Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-36520 State: PUBLISHED Published: 2023-12-20T14:18:41.504Z Last Updated: 2024-08-02T16:52:52.360Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: MarketingFire Products: Editorial Calendar Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar.This issue affects Editorial Calendar: from n/a through 3.7.12. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/editorial-calendar/wordpress-editorial-calendar-plugin-3-7-12-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2023-36521 State: PUBLISHED Published: 2023-07-11T09:07:13.637Z Last Updated: 2024-11-21T14:09:57.839Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC MV540 H, SIMATIC MV540 S, SIMATIC MV550 H, SIMATIC MV550 S, SIMATIC MV560 U, SIMATIC MV560 X Problem Types: CWE-770 Description: A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4), SIMATIC MV550 S (All versions < V3.3.4), SIMATIC MV560 U (All versions < V3.3.4), SIMATIC MV560 X (All versions < V3.3.4). The result synchronization server of the affected p
U (All versions < V3.3.4), SIMATIC MV560 X (All versions < V3.3.4). The result synchronization server of the affected products contains a vulnerability that may lead to a denial of service condition. An attacker may cause a denial of service situation of all socket-based communication of the affected products if the result server is enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-561322.pdf
CVE ID: CVE-2023-36522 State: PUBLISHED Published: 2023-07-11T12:34:23.399Z Last Updated: 2024-10-07T17:30:34.384Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WePupil Products: Quiz Expert Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WePupil Quiz Expert plugin <= 1.5.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/quiz-expert/wordpress-quiz-expert-easy-quiz-maker-exam-and-test-manager-plugin-1-5-0-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2023-36523 State: PUBLISHED Published: 2023-11-30T15:20:02.964Z Last Updated: 2024-10-01T14:26:46.612Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Gopi Ramasamy Products: Email download link Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gopi Ramasamy Email download link.This issue affects Email download link: from n/a through 3.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/email-download-link/wordpress-email-download-link-plugin-3-7-sensitive-data-exposure?_s_id=cve
CVE ID: CVE-2023-36526 State: PUBLISHED Published: 2024-12-13T14:23:44.267Z Last Updated: 2024-12-13T20:45:40.834Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: Inqsys Technology Products: Duplicate Post Page Menu & Custom Post Type Problem Types: CWE-862 Description: Missing Authorization vulnerability in Inqsys Technology Duplicate Post Page Menu & Custom Post Type allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Duplicate Post Page Menu & Custom Post Type: from n/a through 2.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/duplicate-post-page-
lyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/duplicate-post-page-menu-custom-post-type/vulnerability/wordpress-duplicate-post-page-menu-custom-post-type-plugin-2-3-1-broken-access-control?_s_id=cve
CVE ID: CVE-2023-36527 State: PUBLISHED Published: 2023-11-07T16:04:27.473Z Last Updated: 2024-09-04T19:05:58.474Z Vendors: BestWebSoft Products: Post to CSV by BestWebSoft Problem Types: CWE-1236 Description: Improper Neutralization of Formula Elements in a CSV File vulnerability in BestWebSoft Post to CSV by BestWebSoft.This issue affects Post to CSV by BestWebSoft: from n/a through 1.4.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/post-to-csv/wordpress-post-to-csv-by-bestwebsoft-plugin-1-4-0-csv-injection?_s_id=cve
CVE ID: CVE-2023-36528 State: PUBLISHED Published: 2024-12-13T14:23:45.352Z Last Updated: 2024-12-13T20:44:59.613Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: FeedbackWP Products: kk Star Ratings Problem Types: CWE-862 Description: Missing Authorization vulnerability in FeedbackWP kk Star Ratings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects kk Star Ratings: from n/a through 5.4.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/kk-star-ratings/vulnerability/wordpress-kk-star-ratings-plugin-5-4-3-rate-manipulation-due-to-ip-spoofing-vulnerabilit
n/kk-star-ratings/vulnerability/wordpress-kk-star-ratings-plugin-5-4-3-rate-manipulation-due-to-ip-spoofing-vulnerability?_s_id=cve
CVE ID: CVE-2023-36529 State: PUBLISHED Published: 2023-11-03T16:52:28.548Z Last Updated: 2025-02-19T21:22:48.536Z Vendors: Favethemes Products: Houzez - Real Estate WordPress Theme Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme allows SQL Injection.This issue affects Houzez - Real Estate WordPress Theme: from n/a through 1.3.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/houzez-crm/wordpress-houzez-crm-plugin-1-3-3-sql-injection?_s_id=cve
CVE ID: CVE-2023-36530 State: PUBLISHED Published: 2023-08-10T11:52:34.545Z Last Updated: 2024-09-25T15:04:21.299Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Smartypants Products: SP Project & Document Manager Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Smartypants SP Project & Document Manager plugin <= 4.67 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/sp-client-document-manager/wordpress-sp-project-document-manager-plugin-4-67-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-36531 State: PUBLISHED Published: 2024-12-13T14:23:46.460Z Last Updated: 2024-12-13T20:44:11.994Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: LiquidPoll Products: LiquidPoll – Advanced Polls for Creators and Brands Problem Types: CWE-862 Description: Missing Authorization vulnerability in LiquidPoll LiquidPoll – Advanced Polls for Creators and Brands allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LiquidPoll – Advanced Polls for Creators and Brands: from n/a through 3.3.68. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-poll/v
