498 - https://sourceware.org/bugzilla/show_bug.cgi?id=29892 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=65cf035b8dc1df5d8020e0b1449514a3c42933e7 - https://security.netapp.com/advisory/ntap-20231103-0003/
CVE ID: CVE-2023-25586 State: PUBLISHED Published: 2023-09-14T20:49:15.468Z Last Updated: 2025-02-13T16:44:33.064Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: binutils, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora 36, Fedora 37, Extra Packages for Enterprise Linux 7, Fedora, Extra Packages for Enterprise Linux 8 Problem Types: CWE-457 Description: A flaw was found in Binutils. A logic fail in the bfd_init_section_decompress_status function may lead to the use of an uninitialized variable that can cause a crash and local denial of service. Additional A
nction may lead to the use of an uninitialized variable that can cause a crash and local denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-25586 - https://bugzilla.redhat.com/show_bug.cgi?id=2167502 - https://sourceware.org/bugzilla/show_bug.cgi?id=29855 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5830876a0cca17bef3b2d54908928e72cca53502 - https://security.netapp.com/advisory/ntap-20231103-0003/
CVE ID: CVE-2023-25587 State: REJECTED Published: N/A Last Updated: 2023-03-30T00:00:00 Description: No description available.
CVE ID: CVE-2023-25588 State: PUBLISHED Published: 2023-09-14T20:47:16.974Z Last Updated: 2025-02-13T16:44:33.622Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: binutils, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora 37, Extra Packages for Enterprise Linux 8, Fedora 36, Extra Packages for Enterprise Linux 7, Fedora Problem Types: CWE-457 Description: A flaw was found in Binutils. The field `the_bfd` of `asymbol`struct is uninitialized in the `bfd_mach_o_get_synthetic_symtab` function, which may lead to an application crash and local denial of service. Ad
n the `bfd_mach_o_get_synthetic_symtab` function, which may lead to an application crash and local denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-25588 - https://bugzilla.redhat.com/show_bug.cgi?id=2167505 - https://sourceware.org/bugzilla/show_bug.cgi?id=29677 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=d12f8998d2d086f0a6606589e5aedb7147e6f2f1 - https://security.netapp.com/advisory/ntap-20231103-0003/
CVE ID: CVE-2023-25589 State: PUBLISHED Published: 2023-03-14T14:44:57.241Z Last Updated: 2025-02-27T15:47:19.189Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba ClearPass Policy Manager Problem Types: n/a Description: A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to create arbitrary users on the platform. A successful exploit allows an attacker to achieve total cluster compromise. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-202
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-003.txt
CVE ID: CVE-2023-25590 State: PUBLISHED Published: 2023-03-14T14:47:56.899Z Last Updated: 2025-02-27T15:13:47.661Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba ClearPass Policy Manager Problem Types: n/a Description: A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges to those of a higher role. A successful exploit allows malicious users to execute arbitrary code with root level privileges on the Linux instance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.co
. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-003.txt
CVE ID: CVE-2023-25591 State: PUBLISHED Published: 2023-03-14T14:49:52.855Z Last Updated: 2025-02-27T15:11:48.622Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba ClearPass Policy Manager Problem Types: n/a Description: A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further privileges on the ClearPass instance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
ain further privileges on the ClearPass instance. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-003.txt
CVE ID: CVE-2023-25592 State: PUBLISHED Published: 2023-03-14T14:51:34.731Z Last Updated: 2025-02-27T15:04:36.577Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba ClearPass Policy Manager Problem Types: n/a Description: Vulnerabilities within the web-based management interface of ClearPass Policy Manager could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. Additional Analyst Notes: - CVE Program Container: - CIS
in a victim's browser in the context of the affected interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-003.txt
CVE ID: CVE-2023-25593 State: PUBLISHED Published: 2023-03-14T14:52:11.824Z Last Updated: 2025-02-27T14:42:52.219Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba ClearPass Policy Manager Problem Types: n/a Description: Vulnerabilities within the web-based management interface of ClearPass Policy Manager could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. Additional Analyst Notes: - CVE Program Container: - CIS
