Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-40680 State: PUBLISHED Published: 2023-11-30T12:21:54.791Z Last Updated: 2024-10-01T15:48:36.874Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Team Yoast Products: Yoast SEO Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Yoast Yoast SEO allows Stored XSS.This issue affects Yoast SEO: from n/a through 21.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wordpress-seo/wordpress-yoast-seo-plugin-21-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-40681 State: PUBLISHED Published: 2023-10-31T09:48:14.830Z Last Updated: 2024-09-06T15:25:30.515Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Groundhogg Inc. Products: Groundhogg Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Groundhogg Inc. Groundhogg plugin <= 2.7.11.10 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/groundhogg/wordpress-groundhogg-plugin-2-7-11-10-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-40682 State: PUBLISHED Published: 2023-10-13T15:41:07.361Z Last Updated: 2024-09-16T20:35:22.475Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: App Connect Enterprise Problem Types: CWE-532 Description: IBM App Connect Enterprise 12.0.1.0 through 12.0.8.0 contains an unspecified vulnerability that could allow a local privileged user to obtain sensitive information from API logs. IBM X-Force ID: 263833. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7051204 - https://exchange.xforce.ibmcloud.com/vulnerabilities/263833
CVE ID: CVE-2023-40683 State: PUBLISHED Published: 2024-01-19T00:54:43.947Z Last Updated: 2025-05-30T14:26:41.891Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: OpenPages with Watson Problem Types: CWE-285 Description: IBM OpenPages with Watson 8.3 and 9.0 could allow remote attacker to bypass security restrictions, caused by insufficient authorization checks. By authenticating as an OpenPages user and using non-public APIs, an attacker could exploit this vulnerability to bypass security and gain unauthorized administrative access to the application. IBM X-Force ID: 264005. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
cess to the application. IBM X-Force ID: 264005. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7107774 - https://exchange.xforce.ibmcloud.com/vulnerabilities/264005
CVE ID: CVE-2023-40684 State: PUBLISHED Published: 2023-10-04T13:38:40.057Z Last Updated: 2024-09-19T14:45:55.521Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: IBM Products: Content Navigator Problem Types: CWE-79 Description: IBM Content Navigator 3.0.11, 3.0.13, and 3.0.14 with IBM Daeja ViewOne Virtual is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 264019. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://h
X-Force ID: 264019. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://https://www.ibm.com/support/pages/node/7046226 - https://exchange.xforce.ibmcloud.com/vulnerabilities/264019
CVE ID: CVE-2023-40685 State: PUBLISHED Published: 2023-10-29T01:00:45.310Z Last Updated: 2024-09-16T18:54:28.892Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: i Problem Types: CWE-269 Description: Management Central as part of IBM i 7.2, 7.3, 7.4, and 7.5 Navigator contains a local privilege escalation vulnerability. A malicious actor with command line access to the operating system can exploit this vulnerability to elevate privileges to gain root access to the operating system. IBM X-Force ID: 264116. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7060686 - htt
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7060686 - https://exchange.xforce.ibmcloud.com/vulnerabilities/264116
CVE ID: CVE-2023-40686 State: PUBLISHED Published: 2023-10-29T00:58:26.748Z Last Updated: 2024-09-06T19:35:20.528Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: i Problem Types: CWE-269 Description: Management Central as part of IBM i 7.2, 7.3, 7.4, and 7.5 Navigator contains a local privilege escalation vulnerability. A malicious actor with command line access to the operating system can exploit this vulnerability to elevate privileges to gain component access to the operating system. IBM X-Force ID: 264114. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/706068
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7060686 - https://exchange.xforce.ibmcloud.com/vulnerabilities/264114
CVE ID: CVE-2023-40687 State: PUBLISHED Published: 2023-12-04T01:10:23.988Z Last Updated: 2025-02-13T17:08:38.501Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-20 Description: IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted RUNSTATS command on an 8TB table. IBM X-Force ID: 264809. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7087149 - https://exchange.xforce.ibmcloud.com/vulnerabilities/264809 - https://security.netapp.com/advisory/ntap
s/node/7087149 - https://exchange.xforce.ibmcloud.com/vulnerabilities/264809 - https://security.netapp.com/advisory/ntap-20240119-0001/
CVE ID: CVE-2023-40691 State: PUBLISHED Published: 2023-12-18T20:29:00.344Z Last Updated: 2024-08-02T18:38:51.164Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Cloud Pak for Business Automation Problem Types: CWE-200 Description: IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 may reveal sensitive information contained in application configuration to developer and administrator users. IBM X-Force ID: 264805. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7096365 - https://exchange.x
nalyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7096365 - https://exchange.xforce.ibmcloud.com/vulnerabilities/264805
