Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-27438 State: PUBLISHED Published: 2022-06-06T22:21:30 Last Updated: 2024-08-03T05:25:32.729Z Vendors: n/a Products: n/a Problem Types: n/a Description: Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an affected installation to trigger the update check. Additional Analyst Notes: - CVE Program Container: References: - http://advanced.com - http://caphyon.com - https://gerr.re/posts/cve-2022-27438/ - https://www.advancedinstaller.co
s: - http://advanced.com - http://caphyon.com - https://gerr.re/posts/cve-2022-27438/ - https://www.advancedinstaller.com/security-updates-auto-updater.html
CVE ID: CVE-2022-27441 State: PUBLISHED Published: 2022-04-04T21:01:04 Last Updated: 2024-08-03T05:25:32.792Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Phone text box. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/happy_source/tpcms/issues/I3YUCJ
CVE ID: CVE-2022-27442 State: PUBLISHED Published: 2022-04-04T21:01:04 Last Updated: 2024-08-03T05:25:32.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: TPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information such as the administrator's user name and password. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/happy_source/tpcms/issues/I3YNWY
CVE ID: CVE-2022-27444 State: PUBLISHED Published: 2022-04-14T12:56:51 Last Updated: 2024-08-03T05:25:32.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_subselect.cc. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mariadb.org/browse/MDEV-28080 - https://security.netapp.com/advisory/ntap-20220526-0006/
CVE ID: CVE-2022-27445 State: PUBLISHED Published: 2022-04-14T12:56:52 Last Updated: 2024-08-03T05:25:32.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mariadb.org/browse/MDEV-28081 - https://security.netapp.com/advisory/ntap-20220526-0006/ - https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html
CVE ID: CVE-2022-27446 State: PUBLISHED Published: 2022-04-14T12:56:53 Last Updated: 2024-08-03T05:25:32.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.h. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mariadb.org/browse/MDEV-28082 - https://security.netapp.com/advisory/ntap-20220526-0006/
CVE ID: CVE-2022-27447 State: PUBLISHED Published: 2022-04-14T12:56:53 Last Updated: 2024-08-03T05:25:32.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: MariaDB Server v10.9 and below was discovered to contain a use-after-free via the component Binary_string::free_buffer() at /sql/sql_string.h. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mariadb.org/browse/MDEV-28099 - https://security.netapp.com/advisory/ntap-20220526-0006/ - https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html
CVE ID: CVE-2022-27448 State: PUBLISHED Published: 2022-04-14T12:56:55 Last Updated: 2024-08-03T05:25:32.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion failure in MariaDB Server v10.9 and below via 'node->pcur->rel_pos == BTR_PCUR_ON' at /row/row0mysql.cc. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mariadb.org/browse/MDEV-28095 - https://security.netapp.com/advisory/ntap-20220526-0006/ - https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html
CVE ID: CVE-2022-27449 State: PUBLISHED Published: 2022-04-14T12:56:55 Last Updated: 2024-08-03T05:25:32.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_func.cc:148. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mariadb.org/browse/MDEV-28089 - https://security.netapp.com/advisory/ntap-20220526-0006/ - https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html
CVE ID: CVE-2022-27451 State: PUBLISHED Published: 2022-04-14T12:57:00 Last Updated: 2024-08-03T05:25:32.691Z Vendors: n/a Products: n/a Problem Types: n/a Description: MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mariadb.org/browse/MDEV-28094 - https://security.netapp.com/advisory/ntap-20220526-0006/
CVE ID: CVE-2022-27452 State: PUBLISHED Published: 2022-04-14T12:57:00 Last Updated: 2024-08-03T05:25:32.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mariadb.org/browse/MDEV-28090 - https://security.netapp.com/advisory/ntap-20220526-0006/ - https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html
CVE ID: CVE-2022-27455 State: PUBLISHED Published: 2022-04-14T12:57:01 Last Updated: 2024-08-03T05:25:32.720Z Vendors: n/a Products: n/a Problem Types: n/a Description: MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_wildcmp_8bit_impl at /strings/ctype-simple.c. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mariadb.org/browse/MDEV-28097 - https://security.netapp.com/advisory/ntap-20220526-0007/
CVE ID: CVE-2022-27456 State: PUBLISHED Published: 2022-04-14T12:57:02 Last Updated: 2024-08-03T05:25:32.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mariadb.org/browse/MDEV-28093 - https://security.netapp.com/advisory/ntap-20220526-0007/ - https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html
CVE ID: CVE-2022-27457 State: PUBLISHED Published: 2022-04-14T12:57:02 Last Updated: 2024-08-03T05:25:32.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_mb_wc_latin1 at /strings/ctype-latin1.c. Additional Analyst Notes: - CVE Program Container: References: - https://jira.mariadb.org/browse/MDEV-28098 - https://security.netapp.com/advisory/ntap-20220526-0007/
CVE ID: CVE-2022-27458 State: REJECTED Published: N/A Last Updated: 2024-05-01T21:46:11.634970 Description: No description available.