CVE ID: CVE-2023-25594 State: PUBLISHED Published: 2023-03-14T14:54:00.852Z Last Updated: 2025-02-27T15:02:53.121Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba ClearPass Policy Manager Problem Types: n/a Description: A vulnerability in the web-based management interface of ClearPass Policy Manager allows an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of this vulnerability allows an attacker to complete state-changing actions in the web-based management interface that should not be allowed by their current level
complete state-changing actions in the web-based management interface that should not be allowed by their current level of authorization on the platform. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-003.txt
CVE ID: CVE-2023-25595 State: PUBLISHED Published: 2023-03-14T14:55:37.876Z Last Updated: 2025-02-27T18:57:18.302Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba ClearPass Policy Manager Problem Types: n/a Description: A vulnerability exists in the ClearPass OnGuard Ubuntu agent that allows for an attacker with local Ubuntu instance access to potentially obtain sensitive information. Successful Exploitation of this vulnerability allows an attacker to retrieve information that is of a sensitive nature to the ClearPass/OnGuard environment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
ve nature to the ClearPass/OnGuard environment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-003.txt
CVE ID: CVE-2023-25596 State: PUBLISHED Published: 2023-03-14T14:57:27.104Z Last Updated: 2025-02-27T15:01:58.110Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: Aruba ClearPass Policy Manager Problem Types: n/a Description: A vulnerability exists in ClearPass Policy Manager that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by ClearPass Policy Manager. Additional Analyst Notes: - CVE Program Container: - C
access to network services supported by ClearPass Policy Manager. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2023-003.txt
CVE ID: CVE-2023-25597 State: PUBLISHED Published: 2023-04-14T00:00:00.000Z Last Updated: 2025-02-07T21:13:37.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an unauthenticated attacker to download a shared file via a crafted request - including the exact path and filename - due to improper authentication control. A successful exploit could allow access to sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0002
CVE ID: CVE-2023-25598 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2025-01-17T15:15:45.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21.x, and 22.x through 22.24.1500.0 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the home.php page. A successful exploit could allow an attacker to execute arbitrary scripts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support
- CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0003
CVE ID: CVE-2023-25599 State: PUBLISHED Published: 2023-05-24T00:00:00 Last Updated: 2025-01-16T20:15:52.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2, 22.24.1500.0 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the test_presenter.php page. A successful exploit could allow an attacker to execute arbitrary scripts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/m
t: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0003
CVE ID: CVE-2023-25600 State: PUBLISHED Published: 2023-08-03T00:00:00 Last Updated: 2024-10-17T20:08:36.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in InsydeH2O. A malicious operating system can tamper with a runtime-writable EFI variable, leading to out-of-bounds memory reads and a denial of service. This is fixed in version 01.01.04.0016. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2023028
CVE ID: CVE-2023-25601 State: PUBLISHED Published: 2023-04-20T15:07:00.310Z Last Updated: 2025-02-13T16:44:34.179Z Vendors: Apache Software Foundation Products: Apache DolphinScheduler Problem Types: CWE-287 Description: On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version 3.0.0 to 3.1.1, you can turn off the python-gateway function by changing the value `python-gateway.enabled=false` in configuration file `application.yaml`. If you are using the python gateway, please upgrade to version
enabled=false` in configuration file `application.yaml`. If you are using the python gateway, please upgrade to version 3.1.2 or above. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/25g77jqczp3t8cz56hk1p65q7m6c64rf - http://www.openwall.com/lists/oss-security/2023/04/20/10
CVE ID: CVE-2023-25602 State: PUBLISHED Published: 2023-02-16T18:05:47.402Z Last Updated: 2024-10-23T14:48:20.993Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-121 Description: A stack-based buffer overflow in Fortinet FortiWeb 6.4 all versions, FortiWeb versions 6.3.17 and earlier, FortiWeb versions 6.2.6 and earlier, FortiWeb versions 6.1.2 and earlier, FortiWeb versions 6.0.7 and earlier, FortiWeb versions 5.9.1 and earlier, FortiWeb 5.8 all versions, FortiWeb 5.7 all versions, FortiWeb 5.6 all versions allows attacker to execute unauthorized code or commands via specially crafted command argum
