Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-31466 State: PUBLISHED Published: 2024-05-14T22:04:39.665Z Last Updated: 2025-06-24T13:07:43.461Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-8 Instant and AOS-10 AP Description: There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. Additional Analy
esult in the ability to execute arbitrary code as a privileged user on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US
CVE ID: CVE-2024-31467 State: PUBLISHED Published: 2024-05-14T22:08:51.360Z Last Updated: 2025-06-24T13:20:29.703Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-8 Instant and AOS-10 AP Description: There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. Additional Analy
CVE ID: CVE-2024-31468 State: PUBLISHED Published: 2024-05-14T22:24:53.386Z Last Updated: 2025-06-24T13:23:16.767Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-8 Instant and AOS-10 AP Description: There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating syste
e vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US
CVE ID: CVE-2024-31469 State: PUBLISHED Published: 2024-05-14T22:25:46.354Z Last Updated: 2025-06-24T13:26:25.165Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-8 Instant and AOS-10 AP Description: There are buffer overflow vulnerabilities in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating syste
CVE ID: CVE-2024-31470 State: PUBLISHED Published: 2024-05-14T22:26:39.056Z Last Updated: 2025-06-24T13:29:06.597Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-8 Instant and AOS-10 AP Description: There is a buffer overflow vulnerability in the underlying SAE (Simultaneous Authentication of Equals) service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlyi
exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US
CVE ID: CVE-2024-31471 State: PUBLISHED Published: 2024-05-14T22:27:21.146Z Last Updated: 2025-06-24T14:26:02.859Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-8 Instant and AOS-10 AP Description: There is a command injection vulnerability in the underlying Central Communications service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system
s vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US
CVE ID: CVE-2024-31472 State: PUBLISHED Published: 2024-05-14T22:28:29.845Z Last Updated: 2025-06-24T14:57:21.615Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-8 Instant and AOS-10 AP Description: There are command injection vulnerabilities in the underlying Soft AP Daemon service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. Add
erabilities result in the ability to execute arbitrary code as a privileged user on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US
CVE ID: CVE-2024-31473 State: PUBLISHED Published: 2024-05-14T22:29:11.994Z Last Updated: 2025-06-24T15:11:19.420Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-8 Instant and AOS-10 AP Description: There is a command injection vulnerability in the underlying deauthentication service that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system. Addi
erability results in the ability to execute arbitrary code as a privileged user on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US
CVE ID: CVE-2024-31474 State: PUBLISHED Published: 2024-05-14T22:29:51.497Z Last Updated: 2025-06-24T15:12:08.560Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-8 Instant and AOS-10 AP Description: There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI (Aruba's Access Point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the affected Access Point Additional Analyst Notes: - CISA ADP Vulnric
rupt normal operation and impact the integrity of the affected Access Point Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US
CVE ID: CVE-2024-31475 State: PUBLISHED Published: 2024-05-14T22:30:27.186Z Last Updated: 2025-06-24T15:13:24.884Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-8 Instant and AOS-10 AP Description: There is an arbitrary file deletion vulnerability in the Central Communications service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to interrupt normal operation and impact the integrity of the affected Access Point. Additional Analyst Notes
he ability to interrupt normal operation and impact the integrity of the affected Access Point. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US
CVE ID: CVE-2024-31476 State: PUBLISHED Published: 2024-05-14T22:31:22.072Z Last Updated: 2025-06-24T15:14:48.403Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-8 Instant and AOS-10 AP Description: Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLoca
: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US
CVE ID: CVE-2024-31477 State: PUBLISHED Published: 2024-05-14T22:32:06.557Z Last Updated: 2025-06-24T15:15:50.694Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-8 Instant and AOS-10 AP Description: Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLoca
CVE ID: CVE-2024-31478 State: PUBLISHED Published: 2024-05-14T22:32:51.129Z Last Updated: 2025-06-24T15:01:43.100Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-8 Instant and AOS-10 AP Description: Multiple unauthenticated Denial-of-Service (DoS) vulnerabilities exists in the Soft AP daemon accessed via the PAPI protocol. Successful exploitation of these vulnerabilites result in the ability to interrupt the normal operation of the affected Access Point. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_
lnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US
CVE ID: CVE-2024-31479 State: PUBLISHED Published: 2024-05-14T22:33:38.302Z Last Updated: 2025-06-24T15:17:14.638Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-8 Instant and AOS-10 AP Description: Unauthenticated Denial of Service (DoS) vulnerabilities exist in the Central Communications service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647e
Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US
CVE ID: CVE-2024-31480 State: PUBLISHED Published: 2024-05-14T22:34:42.949Z Last Updated: 2025-06-24T15:19:49.638Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-8 Instant and AOS-10 AP Description: Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_U
Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US
CVE ID: CVE-2024-31481 State: PUBLISHED Published: 2024-05-14T22:35:29.359Z Last Updated: 2025-06-24T15:21:48.806Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-8 Instant and AOS-10 AP Description: Unauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_U
CVE ID: CVE-2024-31482 State: PUBLISHED Published: 2024-05-14T22:36:10.770Z Last Updated: 2025-06-24T15:22:57.371Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-8 Instant and AOS-10 AP Description: An unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected Access Point. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en
ulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US
CVE ID: CVE-2024-31483 State: PUBLISHED Published: 2024-05-14T22:37:06.652Z Last Updated: 2025-06-24T15:23:49.047Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: AOS-8 Instant and AOS-10 AP Description: An authenticated sensitive information disclosure vulnerability exists in the CLI service accessed via the PAPI protocol. Successful exploitation of this vulnerability results in the ability to read arbitrary files in the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLoc
t: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04647en_us&docLocale=en_US
CVE ID: CVE-2024-31484 State: PUBLISHED Published: 2024-05-14T10:02:23.871Z Last Updated: 2025-02-13T17:47:58.073Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Siemens Products: CPC80 Central Processing/Communication, CPCI85 Central Processing/Communication, CPCX26 Central Processing/Communication, ETA4 Ethernet Interface IEC60870-5-104, ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2, PCCX26 Ax 1703 PE, Contr, Communication Element Problem Types: CWE-170 Description: A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communication (All versions < V5.30), CPCX26 Central Processing/Commun
All versions < V16.41), CPCI85 Central Processing/Communication (All versions < V5.30), CPCX26 Central Processing/Communication (All versions < V06.02), ETA4 Ethernet Interface IEC60870-5-104 (All versions < V10.46), ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2 (All versions < V03.27), PCCX26 Ax 1703 PE, Contr, Communication Element (All versions < V06.05). The affected devices contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.s
ndition. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-871704.html - https://cert-portal.siemens.com/productcert/html/ssa-620338.html - http://seclists.org/fulldisclosure/2024/Jul/4
CVE ID: CVE-2024-31485 State: PUBLISHED Published: 2024-05-14T10:02:25.052Z Last Updated: 2025-02-13T17:47:58.693Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: CPCI85 Central Processing/Communication, SICORE Base system Problem Types: CWE-77 Description: A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.30), SICORE Base system (All versions < V1.3.0). The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges. Additional Analyst
uld allow an authenticated privileged remote attacker to execute arbitrary code with root privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-871704.html - http://seclists.org/fulldisclosure/2024/Jul/4
CVE ID: CVE-2024-31486 State: PUBLISHED Published: 2024-05-14T10:02:26.227Z Last Updated: 2025-11-03T20:37:15.279Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Siemens Products: OPUPI0 AMQP/MQTT Problem Types: CWE-312 Description: A vulnerability has been identified in OPUPI0 AMQP/MQTT (All versions < V5.30). The affected devices stores MQTT client passwords without sufficient protection on the devices. An attacker with remote shell access or physical access could retrieve the credentials leading to confidentiality loss. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/ht
st Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/html/ssa-871704.html - http://seclists.org/fulldisclosure/2024/Jul/4
CVE ID: CVE-2024-31487 State: PUBLISHED Published: 2024-04-09T14:24:21.862Z Last Updated: 2024-08-02T01:52:57.095Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiSandbox Problem Types: CWE-22 Description: A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiSandbox version 4.4.0 through 4.4.4 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.5 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.0 through 3.0.7 and 2.5.0 through 2.5.2 and 2.4.0 through 2.4.1 may allows attacker to information disclosure via crafted http requests. Additional Analyst Notes: - CISA ADP Vulnrichme
may allows attacker to information disclosure via crafted http requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-24-060
CVE ID: CVE-2024-31488 State: PUBLISHED Published: 2024-05-14T16:19:08.151Z Last Updated: 2024-08-02T01:52:57.296Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Fortinet Products: FortiNAC Problem Types: CWE-79 Description: An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 7.2.0 through 7.2.3 may allow a remote authenticated attacker to perform stored and reflected cross site scripting (XSS) attack via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
d cross site scripting (XSS) attack via crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-24-040
CVE ID: CVE-2024-31489 State: PUBLISHED Published: 2024-09-10T14:37:48.066Z Last Updated: 2024-09-10T17:52:01.310Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiClientMac, FortiClientEMS, FortiClientLinux, FortiClientWindows Problem Types: CWE-295 Description: AAn improper certificate validation vulnerability [CWE-295] in FortiClientWindows 7.2.0 through 7.2.2, 7.0.0 through 7.0.11, FortiClientLinux 7.2.0, 7.0.0 through 7.0.11 and FortiClientMac 7.0.0 through 7.0.11, 7.2.0 through 7.2.4 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the FortiGa
mote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the FortiGate and the FortiClient during the ZTNA tunnel creation Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-22-282
CVE ID: CVE-2024-31490 State: PUBLISHED Published: 2024-09-10T14:37:45.103Z Last Updated: 2024-09-10T16:21:56.672Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiSandbox Problem Types: CWE-200 Description: An exposure of sensitive information to an unauthorized actor in Fortinet FortiSandbox version 4.4.0 through 4.4.4 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.5 and 3.2.2 through 3.2.4 and 3.1.5 allows attacker to information disclosure via HTTP get requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-24-051
CVE ID: CVE-2024-31491 State: PUBLISHED Published: 2024-05-14T16:19:02.974Z Last Updated: 2024-08-26T18:50:05.200Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiSandbox Problem Types: CWE-602 Description: A client-side enforcement of server-side security in Fortinet FortiSandbox version 4.4.0 through 4.4.4 and 4.2.0 through 4.2.6 allows attacker to execute unauthorized code or commands via HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-24-054
CVE ID: CVE-2024-31492 State: PUBLISHED Published: 2024-04-10T13:24:56.859Z Last Updated: 2024-08-22T18:27:36.614Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:X/RC:X) Vendors: Fortinet Products: FortiClientMac Problem Types: CWE-73 Description: An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-345