CVE ID: CVE-2022-27461 State: PUBLISHED Published: 2022-05-04T14:04:08 Last Updated: 2024-08-03T05:25:32.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link. Additional Analyst Notes: - CVE Program Container: References: - http://nopcommerce.com - https://tf1t.gitbook.io/mycve/nopcommerce/open-redirect-on-nopcommerce-4.50.1
CVE ID: CVE-2022-27462 State: PUBLISHED Published: 2022-04-05T15:37:22 Last Updated: 2024-08-03T05:25:32.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php. Additional Analyst Notes: - CVE Program Container: References: - https://avideo.tube/ - https://github.com/WWBN/AVideo/commit/3722335f808484e6bfb5e71028fedddd942add4a
CVE ID: CVE-2022-27463 State: PUBLISHED Published: 2022-04-05T15:37:46 Last Updated: 2024-08-03T05:25:32.683Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page. Additional Analyst Notes: - CVE Program Container: References: - https://avideo.tube/ - https://github.com/WWBN/AVideo/commit/77e9aa6411ff4b97571eb82e587139ec05ff894c
CVE ID: CVE-2022-27466 State: PUBLISHED Published: 2022-05-02T13:24:49 Last Updated: 2024-08-03T05:25:32.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: MCMS v5.2.27 was discovered to contain a SQL injection vulnerability in the orderBy parameter at /dict/list.do. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ming-soft/MCMS/issues/90
CVE ID: CVE-2022-27468 State: PUBLISHED Published: 2022-04-26T13:43:14 Last Updated: 2024-08-03T05:25:32.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: Monstaftp v2.10.3 was discovered to contain an arbitrary file upload which allows attackers to execute arbitrary code via a crafted file uploaded to the web server. Additional Analyst Notes: - CVE Program Container: References: - https://www.monstaftp.com/ - https://www.youtube.com/playlist?list=PLGCNgyyYX0yG9rF3Pd72H7qE9sfRA7d_i
CVE ID: CVE-2022-27469 State: PUBLISHED Published: 2022-04-26T13:43:25 Last Updated: 2024-08-03T05:25:32.818Z Vendors: n/a Products: n/a Problem Types: n/a Description: Monstaftp v2.10.3 was discovered to allow attackers to execute Server-Side Request Forgery (SSRF). Additional Analyst Notes: - CVE Program Container: References: - https://www.monstaftp.com/ - https://www.youtube.com/playlist?list=PLGCNgyyYX0yG9rF3Pd72H7qE9sfRA7d_i
CVE ID: CVE-2022-27470 State: PUBLISHED Published: 2022-05-04T02:34:44 Last Updated: 2024-08-03T05:25:32.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: SDL_ttf v2.0.18 and below was discovered to contain an arbitrary memory write via the function TTF_RenderText_Solid(). This vulnerability is triggered via a crafted TTF file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libsdl-org/SDL_ttf/issues/187 - https://github.com/libsdl-org/SDL_ttf/commit/db1b41ab8bde6723c24b866e466cad78c2fa0448 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPYTEBBNHCDGPVFACC5RC5K2FZUCYTPZ/ - https://lists.fedor
archives/list/package-announce%40lists.fedoraproject.org/message/XPYTEBBNHCDGPVFACC5RC5K2FZUCYTPZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAGMQMRQDTZFQW64JEW3O6HY3JYLAAHT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RXI3MDPR24W5557G34YHWOP2MOK6BTGB/
CVE ID: CVE-2022-27472 State: PUBLISHED Published: 2022-04-12T15:30:29 Last Updated: 2024-08-03T05:25:32.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Topics Counting feature of Roothub 2.6.0 allows unauthorized attackers to execute arbitrary SQL commands via the "s" parameter remotely. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/miansen/Roothub/tree/v2.6 - https://github.com/Hyperkopite/Roothub_vulns/blob/main/SQLi.md
CVE ID: CVE-2022-27473 State: PUBLISHED Published: 2022-04-12T15:30:32 Last Updated: 2024-08-03T05:25:32.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Topics Searching feature of Roothub 2.6.0 allows unauthorized attackers to execute arbitrary SQL commands via the "s" parameter remotely. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/miansen/Roothub/tree/v2.6 - https://github.com/Hyperkopite/Roothub_vulns/blob/main/SQLi.md
CVE ID: CVE-2022-27474 State: PUBLISHED Published: 2022-04-15T12:55:32 Last Updated: 2024-08-03T05:25:32.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload injected into the FirstName text field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Mount4in/Mount4in.github.io/blob/master/suitecrm.docx - https://github.com/Mount4in/Mount4in.github.io/blob/master/poc.py
