Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-32094 State: PUBLISHED Published: 2024-04-15T08:58:13.289Z Last Updated: 2024-08-02T02:06:43.592Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ChurchThemes Products: Church Content – Sermons, Events and More Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ChurchThemes Church Content – Sermons, Events and More.This issue affects Church Content – Sermons, Events and More: from n/a through 2.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/church-theme-content/wordpress-church-content-plugin-2-6-cross-site-request-
tps://patchstack.com/database/vulnerability/church-theme-content/wordpress-church-content-plugin-2-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-32095 State: PUBLISHED Published: 2024-04-15T08:57:05.238Z Last Updated: 2024-08-02T02:06:43.268Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: MultiParcels Products: MultiParcels Shipping For WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in MultiParcels MultiParcels Shipping For WooCommerce.This issue affects MultiParcels Shipping For WooCommerce: from n/a before 1.16.9. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/multiparcels-shipping-for-woocommerce/wordpress-multiparcels-shipping-for-woocommerce-
hstack.com/database/vulnerability/multiparcels-shipping-for-woocommerce/wordpress-multiparcels-shipping-for-woocommerce-plugin-1-16-9-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-32096 State: PUBLISHED Published: 2024-04-15T08:55:58.665Z Last Updated: 2024-08-02T02:06:43.516Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: DAEV.tech Products: WP Migration Plugin DB & Files – WP Synchro Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in DAEV.Tech WP Migration Plugin DB & Files – WP Synchro.This issue affects WP Migration Plugin DB & Files – WP Synchro: from n/a through 1.11.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wpsynchro/wordpress-wp-synchro-plugin-1-11-2-cross-site-request-forgery-c
https://patchstack.com/database/vulnerability/wpsynchro/wordpress-wp-synchro-plugin-1-11-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-32097 State: PUBLISHED Published: 2024-04-15T08:55:05.296Z Last Updated: 2024-08-02T02:06:43.923Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Eyal Fitoussi Products: GEO my WordPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Eyal Fitoussi GEO my WordPress.This issue affects GEO my WordPress: from n/a through 4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/geo-my-wp/wordpress-geo-my-wordpress-plugin-4-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-32098 State: PUBLISHED Published: 2024-04-15T07:39:07.547Z Last Updated: 2024-08-08T18:43:24.925Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: Page Visit Counter Products: Advanced Page Visit Counter Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit Counter.This issue affects Advanced Page Visit Counter: from n/a through 8.0.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/advanced-page-visit-counter/wordpress-advanced-page-visi
nt: References: - https://patchstack.com/database/vulnerability/advanced-page-visit-counter/wordpress-advanced-page-visit-counter-plugin-8-0-6-auth-sql-injection-sqli-vulnerability?_s_id=cve
CVE ID: CVE-2024-32099 State: PUBLISHED Published: 2024-04-15T08:54:08.665Z Last Updated: 2024-08-02T02:06:43.536Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: James Ward Products: WP Mail Catcher Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in James Ward WP Mail Catcher.This issue affects WP Mail Catcher: from n/a through 2.1.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-mail-catcher/wordpress-wp-mail-catcher-plugin-2-1-6-cross-site-request-forgery-vulnerability?_s_id=cve
CVE ID: CVE-2024-32100 State: PUBLISHED Published: 2024-05-13T09:22:40.482Z Last Updated: 2024-08-02T02:06:43.786Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Easy Digital Downloads Products: Easy Digital Downloads Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Easy Digital Downloads.This issue affects Easy Digital Downloads: from n/a through 3.2.11. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/easy-digital-downloads/wordpress-easy-digital-downloads-plugin-3-2-11-sensitive-data-exposure-vulnerability?
