Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-22261 State: PUBLISHED Published: 2022-05-13T15:03:44 Last Updated: 2024-08-03T03:07:50.416Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Unstrict verification vulnerability Description: The HiAIserver has a vulnerability in verifying the validity of the weight used in the model.Successful exploitation of this vulnerability will affect AI services. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2022/5/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202205-0000001245813162
CVE ID: CVE-2022-22262 State: PUBLISHED Published: 2022-03-01T01:55:19.047855Z Last Updated: 2024-09-17T01:45:46.992Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: ASUS Products: Armoury Crate & Aura Creator Installer (ROG Live Service) Problem Types: CWE-59 Description: ROG Live Service’s function for deleting temp files created by installation has an improper link resolution before file access vulnerability. Since this function does not validate the path before deletion, an unauthenticated local attacker can create an unexpected symbolic link to system file path, to delete arbitrary system files and disrupt system service. Additional Analyst Notes: - CVE P
link to system file path, to delete arbitrary system files and disrupt system service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5693-f108f-1.html
CVE ID: CVE-2022-22263 State: PUBLISHED Published: 2022-01-07T22:39:12 Last Updated: 2024-08-03T03:07:50.423Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-269 Description: Unprotected dynamic receiver in SecSettings prior to SMR Jan-2022 Release 1 allows untrusted applications to launch arbitrary activity. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1
CVE ID: CVE-2022-22264 State: PUBLISHED Published: 2022-01-07T22:39:13 Last Updated: 2024-08-03T03:07:50.201Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-20 Description: Improper sanitization of incoming intent in Dressroom prior to SMR Jan-2022 Release 1 allows local attackers to read and write arbitrary files without permission. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1
CVE ID: CVE-2022-22265 State: PUBLISHED Published: 2022-01-07T22:39:11.000Z Last Updated: 2025-10-21T23:15:49.879Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-703 Description: An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1
CVE ID: CVE-2022-22266 State: PUBLISHED Published: 2022-01-07T22:39:12 Last Updated: 2024-08-03T03:07:50.211Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-269 Description: (Applicable to China models only) Unprotected WifiEvaluationService in TencentWifiSecurity application prior to SMR Jan-2022 Release 1 allows untrusted applications to get WiFi information without proper permission. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1
CVE ID: CVE-2022-22267 State: PUBLISHED Published: 2022-01-07T22:39:15 Last Updated: 2024-08-03T03:07:50.202Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-285 Description: Implicit Intent hijacking vulnerability in ActivityMetricsLogger prior to SMR Jan-2022 Release 1 allows attackers to get running application information. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1
CVE ID: CVE-2022-22268 State: PUBLISHED Published: 2022-01-07T22:39:14 Last Updated: 2024-08-03T03:07:50.404Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-285 Description: Incorrect implementation of Knox Guard prior to SMR Jan-2022 Release 1 allows physically proximate attackers to temporary unlock the Knox Guard via Samsung DeX mode. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1
CVE ID: CVE-2022-22269 State: PUBLISHED Published: 2022-01-07T22:39:16 Last Updated: 2024-08-03T03:07:50.392Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-285 Description: Keeping sensitive data in unprotected BluetoothSettingsProvider prior to SMR Jan-2022 Release 1 allows untrusted applications to get a local Bluetooth MAC address. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1
CVE ID: CVE-2022-22270 State: PUBLISHED Published: 2022-01-07T22:39:17 Last Updated: 2024-08-03T03:07:50.151Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-94 Description: An implicit Intent hijacking vulnerability in Dialer prior to SMR Jan-2022 Release 1 allows unprivileged applications to access contact information. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1