CVE ID: CVE-2022-27475 State: PUBLISHED Published: 2022-04-13T11:39:02 Last Updated: 2024-08-03T05:25:32.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross site scripting (XSS) vulnerability in tramyardg hotel-mgmt-system, allows attackers to execute arbitrary code when when /admin.php is loaded. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tramyardg/hotel-mgmt-system - https://github.com/tramyardg/hotel-mgmt-system/commit/3aa5fdd736927f4ba8d4b7efbba850a258ab42ce
CVE ID: CVE-2022-27476 State: PUBLISHED Published: 2022-04-10T21:01:37 Last Updated: 2024-08-03T05:25:32.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability at /admin/goods/update in Newbee-Mall v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the goodsName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/newbee-ltd/newbee-mall/issues/64
CVE ID: CVE-2022-27477 State: PUBLISHED Published: 2022-04-10T21:01:39 Last Updated: 2024-08-03T05:25:32.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: Newbee-Mall v1.0.0 was discovered to contain an arbitrary file upload via the Upload function at /admin/goods/edit. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/newbee-ltd/newbee-mall/issues/63
CVE ID: CVE-2022-27478 State: PUBLISHED Published: 2022-04-21T19:05:34 Last Updated: 2024-08-03T05:25:32.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: Victor v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component admin/profile.php?section=admin. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/k0xx11/Vulscve/blob/master/Victor1.0-rce.md
CVE ID: CVE-2022-27479 State: PUBLISHED Published: 2022-04-13T19:05:11 Last Updated: 2024-08-03T05:25:32.815Z Vendors: Apache Software Foundation Products: Apache Superset Problem Types: CWE-89 Description: Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/94th50j5d0y2fw7ysx0g7w3t6jk3z7q6 - https://lists.apache.org/thread/ztb9b6jd9rngoxwvq8r4fhpp401o613y - http://www.openwall.com/lists/oss-security/2022/04/13/3
CVE ID: CVE-2022-27480 State: PUBLISHED Published: 2022-04-12T09:08:03 Last Updated: 2024-08-03T05:25:32.710Z Vendors: Siemens Products: SICAM A8000 CP-8031, SICAM A8000 CP-8050 Problem Types: CWE-862 Description: A vulnerability has been identified in SICAM A8000 CP-8031 (All versions < V4.80), SICAM A8000 CP-8050 (All versions < V4.80). Affected devices do not require an user to be authenticated to access certain files. This could allow unauthenticated attackers to download these files. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-316850.pdf - http://seclists.org/fulldisclosure/2022/Apr/20 - http://packetstormsecurity.
iemens.com/productcert/pdf/ssa-316850.pdf - http://seclists.org/fulldisclosure/2022/Apr/20 - http://packetstormsecurity.com/files/166743/Siemens-A8000-CP-8050-CP-8031-SICAM-WEB-Missing-File-Download-Missing-Authentication.html
CVE ID: CVE-2022-27481 State: PUBLISHED Published: 2022-04-12T09:08:04 Last Updated: 2024-08-03T05:25:32.886Z Vendors: Siemens Products: SCALANCE W1788-1 M12, SCALANCE W1788-2 EEC M12, SCALANCE W1788-2 M12, SCALANCE W1788-2IA M12 Problem Types: CWE-362 Description: A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions < V3.0.0), SCALANCE W1788-2 EEC M12 (All versions < V3.0.0), SCALANCE W1788-2 M12 (All versions < V3.0.0), SCALANCE W1788-2IA M12 (All versions < V3.0.0). Affected devices do not properly handle resources of ARP requests. This could allow an attacker to cause a race condition that leads to a crash of the entire device. Additional Analyst Notes: - CVE Program
n attacker to cause a race condition that leads to a crash of the entire device. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-392912.pdf
CVE ID: CVE-2022-27482 State: PUBLISHED Published: 2023-02-16T18:06:42.848Z Last Updated: 2024-10-23T14:46:17.267Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiADC Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.6, 6.0.x, 5.x.x allows attacker to execute arbitrary shell code as `root` via CLI commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-046
CVE ID: CVE-2022-27483 State: PUBLISHED Published: 2022-07-18T16:40:20 Last Updated: 2024-10-25T13:30:52.271Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiManager, FortiAnalyzer Problem Types: Execute unauthorized code or commands Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager version 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.x and 6.0.x and FortiAnalyzer version 7.0.0 through 7.0.3, version 6.4.0 through 6.4.7, 6.2.x and 6.0.x allows attacker to execute arbitrary shell code as `root` user via `diagnose system` CLI commands.
