Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-15665 State: PUBLISHED Published: 2020-03-20T17:18:54 Last Updated: 2024-08-05T00:56:22.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120004 in KfeCo10X64.sys fails to validate an offset passed as a parameter during a memory operation, leading to an arbitrary write primitive that can lead to code execution or escalation of privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.killernetworking.com - https://support.killernetworking.com/downloads/ReleaseNotes/KillerSoftware_Release_Notes_2.1.1352.pdf - https://github.com/fireeye/Vulnerability-Dis
king.com/downloads/ReleaseNotes/KillerSoftware_Release_Notes_2.1.1352.pdf - https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0009/FEYE-2019-0009.md
CVE ID: CVE-2019-15666 State: PUBLISHED Published: 2019-08-27T04:49:20 Last Updated: 2024-08-05T00:56:22.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 5.0.19. There is an out-of-bounds array access in __xfrm_policy_unlink, which will cause denial of service, because verify_newpolicy_info in net/xfrm/xfrm_user.c mishandles directory validation. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b805d78d300bcf2c83d6df7da0c818b0fee41427 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.19 - https://lists.debian.org/debian-lts
7da0c818b0fee41427 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.19 - https://lists.debian.org/debian-lts-announce/2019/09/msg00014.html - https://lists.debian.org/debian-lts-announce/2019/09/msg00015.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00064.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00066.html - https://security.netapp.com/advisory/ntap-20191004-0001/ - https://support.f5.com/csp/article/K53420251?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2019-15678 State: PUBLISHED Published: 2019-10-29T16:44:08 Last Updated: 2024-08-05T00:56:22.434Z Vendors: Kaspersky Products: TightVNC Problem Types: CWE-122 Description: TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler, which can potentially result code execution.. This attack appear to be exploitable via network connectivity. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2018/12/10/5 - https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html - https://cert-portal.siemens.com/productcert/pdf/ssa-478893.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-08
CVE ID: CVE-2019-15679 State: PUBLISHED Published: 2019-10-29T16:45:04 Last Updated: 2024-08-05T00:56:22.416Z Vendors: Kaspersky Products: TightVNC Problem Types: CWE-122 Description: TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution. This attack appear to be exploitable via network connectivity. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2018/12/10/5 - https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html - https://cert-portal.siemens.com/productcert/pdf/ssa-478893.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-08
CVE ID: CVE-2019-15680 State: PUBLISHED Published: 2019-10-29T16:45:52 Last Updated: 2024-08-05T00:56:22.088Z Vendors: Kaspersky Products: TightVNC Problem Types: CWE-476 Description: TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System (DoS). This attack appear to be exploitable via network connectivity. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2018/12/10/5 - https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html - https://usn.ubuntu.com/4407-1/ - https://cert-portal.siemens.com/productcert/pdf/ssa-478893.pdf - https://us-cert.cisa.gov/ics/advis
ubuntu.com/4407-1/ - https://cert-portal.siemens.com/productcert/pdf/ssa-478893.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-20-343-08
CVE ID: CVE-2019-15681 State: PUBLISHED Published: 2019-10-29T16:04:51 Last Updated: 2024-08-05T00:56:22.452Z Vendors: Kaspersky Products: LibVNC Problem Types: CWE-665 Description: LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. This attack appear to be exploitable via network connectivity. These vulnerabilities have been fixed in commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a. Additional Analyst Notes: - CVE Program Container: References: - http
n commit d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibVNC/libvncserver/commit/d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a - https://lists.debian.org/debian-lts-announce/2019/10/msg00039.html - https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html - https://lists.debian.org/debian-lts-announce/2019/11/msg00032.html - https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html - http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00027.html - https://usn.ubuntu.com/4407-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00073.html - https://usn.ubuntu.com/4547-1/ -
/4407-1/ - http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00073.html - https://usn.ubuntu.com/4547-1/ - https://usn.ubuntu.com/4573-1/ - https://usn.ubuntu.com/4587-1/ - https://cert-portal.siemens.com/productcert/pdf/ssa-390195.pdf
