Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-26067 State: PUBLISHED Published: 2021-01-28T01:45:16.145818Z Last Updated: 2024-09-16T18:34:10.127Z Vendors: Atlassian Products: Bamboo Problem Types: Sensitive Data Exposure Description: Affected versions of Atlassian Bamboo allow an unauthenticated remote attacker to view a stack trace that may reveal the path for the home directory in disk and if certain files exists on the tmp directory, via a Sensitive Data Exposure vulnerability in the /chart endpoint. The affected versions are before version 7.2.2. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/BAM-21215
CVE ID: CVE-2021-26068 State: PUBLISHED Published: 2021-02-18T15:17:58.744585Z Last Updated: 2024-09-16T22:30:48.540Z Vendors: Atlassian Products: Jira Server for Slack Problem Types: Template Injection Description: An endpoint in Atlassian Jira Server for Slack plugin from version 0.0.3 before version 2.0.15 allows remote attackers to execute arbitrary code via a template injection vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://confluence.atlassian.com/jira/jira-server-for-slack-security-advisory-17th-february-2021-1044091690.html
CVE ID: CVE-2021-26069 State: PUBLISHED Published: 2021-03-22T04:50:12.742409Z Last Updated: 2024-09-17T02:37:34.201Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Information Disclosure Description: Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary files and enumerate project keys via an Information Disclosure vulnerability in the /rest/api/1.0/issues/{id}/ActionsAndOperations API endpoint. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassi
from version 8.14.0 before 8.15.0. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-72010
CVE ID: CVE-2021-26070 State: PUBLISHED Published: 2021-03-22T04:40:11.930398Z Last Updated: 2024-09-16T19:42:02.091Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Broken Authentication Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protection of app-linked resources via a Broken Authentication vulnerability in the `makeRequest` gadget resource. The affected versions are before version 8.13.3, and from version 8.14.0 before 8.14.1. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-72029
CVE ID: CVE-2021-26071 State: PUBLISHED Published: 2021-04-01T02:30:14.635180Z Last Updated: 2024-09-17T03:13:35.908Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Cross-Site Request Forgery (CSRF) Description: The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to enable and disable Jira Software configuration via a cross-site request forgery (CSRF) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-72233
CVE ID: CVE-2021-26072 State: PUBLISHED Published: 2021-04-01T18:10:35.728227Z Last Updated: 2024-09-17T01:40:50.388Z Vendors: Atlassian Products: Confluence Server, Confluence Data Center Problem Types: Server Side Request Forgery (SSRF) Description: The WidgetConnector plugin in Confluence Server and Confluence Data Center before version 5.8.6 allowed remote attackers to manipulate the content of internal network resources via a blind Server-Side Request Forgery (SSRF) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CONFSERVER-61399
CVE ID: CVE-2021-26073 State: PUBLISHED Published: 2021-04-16T03:00:19.147Z Last Updated: 2025-02-12T20:46:54.554Z Vendors: Atlassian Products: Atlassian Connect Express (ACE) Problem Types: Broken Authentication Description: Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Express versions from 3.0.2 before 6.6.0 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-s
3.0.2 before 6.6.0 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://confluence.atlassian.com/pages/viewpage.action?pageId=1051986099 - https://community.developer.atlassian.com/t/action-required-atlassian-connect-vulnerability-a%5B%E2%80%A6%5Dypass-of-app-qsh-verification-via-context-jwts/47072 - https://security.netapp.com/advisory/ntap-20210604-0004/
CVE ID: CVE-2021-26074 State: PUBLISHED Published: 2021-04-16T03:00:19.829Z Last Updated: 2025-02-12T20:52:01.324Z Vendors: Atlassian Products: Atlassian Connect Spring Boot (ACSB) Problem Types: Broken Authentication Description: Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Spring Boot versions from version 1.1.0 before version 2.1.3 erroneously accept context JWTs in lifecycle endpoint
nnect Spring Boot versions from version 1.1.0 before version 2.1.3 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://confluence.atlassian.com/pages/viewpage.action?pageId=1051986106 - https://community.developer.atlassian.com/t/action-required-atlassian-connect-vulnerability-allows-bypass-of-app-qsh-verification-via-context-jwts/47072
CVE ID: CVE-2021-26075 State: PUBLISHED Published: 2021-04-14T23:45:18.560468Z Last Updated: 2024-10-17T14:03:25.665Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Information Disclosure Description: The Jira importers plugin AttachTemporaryFile rest resource in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before 8.13.4, and from version 8.14.0 before 8.15.1 allowed remote authenticated attackers to obtain the full path of the Jira application data directory via an information disclosure vulnerability in the error message when presented with an invalid filename. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
when presented with an invalid filename. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72316