, FortiWeb 5.6 all versions allows attacker to execute unauthorized code or commands via specially crafted command arguments. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-234
CVE ID: CVE-2023-25603 State: PUBLISHED Published: 2023-11-14T18:08:16.641Z Last Updated: 2024-08-30T18:07:23.910Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiDDoS-F, FortiADC Problem Types: CWE-942 Description: A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.0 - 6.4.1 allow an unauthorized attacker to carry out privileged actions and retrieve sensitive information via crafted web requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-518
CVE ID: CVE-2023-25604 State: PUBLISHED Published: 2023-10-10T16:49:40.699Z Last Updated: 2024-09-18T19:37:45.115Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiGuest Problem Types: CWE-532 Description: An insertion of sensitive information into log file vulnerability in Fortinet FortiGuest 1.0.0 allows a local attacker to access plaintext passwords in the RADIUS logs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-052
CVE ID: CVE-2023-25605 State: PUBLISHED Published: 2023-03-07T16:04:34.059Z Last Updated: 2024-10-23T14:31:53.263Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:X/RL:X/RC:X) Vendors: Fortinet Products: FortiSOAR Problem Types: CWE-284 Description: A improper access control vulnerability in Fortinet FortiSOAR 7.3.0 - 7.3.1 allows an attacker authenticated on the administrative interface to perform unauthorized actions via crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-050
CVE ID: CVE-2023-25606 State: PUBLISHED Published: 2023-07-11T16:52:51.034Z Last Updated: 2024-10-22T20:41:02.251Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiManager, FortiAnalyzer Problem Types: CWE-22 Description: An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-23] in FortiAnalyzer and FortiManager management interface 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4 all versions may allow a remote and authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests. Additional Analyst Notes: - CVE Program Contain
files from the underlying filesystem via specially crafted web requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-471
CVE ID: CVE-2023-25607 State: PUBLISHED Published: 2023-10-10T16:51:31.831Z Last Updated: 2024-10-22T20:57:26.476Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiAnalyzer, FortiManager, FortiADC Problem Types: CWE-78 Description: An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78 ] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions, FortiAnalyzer 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions and FortiADC 7.1.0, 7.0.0 through 7.0.3, 6.2 all ver
ugh 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions and FortiADC 7.1.0, 7.0.0 through 7.0.3, 6.2 all versions, 6.1 all versions, 6.0 all versions management interface may allow an authenticated attacker with at least READ permissions on system settings to execute arbitrary commands on the underlying shell due to an unsafe usage of the wordexp function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-352
CVE ID: CVE-2023-25608 State: PUBLISHED Published: 2023-09-13T12:28:51.497Z Last Updated: 2024-09-24T20:00:10.726Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiAP-W2, FortiAP-C, FortiAP, FortiAP-U, FortiAP-S Problem Types: CWE-792 Description: An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-W2 7.2.0 through 7.2.1, 7.0.3 through 7.0.5, 7.0.0 through 7.0.1, 6.4 all versions, 6.2 all versions, 6.0 all versions; FortiAP-C 5.4.0 through 5.4.4, 5.2 all versions; FortiAP 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4 all versions, 6.0 all
AP-C 5.4.0 through 5.4.4, 5.2 all versions; FortiAP 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4 all versions, 6.0 all versions; FortiAP-U 7.0.0, 6.2.0 through 6.2.5, 6.0 all versions, 5.4 all versions may allow an authenticated attacker to read arbitrary files via specially crafted command arguments. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-120
CVE ID: CVE-2023-25609 State: PUBLISHED Published: 2023-06-13T08:41:45.316Z Last Updated: 2024-10-22T20:45:50.969Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiAnalyzer, FortiManager Problem Types: CWE-918 Description: A server-side request forgery (SSRF) vulnerability [CWE-918] in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4.11 may allow a remote and authenticated attacker to access unauthorized files and services on the system via specially crafted web requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortigua
web requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-493
CVE ID: CVE-2023-25610 State: PUBLISHED Published: 2025-03-24T15:39:48.167Z Last Updated: 2025-03-24T18:42:44.673Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiSwitchManager, FortiAnalyzer, FortiOS-6K7K, FortiProxy, FortiOS, FortiManager, FortiWeb Problem Types: CWE-124 Description: A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version 2.0.12 and below and FortiOS-6K7K vers