CVE ID: CVE-2019-15682 State: PUBLISHED Published: 2019-10-30T15:42:18 Last Updated: 2024-08-05T00:56:21.899Z Vendors: RDesktop Products: RDesktop Problem Types: CWE-125 Description: RDesktop version 1.8.4 contains multiple out-of-bound access read vulnerabilities in its code, which results in a denial of service (DoS) condition. This attack appear to be exploitable via network connectivity. These issues have been fixed in version 1.8.5 Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/10/30/klcert-19-032-denial-of-service-in-rdesktop-before-1-8-4/
CVE ID: CVE-2019-15683 State: PUBLISHED Published: 2019-10-29T17:00:58 Last Updated: 2024-08-05T00:56:22.465Z Vendors: Kaspersky Products: TurboVNC Problem Types: CWE-121 Description: TurboVNC server code contains stack buffer overflow vulnerability in commit prior to cea98166008301e614e0d36776bf9435a536136e. This could possibly result into remote code execution, since stack frame is not protected with stack canary. This attack appear to be exploitable via network connectivity. To exploit this vulnerability authorization on server is required. These issues have been fixed in commit cea98166008301e614e0d36776bf9435a536136e. Additional Analyst Notes: - CVE Program Container: References: - http
n commit cea98166008301e614e0d36776bf9435a536136e. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TurboVNC/turbovnc/commit/cea98166008301e614e0d36776bf9435a536136e
CVE ID: CVE-2019-15684 State: PUBLISHED Published: 2019-11-25T16:01:12 Last Updated: 2024-08-05T00:56:22.379Z Vendors: Kaspersky Products: Kaspersky Protection extension for Google Chrome Problem Types: Bypass Description: Kaspersky Protection extension for web browser Google Chrome prior to 30.112.62.0 was vulnerable to unauthorized access to its features remotely that could lead to removing other installed extensions. Additional Analyst Notes: - CVE Program Container: References: - https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1
CVE ID: CVE-2019-15685 State: PUBLISHED Published: 2019-11-26T15:44:19 Last Updated: 2024-08-05T00:56:22.456Z Vendors: Kaspersky Products: Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud Problem Types: Bypass Description: Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component allowed an attacker remotely disable such product's security features as private browsing and anti-banner. Bypass. Additional Analyst Notes: - CVE Program Contai
product's security features as private browsing and anti-banner. Bypass. Additional Analyst Notes: - CVE Program Container: References: - https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1
CVE ID: CVE-2019-15686 State: PUBLISHED Published: 2019-11-26T15:44:49 Last Updated: 2024-08-05T00:56:22.047Z Vendors: Kaspersky Products: Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud Problem Types: DoS, Bypass Description: Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component allowed an attacker remotely disable various anti-virus protection features. DoS, Bypass. Additional Analyst Notes: - CVE Program Container: References: - h
various anti-virus protection features. DoS, Bypass. Additional Analyst Notes: - CVE Program Container: References: - https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1
CVE ID: CVE-2019-15687 State: PUBLISHED Published: 2019-11-26T15:45:17 Last Updated: 2024-08-05T00:56:22.458Z Vendors: Kaspersky Products: Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud Problem Types: Information Disclosure. Description: Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component was vulnerable to remote disclosure of various information about the user's system (like Windows version and version of the product, host unique
disclosure of various information about the user's system (like Windows version and version of the product, host unique ID). Information Disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1
CVE ID: CVE-2019-15688 State: PUBLISHED Published: 2019-11-26T15:32:17 Last Updated: 2024-08-05T00:56:22.438Z Vendors: Kaspersky Products: Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud Problem Types: Bypass Description: Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, Kaspersky Small Office Security, Kaspersky Security Cloud up to 2020, the web protection component did not adequately inform the user about the threat of redirecting to an untrusted site. Bypass. Additional Analyst Notes: - CVE Program Container: References: -
the threat of redirecting to an untrusted site. Bypass. Additional Analyst Notes: - CVE Program Container: References: - https://support.kaspersky.com/general/vulnerability.aspx?el=12430#251119_1