CVE ID: CVE-2021-26076 State: PUBLISHED Published: 2021-04-14T23:45:19.196220Z Last Updated: 2024-10-17T14:12:32.765Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Security Misconfiguration Description: The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.0 allows remote anonymous attackers who can perform an attacker in the middle attack to learn which mode a user is editing in due to the cookie not being set with a secure attribute if Jira was configured to use https. Additional Analyst Notes: - CVE Program Contain
t being set with a secure attribute if Jira was configured to use https. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72252
CVE ID: CVE-2021-26077 State: PUBLISHED Published: 2021-05-09T23:55:09.616Z Last Updated: 2025-02-12T20:57:51.249Z Vendors: Atlassian Products: Atlassian Connect Spring Boot (ACSB) Problem Types: Broken Authentication Description: Broken Authentication in Atlassian Connect Spring Boot (ACSB) in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Spring Boot versions 1.1.0 before 2.1.3 and versions 2.1.4 before 2.1.5 erroneously acce
context JWT. Atlassian Connect Spring Boot versions 1.1.0 before 2.1.3 and versions 2.1.4 before 2.1.5 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.developer.atlassian.com/t/action-required-atlassian-connect-vulnerability-allows-bypass-of-app-qsh-verification-via-context-jwts/47072 - https://confluence.atlassian.com/pages/viewpage.action?pageId=1063555147
CVE ID: CVE-2021-26078 State: PUBLISHED Published: 2021-06-07T22:25:11.009457Z Last Updated: 2024-10-17T14:27:52.463Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Cross Site Scripting (XSS) Description: The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.0 before version 8.16.1 allows remote attackers inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72392 - http://packetstormsecurity.com/file
ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72392 - http://packetstormsecurity.com/files/163289/Atlassian-Jira-Server-Data-Center-8.16.0-Cross-Site-Scripting.html
CVE ID: CVE-2021-26079 State: PUBLISHED Published: 2021-06-07T22:35:09.941016Z Last Updated: 2024-10-17T14:29:23.194Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Cross Site Scripting (XSS) Description: The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72396
CVE ID: CVE-2021-26080 State: PUBLISHED Published: 2021-06-07T22:25:11.650750Z Last Updated: 2024-10-17T14:28:50.794Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Cross Site Scripting (XSS) Description: EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version 8.13.6, and from 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72432
CVE ID: CVE-2021-26081 State: PUBLISHED Published: 2021-07-20T03:25:12.678817Z Last Updated: 2024-10-11T17:18:17.200Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Enumeration Description: REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to enumerate usernames via a Sensitive Data Exposure vulnerability in the `/rest/api/latest/user/avatar/temporary` endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72499
CVE ID: CVE-2021-26082 State: PUBLISHED Published: 2021-07-20T03:25:14.310371Z Last Updated: 2024-10-11T17:19:19.636Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Cross Site Scripting (XSS) Description: The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a stored cross site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72393
CVE ID: CVE-2021-26083 State: PUBLISHED Published: 2021-07-20T03:25:15.828586Z Last Updated: 2024-10-17T14:33:00.954Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Cross Site Scripting (XSS) Description: Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72213
CVE ID: CVE-2021-26084 State: PUBLISHED Published: 2021-08-30T06:30:14.248Z Last Updated: 2025-10-21T23:25:35.945Z Vendors: Atlassian Products: Confluence Server, Confluence Data Center Problem Types: Remote Code Execution Description: In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
version 7.12.0 before 7.12.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/CONFSERVER-67940 - http://packetstormsecurity.com/files/167449/Atlassian-Confluence-Namespace-OGNL-Injection.html
CVE ID: CVE-2021-26085 State: PUBLISHED Published: 2021-08-03T00:00:12.199Z Last Updated: 2025-10-21T23:25:39.229Z Vendors: Atlassian Products: Confluence Server, Confluence Data Center Problem Types: Pre-Authorization Arbitrary File Read Description: Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. The affected versions are before version 7.4.10, and from version 7.5.0 before 7.12.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/CONFSERVER-67893 - http://packetstormsecurity.com/files/1
Vulnrichment: References: - https://jira.atlassian.com/browse/CONFSERVER-67893 - http://packetstormsecurity.com/files/164401/Atlassian-Confluence-Server-7.5.1-Arbitrary-File-Read.html
CVE ID: CVE-2021-26086 State: PUBLISHED Published: 2021-08-16T00:15:09.827Z Last Updated: 2025-10-21T23:25:37.960Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: Path Traversal Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72695 - http://packetstormsecurity.com/files/164405
nrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72695 - http://packetstormsecurity.com/files/164405/Atlassian-Jira-Server-Data-Center-8.4.0-File-Read.html