CVE ID: CVE-2022-22271 State: PUBLISHED Published: 2022-01-07T22:39:18 Last Updated: 2024-08-03T03:07:50.314Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-125 Description: A missing input validation before memory copy in TIMA trustlet prior to SMR Jan-2022 Release 1 allows attackers to copy data from arbitrary memory. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1
CVE ID: CVE-2022-22272 State: PUBLISHED Published: 2022-01-07T22:39:15 Last Updated: 2024-08-03T03:07:50.280Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-285 Description: Improper authorization in TelephonyManager prior to SMR Jan-2022 Release 1 allows attackers to get IMSI without READ_PRIVILEGED_PHONE_STATE permission Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1
CVE ID: CVE-2022-22273 State: PUBLISHED Published: 2022-03-17T01:40:09 Last Updated: 2024-08-03T03:07:50.311Z Vendors: SonicWall Products: SonicWall SRA/SMA100 Problem Types: CWE-78 Description: Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile Access (SMA) 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier versions and Secure Mobile Access (SMA) 100 series products running older firmware 9.0.0.9-26sv and earlier versions Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
.0.0.9-26sv and earlier versions Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0001
CVE ID: CVE-2022-22274 State: PUBLISHED Published: 2022-03-25T23:05:09 Last Updated: 2024-08-03T03:07:50.278Z Vendors: SonicWall Products: SonicOS Problem Types: CWE-121 Description: A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution in the firewall. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0003
CVE ID: CVE-2022-22275 State: PUBLISHED Published: 2022-04-27T16:25:13 Last Updated: 2024-08-03T03:07:50.213Z Vendors: SonicWall Products: SonicOS Problem Types: CWE-400 Description: Improper Restriction of TCP Communication Channel in HTTP/S inbound traffic from WAN to DMZ bypassing security policy until TCP handshake potentially resulting in Denial of Service (DoS) attack if a target host is vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0004
CVE ID: CVE-2022-22276 State: PUBLISHED Published: 2022-04-27T16:25:15 Last Updated: 2024-08-03T03:07:50.191Z Vendors: SonicWall Products: SonicOS Problem Types: CWE-200 Description: A vulnerability in SonicOS SNMP service resulting exposure of sensitive information to an unauthorized user. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0004
CVE ID: CVE-2022-22277 State: PUBLISHED Published: 2022-04-27T16:25:16 Last Updated: 2024-08-03T03:07:50.394Z Vendors: SonicWall Products: SonicOS Problem Types: CWE-200 Description: A vulnerability in SonicOS SNMP service resulting exposure of Wireless Access Point sensitive information in cleartext. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0004
CVE ID: CVE-2022-22278 State: PUBLISHED Published: 2022-04-27T16:25:18 Last Updated: 2024-08-03T03:07:50.277Z Vendors: SonicWall Products: SonicOS Problem Types: CWE-770 Description: A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when users try to access prohibited resource this allows an attacker to cause HTTP Denial of Service (DoS) attack Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0004
CVE ID: CVE-2022-22279 State: PUBLISHED Published: 2022-04-13T05:35:09 Last Updated: 2024-08-03T03:07:50.200Z Vendors: SonicWall Products: SonicWall SRA/SMA100 Problem Types: CWE-23 Description: A post-authentication arbitrary file read vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile Access (SMA) 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier versions and Secure Mobile Access (SMA) 100 series products running older firmware 9.0.0.9-26sv and earlier versions Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-20
dditional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0006
CVE ID: CVE-2022-22280 State: PUBLISHED Published: 2022-07-29T21:05:12 Last Updated: 2024-08-03T03:07:50.162Z Vendors: SonicWall Products: SonicWall GMS, SonicWall Analytics On-Prem Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command leading to Unauthenticated SQL Injection vulnerability, impacting SonicWall GMS 9.3.1-SP2-Hotfix1, Analytics On-Prem 2.5.0.3-2520 and earlier versions. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0007