CVE ID: CVE-2019-15689 State: PUBLISHED Published: 2019-12-02T20:43:52 Last Updated: 2024-08-05T00:56:22.341Z Vendors: Kaspersky Products: Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Security Cloud Problem Types: Bypass Description: Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Security Cloud prior to version 2020 patch E have bug that allows a local user to execute arbitrary code via execution compromised file placed by an attacker with administrator rights. No privilege escalation. Possible whitelisting bypass some of the security products Additional Analyst Notes: - CVE Program Container: Ref
ation. Possible whitelisting bypass some of the security products Additional Analyst Notes: - CVE Program Container: References: - https://support.kaspersky.com/general/vulnerability.aspx?el=12430#021219
CVE ID: CVE-2019-15690 State: PUBLISHED Published: 2025-01-24T17:53:58.866Z Last Updated: 2025-01-24T18:22:55.433Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: LibVNC Products: LibVNCServer Problem Types: CWE-122 Description: LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://ics-cert.kaspersky.com/vulnerabilities/klcert-20-009-remote-code-execution-on-libvnc-version-prior-to-0-9-
es: - https://ics-cert.kaspersky.com/vulnerabilities/klcert-20-009-remote-code-execution-on-libvnc-version-prior-to-0-9-12/
CVE ID: CVE-2019-15691 State: PUBLISHED Published: 2019-12-26T14:52:46 Last Updated: 2024-08-05T00:56:22.245Z Vendors: Kaspersky Products: TigerVNC Problem Types: CWE-825 Description: TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return, which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception, ZRLEDecoder may try to access stack variable, which has been already freed during the process of stack unwinding. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity. Additional Analyst Notes: - CVE Program Container: References:
ttack appear to be exploitable via network connectivity. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CendioOssman/tigervnc/commit/d61a767d6842b530ffb532ddd5a3d233119aad40 - https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1 - https://www.openwall.com/lists/oss-security/2019/12/20/2 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html
CVE ID: CVE-2019-15692 State: PUBLISHED Published: 2019-12-26T14:55:47 Last Updated: 2024-08-05T00:56:22.409Z Vendors: Kaspersky Products: TigerVNC Problem Types: CWE-122 Description: TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. Vulnerability could be triggered from CopyRectDecoder due to incorrect value checks. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CendioOssman/tigervnc/commit/996356b6c65ca165ee1ea46a571c32a1dc3c3821 - https://github.com/TigerVNC/tigervnc/releases/tag/v1
ioOssman/tigervnc/commit/996356b6c65ca165ee1ea46a571c32a1dc3c3821 - https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1 - https://www.openwall.com/lists/oss-security/2019/12/20/2 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html
CVE ID: CVE-2019-15693 State: PUBLISHED Published: 2019-12-26T14:57:33 Last Updated: 2024-08-05T00:56:22.462Z Vendors: Kaspersky Products: TigerVNC Problem Types: CWE-122 Description: TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which occurs in TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CendioOssman/tigervnc/commit/b4ada8d0c6dac98c8b91fc64d112569a8ae5fb95 - https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1 - https://www.openwall.com/lists/
8c8b91fc64d112569a8ae5fb95 - https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1 - https://www.openwall.com/lists/oss-security/2019/12/20/2 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html
CVE ID: CVE-2019-15694 State: PUBLISHED Published: 2019-12-26T14:59:01 Last Updated: 2024-08-05T00:56:22.428Z Vendors: Kaspersky Products: TigerVNC Problem Types: CWE-122 Description: TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow, which could be triggered from DecodeManager::decodeRect. Vulnerability occurs due to the signdness error in processing MemOutStream. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/CendioOssman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438 - http
Container: References: - https://github.com/CendioOssman/tigervnc/commit/0943c006c7d900dfc0281639e992791d6c567438 - https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1 - https://www.openwall.com/lists/oss-security/2019/12/20/2 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html
CVE ID: CVE-2019-15695 State: PUBLISHED Published: 2019-12-26T15:24:00 Last Updated: 2024-08-05T00:56:22.455Z Vendors: Kaspersky Products: TigerVNC Problem Types: CWE-121 Description: TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow, which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat. Since remote attacker can choose offset from start of the buffer to start writing his values, exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity. Additional Analyst Notes: - CVE Program Container: References: - h