CVE ID: CVE-2023-40692 State: PUBLISHED Published: 2023-12-03T23:51:06.202Z Last Updated: 2025-02-13T17:08:39.786Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-400 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, 11.5 is vulnerable to denial of service under extreme stress conditions. IBM X-Force ID: 264807. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7087157 - https://exchange.xforce.ibmcloud.com/vulnerabilities/264807 - https://security.netapp.com/advisory/ntap-202
de/7087157 - https://exchange.xforce.ibmcloud.com/vulnerabilities/264807 - https://security.netapp.com/advisory/ntap-20240119-0001/
CVE ID: CVE-2023-40694 State: PUBLISHED Published: 2024-05-07T21:09:08.715Z Last Updated: 2024-08-02T18:38:51.152Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Watson CP4D Data Stores Problem Types: CWE-532 Description: IBM Watson CP4D Data Stores 4.0.0 through 4.8.4 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 264838. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7150286 - https://exchange.xforce.ibmcloud.com/vulnerabilities/264838
CVE ID: CVE-2023-40695 State: PUBLISHED Published: 2024-05-03T18:18:46.183Z Last Updated: 2024-08-02T18:38:51.283Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Cognos Controller Problem Types: CWE-613 Description: IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 264938. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7149876 - https://exchange.xforce.ibmcloud.com/vulnerabilities/264938
CVE ID: CVE-2023-40696 State: PUBLISHED Published: 2024-05-03T17:34:30.280Z Last Updated: 2024-08-02T18:38:51.060Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Cognos Controller Problem Types: CWE-327 Description: IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 264939. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7149876 - https://exchange.xforce.ibmcloud.com/vulnerabilities/264939
CVE ID: CVE-2023-40699 State: PUBLISHED Published: 2023-12-01T20:59:35.849Z Last Updated: 2025-06-03T02:19:40.807Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-20 Description: IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation. IBM X-Force ID: 265161. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7067714 - https://exchange.xforce.ibmcloud.com/vulnerabilities/265161
CVE ID: CVE-2023-40702 State: PUBLISHED Published: 2024-07-09T15:38:47.415Z Last Updated: 2024-08-02T18:38:51.083Z Vendors: Ping Identity Products: PingOne MFA Integration Kit for PingFederate Problem Types: CWE-290 Description: PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able to exploit this vulnerability to authenticate as a target user if they have existing knowledge of the target user’s first-factor credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Ref
target user’s first-factor credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks1657303194394
CVE ID: CVE-2023-40703 State: PUBLISHED Published: 2023-11-27T09:08:31.251Z Last Updated: 2025-06-03T14:01:59.793Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-400 Description: Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to consume excessive resources, possibly leading to Denial of Service, by patching the field of a block using a specially crafted string. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2023-40704 State: PUBLISHED Published: 2024-07-18T16:33:27.444Z Last Updated: 2025-08-27T20:32:53.978Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Philips Products: Vue PACS Problem Types: CWE-1392 Description: The product does not require unique and complex passwords to be created during installation. Using Philips's default password could jeopardize the PACS system if the password was hacked or leaked. An attacker could gain access to the database impacting system availability and data integrity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-medical-advisories/
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-200-01 - http://www.philips.com/productsecurity
CVE ID: CVE-2023-40705 State: PUBLISHED Published: 2023-09-05T08:40:44.612Z Last Updated: 2024-09-30T17:27:52.788Z Vendors: i-PRO Co., Ltd. Products: VI Web Client Problem Types: Cross-site scripting (XSS) Description: Stored cross-site scripting vulnerability in Map setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inject an arbitrary script. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://downloadvi.com/downloads/IPServer/v7.9/796232/v796232RN.pdf - https://jvn.jp/en/jp/JVN60140221/
CVE ID: CVE-2023-40706 State: PUBLISHED Published: 2023-08-24T16:03:36.347Z Last Updated: 2024-10-02T20:24:51.286Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: OPTO 22 Products: SNAP PAC S1 Problem Types: CWE-307 Description: There is no limit on the number of login attempts in the web server for the SNAP PAC S1 Firmware version R10.3b. This could allow for a brute-force attack on the built-in web server login. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-02
CVE ID: CVE-2023-40707 State: PUBLISHED Published: 2023-08-24T16:05:48.352Z Last Updated: 2024-10-02T20:23:51.426Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: OPTO 22 Products: SNAP PAC S1 Problem Types: CWE-521 Description: There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-02
CVE ID: CVE-2023-40708 State: PUBLISHED Published: 2023-08-24T16:08:23.730Z Last Updated: 2024-10-02T20:20:36.186Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: OPTO 22 Products: SNAP PAC S1 Problem Types: CWE-1188 Description: The File Transfer Protocol (FTP) port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access some device files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-02