CVE ID: CVE-2022-22281 State: PUBLISHED Published: 2022-05-13T19:40:17 Last Updated: 2024-08-03T03:07:50.181Z Vendors: SonicWall Products: SonicWall NetExtender Windows (32 and 64 bit) Client Problem Types: CWE-121 Description: A buffer overflow vulnerability in the SonicWall SSL-VPN NetExtender Windows Client (32 and 64 bit) in 10.2.322 and earlier versions, allows an attacker to potentially execute arbitrary code in the host windows operating system. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0008
CVE ID: CVE-2022-22282 State: PUBLISHED Published: 2022-05-13T19:40:18 Last Updated: 2024-08-03T03:07:50.319Z Vendors: SonicWall Products: SonicWall SMA1000 Problem Types: CWE-284 Description: SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource using HTTP connections from an unauthorized actor leading to Improper Access Control vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0009
CVE ID: CVE-2022-22283 State: PUBLISHED Published: 2022-01-07T22:39:19 Last Updated: 2024-08-03T03:07:50.196Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Health Problem Types: CWE-287 Description: Improper session management vulnerability in Samsung Health prior to 6.20.1.005 prevents logging out from Samsung Health App. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1
CVE ID: CVE-2022-22284 State: PUBLISHED Published: 2022-01-07T22:39:19 Last Updated: 2024-08-03T03:07:50.436Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N) Vendors: Samsung Mobile Products: Samsung Internet Problem Types: CWE-287 Description: Improper authentication vulnerability in Samsung Internet prior to 16.0.2.19 allows attackers to bypass secret mode password authentication Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1
CVE ID: CVE-2022-22285 State: PUBLISHED Published: 2022-01-07T22:39:20 Last Updated: 2024-08-03T03:07:50.439Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Samsung Mobile Products: Reminder Problem Types: CWE-94 Description: A vulnerability using PendingIntent in Reminder prior to version 12.2.05.0 in Android R(11.0) and 12.3.02.1000 in Android S(12.0) allows attackers to execute privileged action by hijacking and modifying the intent. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1
CVE ID: CVE-2022-22286 State: PUBLISHED Published: 2022-01-07T22:39:21 Last Updated: 2024-08-03T03:07:50.229Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: Samsung Mobile Products: Bixby Routines Problem Types: CWE-94 Description: A vulnerability using PendingIntent in Bixby Routines prior to version 3.1.21.8 in Android R(11.0) and 2.6.30.5 in Android Q(10.0) allows attackers to execute privileged action by hijacking and modifying the intent. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1
CVE ID: CVE-2022-22287 State: PUBLISHED Published: 2022-01-07T22:39:22 Last Updated: 2024-08-03T03:07:50.273Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Email Problem Types: CWE-20 Description: Abitrary file access vulnerability in Samsung Email prior to 6.1.60.16 allows attacker to read isolated data in sandbox. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1
CVE ID: CVE-2022-22288 State: PUBLISHED Published: 2022-01-07T22:39:22 Last Updated: 2024-08-03T03:07:50.285Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Samsung Mobile Products: Galaxy Store Problem Types: CWE-285 Description: Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1
CVE ID: CVE-2022-22289 State: PUBLISHED Published: 2022-01-07T22:39:23 Last Updated: 2024-08-03T03:07:50.279Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: S Assistant Problem Types: CWE-287 Description: Improper access control vulnerability in S Assistant prior to version 7.5 allows attacker to remotely get senstive information. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1
CVE ID: CVE-2022-22290 State: PUBLISHED Published: 2022-01-14T19:11:37 Last Updated: 2024-08-03T03:07:50.178Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Samsung Mobile Products: Samsung Internet Problem Types: CWE-703 Description: Incorrect download source UI in Downloads in Samsung Internet prior to 16.0.6.23 allows attackers to perform domain spoofing via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=1
CVE ID: CVE-2022-22291 State: PUBLISHED Published: 2022-02-11T17:40:07 Last Updated: 2024-08-03T03:07:50.276Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-779 Description: Logging of excessive data vulnerability in telephony prior to SMR Feb-2022 Release 1 allows privileged attackers to get Cell Location Information through log of user device. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=2