ck appear to be exploitable via network connectivity. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TigerVNC/tigervnc/releases/tag/v1.10.1 - https://www.openwall.com/lists/oss-security/2019/12/20/2 - https://github.com/CendioOssman/tigervnc/commit/05e28490873a861379c943bf616614b78b558b89 - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00039.html
CVE ID: CVE-2019-15698 State: PUBLISHED Published: 2019-08-27T16:53:48 Last Updated: 2024-08-05T00:56:22.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Octopus Deploy 2019.7.3 through 2019.7.9, in certain circumstances, an authenticated user with VariableView permissions could view sensitive values. This is fixed in 2019.7.10. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OctopusDeploy/Issues/issues/5810
CVE ID: CVE-2019-15699 State: PUBLISHED Published: 2019-09-24T19:20:11 Last Updated: 2024-08-05T00:56:22.166Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in app-layer-ssl.c in Suricata 4.1.4. Upon receiving a corrupted SSLv3 (TLS 1.2) packet, the parser function TLSDecodeHSHelloExtensions tries to access a memory region that is not allocated, because the expected length of HSHelloExtensions does not match the real length of the HSHelloExtensions part of the packet. Additional Analyst Notes: - CVE Program Container: References: - https://lists.openinfosecfoundation.org/pipermail/oisf-announce/ - https://suricata-ids.org/2019/09/24/suricata-4-1-5-released
//lists.openinfosecfoundation.org/pipermail/oisf-announce/ - https://suricata-ids.org/2019/09/24/suricata-4-1-5-released/
CVE ID: CVE-2019-15700 State: PUBLISHED Published: 2019-08-27T17:17:30 Last Updated: 2024-08-05T00:56:22.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/frappe/frappe/pull/8262
CVE ID: CVE-2019-15701 State: PUBLISHED Published: 2019-08-27T17:25:56 Last Updated: 2024-08-05T00:56:22.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: components/Modals/HelpModal.jsx in BloodHound 2.2.0 allows remote attackers to execute arbitrary OS commands (by spawning a child process as the current user on the victim's machine) when the search function's autocomplete feature is used. The victim must import data from an Active Directory with a GPO containing JavaScript in its name. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BloodHoundAD/BloodHound/issues/267
CVE ID: CVE-2019-15702 State: PUBLISHED Published: 2019-08-27T17:35:20 Last Updated: 2024-08-05T00:56:22.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the TCP implementation (gnrc_tcp) in RIOT through 2019.07, the parser for TCP options does not terminate on all inputs, allowing a denial-of-service, because sys/net/gnrc/transport_layer/tcp/gnrc_tcp_option.c has an infinite loop for an unknown zero-length option. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/RIOT-OS/RIOT/issues/12086
CVE ID: CVE-2019-15703 State: PUBLISHED Published: 2019-10-24T13:53:17 Last Updated: 2024-10-25T14:28:18.828Z Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Information disclosure Description: An Insufficient Entropy in PRNG vulnerability in Fortinet FortiOS 6.2.1, 6.2.0, 6.0.8 and below for device not enable hardware TRNG token and models not support builtin TRNG seed allows attacker to theoretically recover the long term ECDSA secret in a TLS client with a RSA handshake and mutual ECDSA authentication via the help of flush+reload side channel attacks in FortiGate VM models only. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://f
Gate VM models only. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-19-186
CVE ID: CVE-2019-15704 State: PUBLISHED Published: 2019-11-21T14:53:57 Last Updated: 2024-10-25T14:05:20.462Z Vendors: Fortinet Products: FortiClient for Mac OS Problem Types: Information Disclosure Description: A clear text storage of sensitive information vulnerability in FortiClient for Mac may allow a local attacker to read sensitive information logged in the console window when the user connects to an SSL VPN Gateway. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-19-227
CVE ID: CVE-2019-15705 State: PUBLISHED Published: 2019-11-27T20:38:54 Last Updated: 2024-10-25T14:27:42.720Z Vendors: Fortinet Products: FortiGate Problem Types: Denial of Service Description: An Improper Input Validation vulnerability in the SSL VPN portal of FortiOS versions 6.2.1 and below, and 6.0.6 and below may allow an unauthenticated remote attacker to crash the SSL VPN service by sending a crafted POST request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-19-236
CVE ID: CVE-2019-15706 State: PUBLISHED Published: 2025-03-17T13:05:08.965Z Last Updated: 2025-03-17T13:53:31.962Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiProxy, FortiOS Problem Types: CWE-79 Description: An improper neutralization of input during web page generation in the SSL VPN portal of FortiProxy version 2.0.0, version 1.2.9 and below and FortiOS version 6.2.1 and below, version 6.0.8 and below, version 5.6.12 may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG
attack (XSS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-19-223