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-poll/vulnerability/wordpress-liquidpoll-advanced-polls-for-creators-and-brands-plugin-3-3-68-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-36532 State: PUBLISHED Published: 2023-08-08T17:30:58.217Z Last Updated: 2024-10-09T16:25:28.757Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Zoom Video Communications, Inc. Products: Zoom Clients Problem Types: CWE-122 Description: Buffer overflow in Zoom Clients before 5.14.5 may allow an unauthenticated user to enable a denial of service via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-36533 State: PUBLISHED Published: 2023-08-08T17:33:47.868Z Last Updated: 2024-10-04T15:05:48.927Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) Vendors: Zoom Video Communications, Inc. Products: Zoom SDK's Problem Types: CWE-772 Description: Uncontrolled resource consumption in Zoom SDKs before 5.14.7 may allow an unauthenticated user to enable a denial of service via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-36534 State: PUBLISHED Published: 2023-08-08T17:35:29.278Z Last Updated: 2024-10-10T16:23:44.862Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H) Vendors: Zoom Video Communications, Inc. Products: Zoom Desktop Client for Windows Problem Types: CWE-22 Description: Path traversal in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-36535 State: PUBLISHED Published: 2023-08-08T17:39:51.259Z Last Updated: 2024-10-08T15:03:49.453Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: Zoom Video Communications, Inc. Products: Zoom Clients Problem Types: CWE-449 Description: Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow an authenticated user to enable information disclosure via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-36536 State: PUBLISHED Published: 2023-07-11T17:06:59.410Z Last Updated: 2024-11-07T19:22:23.853Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Zoom Video Communications, Inc. Products: Zoom Rooms for Windows Problem Types: CWE-426 Description: Untrusted search path in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-36537 State: PUBLISHED Published: 2023-07-11T17:09:13.924Z Last Updated: 2024-10-23T15:41:06.781Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L) Vendors: Zoom Video Communications, Inc. Products: Zoom Rooms for Windows Problem Types: CWE-354 Description: Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-36538 State: PUBLISHED Published: 2023-07-11T17:12:17.255Z Last Updated: 2024-10-23T15:41:31.288Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) Vendors: Zoom Video Communications, Inc. Products: Zoom Rooms for Windows Problem Types: CWE-426 Description: Improper access control in Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-36539 State: PUBLISHED Published: 2023-06-30T02:01:21.401Z Last Updated: 2024-10-28T13:04:46.477Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Zoom Video Communications, Inc. Products: Zoom clients Problem Types: CWE-200, CWE-325 Description: Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-36540 State: PUBLISHED Published: 2023-08-08T17:05:59.963Z Last Updated: 2024-10-04T17:30:41.001Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L) Vendors: Zoom Video Communications, Inc. Products: Zoom Desktop Client for Windows Problem Types: CWE-426 Description: Untrusted search path in the installer for Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-36541 State: PUBLISHED Published: 2023-08-08T17:27:48.651Z Last Updated: 2024-10-10T16:24:14.613Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Zoom Video Communications, Inc. Products: Zoom Desktop Client for Windows Problem Types: CWE-345 Description: Insufficient verification of data authenticity in Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://explore.zoom.us/en/trust/security/security-bulletin/
CVE ID: CVE-2023-36542 State: PUBLISHED Published: 2023-07-29T07:12:18.290Z Last Updated: 2025-02-13T16:56:21.633Z Vendors: Apache Software Foundation Products: Apache NiFi Problem Types: CWE-94 Description: Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services a
ts to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nifi.apache.org/security.html#CVE-2023-36542 - https://lists.apache.org/thread/swnly3dzhhq9zo3rofc8djq77stkhbof - http://seclists.org/fulldisclosure/2023/Jul/43 - http://www.openwall.com/lists/oss-security/2023/07/29/1
CVE ID: CVE-2023-36543 State: PUBLISHED Published: 2023-07-12T09:17:33.707Z Last Updated: 2024-10-04T13:47:18.046Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-1333 Description: Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. It is recommended to upgrade to a version that is not affected Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/32060 - https://lists.apache.org/thread/tokfs980504ylgk3cv3hjlnrtbv4tng4
CVE ID: CVE-2023-36546 State: REJECTED Published: N/A Last Updated: 2023-12-31T02:44:59.796305 Description: No description available.