CVE ID: CVE-2022-22292 State: PUBLISHED Published: 2022-02-11T17:40:08 Last Updated: 2024-08-03T03:07:50.428Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-280 Description: Unprotected dynamic receiver in Telecom prior to SMR Feb-2022 Release 1 allows untrusted applications to launch arbitrary activity. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=2
CVE ID: CVE-2022-22293 State: PUBLISHED Published: 2022-01-01T23:52:49 Last Updated: 2024-08-03T03:07:50.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mustgundogdu/Research/blob/main/Dolibar_7.0.2-StoredXSS/README.md - https://github.com/Dolibarr/dolibarr/issues/20237
CVE ID: CVE-2022-22294 State: PUBLISHED Published: 2022-01-28T16:37:17 Last Updated: 2024-08-03T03:07:50.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in ZFAKA<=1.43 which an attacker can use to complete SQL injection in the foreground and add a background administrator account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zfaka-plus/zfaka/pull/237 - https://www.cnblogs.com/J0o1ey/p/15757096.html
CVE ID: CVE-2022-22295 State: PUBLISHED Published: 2022-02-14T20:18:10 Last Updated: 2024-08-03T03:07:50.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in parameter_admin.class.php via the table_para parameter. Additional Analyst Notes: - CVE Program Container: References: - http://note.youdao.com/noteshare?id=2bbcb3b4a5cd232f7a0ad47aa70f0f95&sub=1BC1FED9D3274995B3489DB645AA630B
CVE ID: CVE-2022-22296 State: PUBLISHED Published: 2022-01-24T13:11:53 Last Updated: 2024-08-03T03:07:50.396Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Hospital's Patient Records Management System 1.0 is vulnerable to Insecure Permissions via the id parameter in manage_user endpoint. Simply change the value and data of other users can be displayed. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vlakhani28/CVE-2022-22296/blob/main/README.md
CVE ID: CVE-2022-22297 State: PUBLISHED Published: 2023-03-07T16:04:48.484Z Last Updated: 2024-10-22T20:48:26.477Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiRecorder, FortiWeb Problem Types: CWE-792 Description: An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder version 6.4.0 through 6.4.3, FortiRecorder all versions 6.0, FortiRecorder all versions 2.7 may allow an authe
iRecorder version 6.4.0 through 6.4.3, FortiRecorder all versions 6.0, FortiRecorder all versions 2.7 may allow an authenticated user to read arbitrary files via specially crafted command arguments. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-218
CVE ID: CVE-2022-22298 State: PUBLISHED Published: 2023-10-10T16:49:46.033Z Last Updated: 2024-09-18T19:48:48.594Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H/RL:X/RC:C) Vendors: Fortinet Products: FortiIsolator Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiIsolator version 1.0.0, FortiIsolator version 1.1.0, FortiIsolator version 1.2.0 through 1.2.2, FortiIsolator version 2.0.0 through 2.0.1, FortiIsolator version 2.1.0 through 2.1.2, FortiIsolator version 2.2.0, FortiIsolator version 2.3.0 through 2.3.4 allows attacker to execute arbitrary OS commands in the un
ator version 2.2.0, FortiIsolator version 2.3.0 through 2.3.4 allows attacker to execute arbitrary OS commands in the underlying shell via specially crafted input parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-233
CVE ID: CVE-2022-22299 State: PUBLISHED Published: 2022-08-05T15:23:52 Last Updated: 2024-10-25T13:30:31.683Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiADC, FortiProxy, FortiMail, FortiOS Problem Types: Execute unauthorized code or commands Description: A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy version 1.0.0 through 1.0.7, FortiProxy version 1.1.0 through 1.1.6, FortiProxy version 1.2.0 through 1.2.13, FortiProxy version 2.0.0 through 2.0.7, FortiProxy
ersion 1.1.0 through 1.1.6, FortiProxy version 1.2.0 through 1.2.13, FortiProxy version 2.0.0 through 2.0.7, FortiProxy version 7.0.0 through 7.0.1, FortiOS version 6.0.0 through 6.0.14, FortiOS version 6.2.0 through 6.2.10, FortiOS version 6.4.0 through 6.4.8, FortiOS version 7.0.0 through 7.0.2, FortiMail version 6.4.0 through 6.4.5, FortiMail version 7.0.0 through 7.0.2 may allow an authenticated user to execute unauthorized code or commands via specially crafted command arguments. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-235