lnerability/easy-digital-downloads/wordpress-easy-digital-downloads-plugin-3-2-11-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2024-32101 State: PUBLISHED Published: 2024-04-15T08:49:01.162Z Last Updated: 2024-08-02T02:06:44.136Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Omnisend Products: Email Marketing for WooCommerce by Omnisend Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Omnisend Email Marketing for WooCommerce by Omnisend.This issue affects Email Marketing for WooCommerce by Omnisend: from n/a through 1.14.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/omnisend-connect/wordpress-email-marketing-for-woocommerce-plugin-1-14-3-cr
ttps://patchstack.com/database/vulnerability/omnisend-connect/wordpress-email-marketing-for-woocommerce-plugin-1-14-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-32102 State: PUBLISHED Published: 2024-04-15T08:45:32.655Z Last Updated: 2024-08-02T02:06:44.006Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Scott Kingsley Clark Products: Crony Cronjob Manager Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Scott Kingsley Clark Crony Cronjob Manager.This issue affects Crony Cronjob Manager: from n/a through 0.5.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/crony/wordpress-crony-cronjob-manager-plugin-0-5-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-32103 State: PUBLISHED Published: 2024-04-15T08:44:37.737Z Last Updated: 2024-08-08T16:11:50.306Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Siteimprove Products: Siteimprove Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Siteimprove.This issue affects Siteimprove: from n/a through 2.0.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/siteimprove/wordpress-siteimprove-plugin-2-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-32104 State: PUBLISHED Published: 2024-04-15T08:43:16.358Z Last Updated: 2024-08-02T02:06:43.592Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: XLPlugins Products: NextMove Lite Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in XLPlugins NextMove Lite.This issue affects NextMove Lite: from n/a through 2.18.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woo-thank-you-page-nextmove-lite/wordpress-nextmove-lite-plugin-2-18-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-32105 State: PUBLISHED Published: 2024-04-11T13:16:22.525Z Last Updated: 2024-08-02T02:06:44.092Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ELEXtensions Products: ELEX WooCommerce Dynamic Pricing and Discounts Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ELEXtensions ELEX WooCommerce Dynamic Pricing and Discounts.This issue affects ELEX WooCommerce Dynamic Pricing and Discounts: from n/a through 2.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/elex-woocommerce-dynamic-pricing-and-discounts/wordpress-el
References: - https://patchstack.com/database/vulnerability/elex-woocommerce-dynamic-pricing-and-discounts/wordpress-elex-woocommerce-dynamic-pricing-and-discounts-plugin-2-1-2-cross-site-request-forgery-csrf-vulnerability-2?_s_id=cve
CVE ID: CVE-2024-32106 State: PUBLISHED Published: 2024-04-11T13:00:38.388Z Last Updated: 2024-08-02T02:06:43.571Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WP Compress Products: WP Compress – Image Optimizer [All-In-One] Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Compress WP Compress – Image Optimizer [All-In-One].This issue affects WP Compress – Image Optimizer [All-In-One]: from n/a through 6.10.35. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-compress-image-optimizer/wordpress-wp-compress-plugin-6-10-35-cross-
- https://patchstack.com/database/vulnerability/wp-compress-image-optimizer/wordpress-wp-compress-plugin-6-10-35-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-32107 State: PUBLISHED Published: 2024-04-11T12:59:29.374Z Last Updated: 2024-08-02T02:06:43.686Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: XLPlugins Products: Finale Lite Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in XLPlugins Finale Lite.This issue affects Finale Lite: from n/a through 2.18.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/finale-woocommerce-sales-countdown-timer-discount/wordpress-finale-lite-sales-countdown-timer-discount-for-woocommerce-plugin-2-18-0-cross-site-request-forgery-csrf-vuln
/wordpress-finale-lite-sales-countdown-timer-discount-for-woocommerce-plugin-2-18-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-32108 State: PUBLISHED Published: 2024-04-11T12:56:26.373Z Last Updated: 2024-08-02T02:06:44.029Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Stephanie Leary Products: Convert Post Types Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Stephanie Leary Convert Post Types.This issue affects Convert Post Types: from n/a through 1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/convert-post-types/wordpress-convert-post-types-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-32109 State: PUBLISHED Published: 2024-04-11T12:54:51.461Z Last Updated: 2024-08-02T02:06:44.134Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Julien Berthelot / MPEmbed.com Products: WP Matterport Shortcode Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Julien Berthelot / MPEmbed.Com WP Matterport Shortcode allows Cross Site Request Forgery.This issue affects WP Matterport Shortcode: from n/a through 2.1.9. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/shortcode-gallery-for-matterport-showcase/wordpress-wp-mat
: References: - https://patchstack.com/database/vulnerability/shortcode-gallery-for-matterport-showcase/wordpress-wp-matterport-shortcode-plugin-2-1-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-32111 State: PUBLISHED Published: 2024-06-25T13:35:45.596Z Last Updated: 2024-08-02T02:06:44.011Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Automattic Products: WordPress Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.