CVE ID: CVE-2021-26087 State: PUBLISHED Published: 2025-03-17T13:05:19.849Z Last Updated: 2025-03-17T13:52:53.619Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiWLC Problem Types: CWE-79 Description: An improper neutralization of input during web page generation in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 web interface may allow both authenticated remote attackers and non-authenticated attackers in the same network as the appliance to perform a stored cross site scripting attack (XSS) via injecting malicious payloads in different locations. Additional Analyst Notes: - CISA
ss site scripting attack (XSS) via injecting malicious payloads in different locations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-20-137
CVE ID: CVE-2021-26088 State: PUBLISHED Published: 2021-07-12T13:21:41 Last Updated: 2024-10-25T13:55:38.588Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Fortinet Products: Fortinet FSSO Windows DC Agent, FSSO Windows CA Problem Types: CWE 287 - Improper Authentication Description: An improper authentication vulnerability in FSSO Collector version 5.0.295 and below may allow an unauthenticated user to bypass a FSSO firewall policy and access the protected network via sending specifically crafted UDP login notification packets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-191
CVE ID: CVE-2021-26089 State: PUBLISHED Published: 2021-07-12T12:48:01 Last Updated: 2024-10-25T13:56:00.954Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Fortinet Products: Fortinet FortiClientMac Problem Types: Execute unauthorized code or commands Description: An improper symlink following in FortiClient for Mac 6.4.3 and below may allow an non-privileged user to execute arbitrary privileged shell commands during installation phase. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-022 - https://www.zerodayinitiative.com/advisories/ZDI-22-078/
CVE ID: CVE-2021-26090 State: PUBLISHED Published: 2021-07-12T12:53:27 Last Updated: 2024-10-25T13:55:49.687Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Fortinet Products: Fortinet FortiMail Problem Types: Denial of service Description: A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote attacker to exhaust available memory via specifically crafted login requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-042
CVE ID: CVE-2021-26091 State: PUBLISHED Published: 2025-03-24T15:37:58.370Z Last Updated: 2025-03-31T18:11:58.179Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:U/RC:C) Vendors: Fortinet Products: FortiMail Problem Types: CWE-338 Description: A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of the Identity Based Encryption service of FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to infer parts of users authentication tokens and reset their credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-031
CVE ID: CVE-2021-26092 State: PUBLISHED Published: 2022-02-24T02:45:57 Last Updated: 2024-10-22T21:01:11.565Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiOS, FortiProxy Problem Types: Execute unauthorized code or commands Description: Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; and FortiProxy 1.2.0 through 1.2.9, 2.0.0 through 2.0.1 may allow a remote unauthenticated attacker to perform a reflected Cross-site Scripting (XSS) attack by sending a request to the e
a remote unauthenticated attacker to perform a reflected Cross-site Scripting (XSS) attack by sending a request to the error page with malicious GET parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-20-199
CVE ID: CVE-2021-26093 State: PUBLISHED Published: 2024-12-19T07:47:44.394Z Last Updated: 2024-12-20T17:41:17.833Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiWLC Problem Types: CWE-824 Description: An access of uninitialized pointer (CWE-824) vulnerability in FortiWLC versions 8.6.0, 8.5.3 and earlier may allow a local and authenticated attacker to crash the access point being managed by the controller by executing a crafted CLI command. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-002
CVE ID: CVE-2021-26095 State: PUBLISHED Published: 2021-07-20T10:48:06 Last Updated: 2024-10-25T13:54:39.531Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Fortinet Products: Fortinet FortiMail Problem Types: Improper Access Control Description: The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referen
tent, thereby escalating privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-019
CVE ID: CVE-2021-26096 State: PUBLISHED Published: 2021-08-04T17:57:07 Last Updated: 2024-10-25T13:52:38.279Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L/E:X/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiSandbox Problem Types: Execute unauthorized code or commands Description: Multiple instances of heap-based buffer overflow in the command shell of FortiSandbox before 4.0.0 may allow an authenticated attacker to manipulate memory and alter its content by means of specifically crafted command line arguments. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-188
CVE ID: CVE-2021-26097 State: PUBLISHED Published: 2021-08-04T15:54:53 Last Updated: 2024-10-25T13:52:51.073Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiSandbox Problem Types: Shell injection Description: An improper neutralization of special elements used in an OS Command vulnerability in FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6 may allow an authenticated attacker with access to the web GUI to execute unauthorized code or commands via specifically crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fort
ed HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-198