CVE ID: CVE-2023-36547 State: PUBLISHED Published: 2023-10-10T16:51:12.378Z Last Updated: 2024-09-19T20:21:28.861Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiWLM Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-140
CVE ID: CVE-2023-36548 State: PUBLISHED Published: 2023-10-10T16:51:16.655Z Last Updated: 2024-09-19T14:19:29.346Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiWLM Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-140
CVE ID: CVE-2023-36549 State: PUBLISHED Published: 2023-10-10T16:50:59.929Z Last Updated: 2024-09-17T14:07:15.737Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiWLM Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-140
CVE ID: CVE-2023-36550 State: PUBLISHED Published: 2023-10-10T16:51:03.814Z Last Updated: 2024-09-19T19:18:15.075Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiWLM Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-140
CVE ID: CVE-2023-36551 State: PUBLISHED Published: 2023-09-13T12:29:10.219Z Last Updated: 2024-09-24T19:59:51.691Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiSIEM Problem Types: CWE-200 Description: A exposure of sensitive information to an unauthorized actor in Fortinet FortiSIEM version 6.7.0 through 6.7.5 allows attacker to information disclosure via a crafted http request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-126
CVE ID: CVE-2023-36553 State: PUBLISHED Published: 2023-11-14T18:05:29.387Z Last Updated: 2024-10-22T20:53:32.183Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:X) Vendors: Fortinet Products: FortiSIEM Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 5.4.0 and 5.3.0 through 5.3.3 and 5.2.5 through 5.2.8 and 5.2.1 through 5.2.2 and 5.1.0 through 5.1.3 and 5.0.0 through 5.0.1 and 4.10.0 and 4.9.0 and 4.7.2 allows attacker to execute unauthorized code or commands via crafted API requests. Additional Analyst Notes: - CVE Program Container: - CISA AD
ute unauthorized code or commands via crafted API requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-135
CVE ID: CVE-2023-36554 State: PUBLISHED Published: 2024-03-12T15:09:16.256Z Last Updated: 2024-08-02T16:52:52.352Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiManager Problem Types: CWE-284 Description: A improper access control in Fortinet FortiManager version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.10, version 6.4.0 through 6.4.13, 6.2 all versions allows attacker to execute unauthorized code or commands via specially crafted HTTP requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-103
CVE ID: CVE-2023-36555 State: PUBLISHED Published: 2023-10-10T16:48:32.638Z Last Updated: 2024-09-18T18:10:30.449Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiOS Problem Types: CWE-80 Description: An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-104
CVE ID: CVE-2023-36556 State: PUBLISHED Published: 2023-10-10T16:49:50.906Z Last Updated: 2024-10-22T20:57:57.262Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiMail Problem Types: CWE-863 Description: An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an authenticated attacker to login on other users accounts from the same web domain via crafted HTTP or HTTPs requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-202
CVE ID: CVE-2023-36557 State: PUBLISHED Published: 2023-10-10T17:08:02.542Z Last Updated: 2025-04-14T22:46:34.235Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) Vendors: Microsoft Products: Windows 11 version 22H2, Windows 10 Version 22H2, Windows Server 2022, Windows 10 Version 21H2, Windows 11 version 21H2, Windows 10 Version 1809, Windows Server 2019, Windows 10 Version 1507, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 10 Version 1607, Windows Server 2019 (Server Core installation) Problem Types: Remote Code Execution Description: PrintHTML API Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP V
ote Code Execution Description: PrintHTML API Remote Code Execution Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36557
CVE ID: CVE-2023-36558 State: PUBLISHED Published: 2023-11-14T21:35:31.499Z Last Updated: 2025-10-09T00:00:12.174Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C) Vendors: Microsoft Products: .NET 6.0, ASP.NET Core 6.0, .NET 7.0, Microsoft Visual Studio 2022 version 17.2, .NET 8.0, Microsoft Visual Studio 2022 version 17.4, Microsoft Visual Studio 2022 version 17.6, Microsoft Visual Studio 2022 version 17.7, ASP.NET Core 7.0, ASP.NET Core 8.0 Problem Types: Security Feature Bypass Description: ASP.NET Core Security Feature Bypass Vulnerability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsof
rability Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36558
CVE ID: CVE-2023-36559 State: PUBLISHED Published: 2023-10-13T20:36:10.925Z Last Updated: 2025-04-14T22:46:41.145Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C) Vendors: Microsoft Products: Microsoft Edge (Chromium-based) Problem Types: Spoofing Description: Microsoft Edge (Chromium-based) Spoofing Vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36559