8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wordpress/wordpress-core-6-5-5-contributor-arbitrary-html-file-read-windows-only-vulnera
tack.com/database/vulnerability/wordpress/wordpress-core-6-5-5-contributor-arbitrary-html-file-read-windows-only-vulnerability?_s_id=cve - https://wordpress.org/news/2024/06/wordpress-6-5-5/
CVE ID: CVE-2024-32112 State: PUBLISHED Published: 2024-04-11T12:01:39.193Z Last Updated: 2024-08-08T16:12:18.358Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Leadinfo Products: Leadinfo Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Leadinfo leadinfo. The patch was released under the same version which was reported as vulnerable. We consider the current version as vulnerable.This issue affects Leadinfo: from n/a through 1.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/leadinfo/wordpress-leadinfo-plugin-1-0-cross-site-reques
nt: References: - https://patchstack.com/database/vulnerability/leadinfo/wordpress-leadinfo-plugin-1-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2024-32113 State: PUBLISHED Published: 2024-05-08T14:50:07.272Z Last Updated: 2025-10-21T23:05:18.831Z Vendors: Apache Software Foundation Products: Apache OFBiz Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://ofbiz.apache.org/download.html - https://ofbiz.apache.org/security.html - https://issues.apache.org/jira/browse/OFBIZ-13006 - https://lists.apache.org/thread
s://ofbiz.apache.org/security.html - https://issues.apache.org/jira/browse/OFBIZ-13006 - https://lists.apache.org/thread/w6s60okgkxp2th1sr8vx0ndmgk68fqrd - http://www.openwall.com/lists/oss-security/2024/05/09/1
CVE ID: CVE-2024-32114 State: PUBLISHED Published: 2024-05-02T08:29:18.219Z Last Updated: 2024-08-02T02:06:44.047Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H) Vendors: Apache Software Foundation Products: Apache ActiveMQ Problem Types: CWE-1188 Description: In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API). To mitigate
kia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API). To mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement: <bean id="securityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping"> <property name="constraint" ref="securityConstraint" /> <property name="pathSpec" value="/" /> </bean> Or we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://activemq.apache.org/security-advisories.data/CVE-
CISA ADP Vulnrichment: - CVE Program Container: References: - https://activemq.apache.org/security-advisories.data/CVE-2024-32114-announcement.txt
CVE ID: CVE-2024-32115 State: PUBLISHED Published: 2025-01-14T14:10:01.318Z Last Updated: 2025-02-18T21:33:30.403Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiManager Problem Types: CWE-23 Description: A relative path traversal vulnerability [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 allows a privileged attacker to delete files from the underlying filesystem via crafted HTTP or HTTPs requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-097
CVE ID: CVE-2024-32116 State: PUBLISHED Published: 2024-11-12T18:53:54.318Z Last Updated: 2024-11-13T18:45:12.057Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiAnalyzer, FortiManager Problem Types: CWE-23 Description: Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5 and FortiAnalyzer-BigData version 7.4.0 and before 7.2.7 allows a privileged attacker to delete files from the underlying filesystem via crafted CLI requests. Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
es from the underlying filesystem via crafted CLI requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-099
CVE ID: CVE-2024-32117 State: PUBLISHED Published: 2024-11-12T18:53:50.491Z Last Updated: 2024-11-12T20:28:55.063Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiManager, FortiAnalyzer Problem Types: CWE-22 Description: An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.4.0 through 7.4.2 and below 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.2 and below 7.2.5 & FortiAnalyzer-BigData version 7.4.0 and below 7.2.7 allows a privileged attacker to read arbitrary files from the underlying system via crafted HTTP or HTTPs requests. Addi
allows a privileged attacker to read arbitrary files from the underlying system via crafted HTTP or HTTPs requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-115
CVE ID: CVE-2024-32118 State: PUBLISHED Published: 2024-11-12T18:53:56.156Z Last Updated: 2024-11-12T20:27:32.113Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiAnalyzer, FortiManager Problem Types: CWE-78 Description: Multiple improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, Fortinet FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5 and Fortinet FortiAnalyzer-BigData before 7.4.0 allows an authenticated privileged attacker to execute unauthorized code or commands via crafte
zer-BigData before 7.4.0 allows an authenticated privileged attacker to execute unauthorized code or commands via crafted CLI requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-116
CVE ID: CVE-2024-32119 State: PUBLISHED Published: 2025-06-10T16:36:15.059Z Last Updated: 2025-06-10T19:39:57.140Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiClientEMS Problem Types: CWE-1390 Description: An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7.4.0 and before 7.2.4 allows an unauthenticated attacker with the knowledge of the targeted user's FCTUID and VDOM to perform operations such as uploading or tagging on behalf of the targeted user via specially crafted TCP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/p
crafted TCP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-375
CVE ID: CVE-2024-32122 State: PUBLISHED Published: 2025-04-08T14:02:57.071Z Last Updated: 2025-11-18T17:01:21.727Z Severity: LOW (CVSS 2.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:C) Vendors: Fortinet Products: FortiOS Problem Types: CWE-257 Description: A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to information disclosure via modification of LDAP server IP to point to a malicious server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-111
CVE ID: CVE-2024-32123 State: PUBLISHED Published: 2025-03-11T14:54:38.345Z Last Updated: 2025-03-12T04:00:45.328Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiManager, FortiAnalyzer Problem Types: CWE-78 Description: Multiple improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2 7.2.0 through 7.2.5 and 7.0.0 through 7.0.12 and 6.4.0 through 6.4.14 and 6.2.0 through 6.2.12 and 6.0.0 through 6.0.12 and 5.6.0 through 5.6.11 and 5.4.0 through 5.4.7 and 5.2.0 through 5.2.10 and 5.0.0 through 5.0.12 and 4.3.4 through 4
2 and 5.6.0 through 5.6.11 and 5.4.0 through 5.4.7 and 5.2.0 through 5.2.10 and 5.0.0 through 5.0.12 and 4.3.4 through 4.3.8 allows attacker to execute unauthorized code or commands via crafted CLI requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-24-124
CVE ID: CVE-2024-32124 State: PUBLISHED Published: 2025-07-18T08:08:21.544Z Last Updated: 2025-07-18T13:45:22.747Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiIsolator Problem Types: CWE-284 Description: An improper access control vulnerability [CWE-284] in FortiIsolator version 2.4.4, version 2.4.3, 2.3 all versions logging component may allow a remote authenticated read-only attacker to alter logs via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-24-045