.4.7, 6.2.x and 6.0.x allows attacker to execute arbitrary shell code as `root` user via `diagnose system` CLI commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-049
CVE ID: CVE-2022-27484 State: PUBLISHED Published: 2022-08-03T13:20:10 Last Updated: 2024-10-22T20:55:11.735Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiADC Problem Types: Improper access control Description: A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x allows an authenticated attacker to bypass the Old Password check in the password change form via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-055
CVE ID: CVE-2022-27485 State: PUBLISHED Published: 2023-04-11T16:07:08.880Z Last Updated: 2024-10-22T20:47:12.883Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiSandbox Problem Types: CWE-89 Description: A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox version 4.2.0, 4.0.0 through 4.0.2, 3.2.0 through 3.2.3, 3.1.x and 3.0.x allows a remote and authenticated attacker with read permission to retrieve arbitrary files from the underlying Linux system via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: - CISA ADP
om the underlying Linux system via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-060
CVE ID: CVE-2022-27486 State: PUBLISHED Published: 2024-08-13T15:51:57.242Z Last Updated: 2024-08-14T14:41:14.087Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C) Vendors: Fortinet Products: FortiDDoS, FortiDDoS-F Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiDDoS version 5.5.0 through 5.5.1, 5.4.2 through 5.4.0, 5.3.0 through 5.3.1, 5.2.0, 5.1.0, 5.0.0, 4.7.0, 4.6.0 and 4.5.0 and FortiDDoS-F version 6.3.0 through 6.3.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.4 allows an authenticated attacker to execute shell code as `root` via `execute` CLI commands. Add
.2, 6.1.0 through 6.1.4 allows an authenticated attacker to execute shell code as `root` via `execute` CLI commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-047
CVE ID: CVE-2022-27487 State: PUBLISHED Published: 2023-04-11T16:06:58.797Z Last Updated: 2024-10-23T14:28:34.806Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiDeceptor, FortiSandbox Problem Types: CWE-269 Description: A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0.0 through 4.0.2 and before 3.3.3 allows a remote authenticated attacker to perform unauthorized API calls via crafted HTTP or HTTPS requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortigua
TPS requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-056
CVE ID: CVE-2022-27488 State: PUBLISHED Published: 2023-12-13T06:39:42.998Z Last Updated: 2024-08-03T05:32:57.924Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H/E:P/RL:O/RC:C) Vendors: Fortinet Products: FortiVoice, FortiRecorder, FortiSwitch, FortiNDR, FortiMail Problem Types: CWE-352 Description: A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7, 6.0.x, FortiMail version 7.0.0 through 7.0.3, 6.4.0 through 6.4.6, 6.2.x, 6.0.x FortiRecorder version 6.4.0 through 6.4.2, 6.0.x, 2.7.x, 2.6.x, FortiNDR version 1.x.x allows a remote unauthenticated at
ortiRecorder version 6.4.0 through 6.4.2, 6.0.x, 2.7.x, 2.6.x, FortiNDR version 1.x.x allows a remote unauthenticated attacker to execute commands on the CLI via tricking an authenticated administrator to execute malicious GET requests. Additional Analyst Notes: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-22-038
CVE ID: CVE-2022-27489 State: PUBLISHED Published: 2023-02-16T18:06:40.150Z Last Updated: 2024-10-23T14:46:25.263Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C) Vendors: Fortinet Products: FortiExtender Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.0.0 through 7.0.3, 5.3.2, 4.2.4 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-048
CVE ID: CVE-2022-27490 State: PUBLISHED Published: 2023-03-07T16:04:57.843Z Last Updated: 2024-10-22T20:48:18.405Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiManager, FortiAnalyzer, FortiPortal, FortiSwitch Problem Types: CWE-200 Description: A exposure of sensitive information to an unauthorized actor in Fortinet FortiManager version 6.0.0 through 6.0.4, FortiAnalyzer version 6.0.0 through 6.0.4, FortiPortal version 6.0.0 through 6.0.9, 5.3.0 through 5.3.8, 5.2.x, 5.1.0, 5.0.x, 4.2.x, 4.1.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.x, 6.0.x allows an attacker which has obtained access to a