CVE ID: CVE-2023-40709 State: PUBLISHED Published: 2023-08-24T16:08:47.919Z Last Updated: 2024-09-13T16:16:40.330Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: OPTO 22 Products: SNAP PAC S1 Problem Types: CWE-770 Description: An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Firmware version R10.3b Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-02
CVE ID: CVE-2023-40710 State: PUBLISHED Published: 2023-08-24T16:09:25.235Z Last Updated: 2024-09-30T19:13:20.220Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: OPTO 22 Products: SNAP PAC S1 Problem Types: CWE-770 Description: An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Firmware version R10.3b Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-
s: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-02
CVE ID: CVE-2023-40711 State: PUBLISHED Published: 2023-08-20T00:00:00 Last Updated: 2024-10-08T14:30:36.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: Veilid before 0.1.9 does not check the size of uncompressed data during decompression upon an envelope receipt, which allows remote attackers to cause a denial of service (out-of-memory abort) via crafted packet data, as exploited in the wild in August 2023. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/veilid/veilid/-/blob/main/CHANGELOG.md
CVE ID: CVE-2023-40712 State: PUBLISHED Published: 2023-09-12T11:05:48.763Z Last Updated: 2024-09-25T15:23:45.803Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-200 Description: Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly advised to upgrade to version 2.7.1 or later which has removed the vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apac
ility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/33512 - https://github.com/apache/airflow/pull/33516 - https://lists.apache.org/thread/jw1yv4lt6hpowqbb0x4o3tdp0jhx2bts
CVE ID: CVE-2023-40714 State: PUBLISHED Published: 2025-04-02T08:06:48.075Z Last Updated: 2025-04-02T16:16:37.645Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiSIEM Problem Types: CWE-23 Description: A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege via uploading certain GUI elements Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-085
CVE ID: CVE-2023-40715 State: PUBLISHED Published: 2023-09-13T12:29:50.478Z Last Updated: 2024-09-24T19:56:35.906Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiTester Problem Types: CWE-312 Description: A cleartext storage of sensitive information vulnerability [CWE-312] in FortiTester 2.3.0 through 7.2.3 may allow an attacker with access to the DB contents to retrieve the plaintext password of external servers configured in the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-465
CVE ID: CVE-2023-40716 State: PUBLISHED Published: 2023-12-13T06:44:03.852Z Last Updated: 2024-08-02T18:38:51.171Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiTester Problem Types: CWE-78 Description: An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiTester 2.3.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments when running execute restore/backup . Additional Analyst Notes: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-22-345
CVE ID: CVE-2023-40717 State: PUBLISHED Published: 2023-09-13T12:29:45.466Z Last Updated: 2024-09-24T19:57:16.170Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiTester Problem Types: CWE-798 Description: A use of hard-coded credentials vulnerability [CWE-798] in FortiTester 2.3.0 through 7.2.3 may allow an attacker who managed to get a shell on the device to access the database via shell commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-245
CVE ID: CVE-2023-40718 State: PUBLISHED Published: 2023-10-10T16:49:04.727Z Last Updated: 2024-09-18T19:03:01.519Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:F/RL:O/RC:R) Vendors: Fortinet Products: IPS Engine Problem Types: CWE-436 Description: A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-090
CVE ID: CVE-2023-40719 State: PUBLISHED Published: 2023-11-14T18:08:08.383Z Last Updated: 2024-08-30T18:08:00.074Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiAnalyzer, FortiManager Problem Types: CWE-798 Description: A use of hard-coded credentials vulnerability in Fortinet FortiAnalyzer and FortiManager 7.0.0 - 7.0.8, 7.2.0 - 7.2.3 and 7.4.0 allows an attacker to access Fortinet private testing data via the use of static credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-177
CVE ID: CVE-2023-40720 State: PUBLISHED Published: 2024-05-14T16:19:12.993Z Last Updated: 2024-08-02T18:38:51.211Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiVoice Problem Types: CWE-639 Description: An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiVoiceEntreprise version 7.0.0 through 7.0.1 and before 6.4.8 allows an authenticated attacker to read the SIP configuration of other users via crafted HTTP or HTTPS requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-282
CVE ID: CVE-2023-40721 State: PUBLISHED Published: 2025-02-11T16:09:06.077Z Last Updated: 2025-02-12T15:52:51.412Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiOS, FortiSwitchManager, FortiProxy, FortiPAM Problem Types: CWE-134 Description: A use of externally-controlled format string vulnerability [CWE-134] in Fortinet FortiOS version 7.4.0 through 7.4.1 and before 7.2.6, FortiProxy version 7.4.0 and before 7.2.7, FortiPAM version 1.1.2 and before 1.0.3, FortiSwitchManager version 7.2.0 through 7.2.2 and before 7.0.2 allows a privileged attacker to execute arbitrary code or commands via specially crafted requests. Ad
2 and before 7.0.2 allows a privileged attacker to execute arbitrary code or commands via specially crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-261