Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-47511 State: PUBLISHED Published: 2023-11-16T18:16:40.172Z Last Updated: 2024-12-18T18:04:05.648Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: SO WP Products: Pinyin Slugs Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SO WP Pinyin Slugs plugin <= 2.3.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/so-pinyin-slugs/wordpress-pinyin-slugs-plugin-2-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47512 State: PUBLISHED Published: 2023-11-16T18:11:50.574Z Last Updated: 2024-08-28T15:11:34.760Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Gravity Master Products: Product Enquiry for WooCommerce Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Gravity Master Product Enquiry for WooCommerce plugin <= 3.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/gm-woocommerce-quote-popup/wordpress-product-enquiry-for-woocommerce-plugin-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47513 State: PUBLISHED Published: 2024-06-04T09:46:23.663Z Last Updated: 2024-08-02T21:09:37.319Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: ARI Soft Products: ARI Stream Quiz Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ARI Soft ARI Stream Quiz allows Code Injection.This issue affects ARI Stream Quiz: from n/a through 1.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ari-stream-quiz/wordpress-ari-stream-quiz-wordpress-quizzes-builder-plugin-1-2-32-content-injec
m/database/vulnerability/ari-stream-quiz/wordpress-ari-stream-quiz-wordpress-quizzes-builder-plugin-1-2-32-content-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-47514 State: PUBLISHED Published: 2023-11-16T18:07:27.114Z Last Updated: 2024-08-02T21:09:37.348Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: lawrenceowen, gcubero, acunnningham, fmahmood Products: Star CloudPRNT for WooCommerce Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in lawrenceowen, gcubero, acunnningham, fmahmood Star CloudPRNT for WooCommerce plugin <= 2.0.3 versions. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/star-cloudprnt-for-woocommerce/wordpress-star-cloudprnt-for-woocommerce-plugin-2-0-3-cross-site-scripting-x
ulnerability/star-cloudprnt-for-woocommerce/wordpress-star-cloudprnt-for-woocommerce-plugin-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47515 State: PUBLISHED Published: 2025-01-02T12:00:33.948Z Last Updated: 2025-01-03T18:59:52.009Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Seers Products: Seers Problem Types: CWE-862 Description: Missing Authorization vulnerability in Seers Seers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seers: from n/a through 8.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/seers-cookie-consent-banner-privacy-policy/vulnerability/wordpress-seers-gdpr-ccpa-cookie-consent-compliance-plugin-8-0-6-broken-access-control-vulnerability?
licy/vulnerability/wordpress-seers-gdpr-ccpa-cookie-consent-compliance-plugin-8-0-6-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-47516 State: PUBLISHED Published: 2023-11-13T03:57:12.015Z Last Updated: 2024-08-28T15:37:56.412Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Stark Digital Products: Category Post List Widget Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Stark Digital Category Post List Widget allows Stored XSS.This issue affects Category Post List Widget: from n/a through 2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/category-post-list-widget/wordpress-category-post-list-widget-plugin-2-0-csrf-to-cross-site-scripting-xss-
vulnerability/category-post-list-widget/wordpress-category-post-list-widget-plugin-2-0-csrf-to-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47517 State: PUBLISHED Published: 2023-11-14T22:17:19.597Z Last Updated: 2024-08-28T15:11:06.035Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: SendPress Products: SendPress Newsletters Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in SendPress Newsletters plugin <= 1.23.11.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/sendpress/wordpress-sendpress-newsletters-plugin-1-22-3-31-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47518 State: PUBLISHED Published: 2023-11-14T22:11:10.527Z Last Updated: 2024-08-14T19:17:26.717Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Matthew Muro Products: Restrict Categories Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Matthew Muro Restrict Categories plugin <= 2.6.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/restrict-categories/wordpress-restrict-categories-plugin-2-6-4-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47519 State: PUBLISHED Published: 2023-11-18T22:01:12.395Z Last Updated: 2024-08-10T15:38:58.153Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WC Product Table Products: WooCommerce Product Table Lite Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WC Product Table WooCommerce Product Table Lite.This issue affects WooCommerce Product Table Lite: from n/a through 2.6.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wc-product-table-lite/wordpress-woocommerce-product-table-lite-plugin-2-6-2-cross-site-request-forg
tabase/vulnerability/wc-product-table-lite/wordpress-woocommerce-product-table-lite-plugin-2-6-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-47520 State: PUBLISHED Published: 2023-11-14T21:41:46.837Z Last Updated: 2024-08-28T15:10:41.602Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Michael Uno (miunosoft) Products: Responsive Column Widgets Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Michael Uno (miunosoft) Responsive Column Widgets plugin <= 1.2.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/responsive-column-widgets/wordpress-responsive-column-widgets-plugin-1-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47521 State: PUBLISHED Published: 2023-11-30T16:59:43.303Z Last Updated: 2024-08-02T21:09:37.341Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Max Bond, AndreSC Products: Q2W3 Post Order Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Bond, AndreSC Q2W3 Post Order allows Reflected XSS.This issue affects Q2W3 Post Order: from n/a through 1.2.8. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/q2w3-post-order/wordpress-q2w3-post-order-plugin-1-2-8-reflected-cross-site-scripting-xss-vulnerab
atabase/vulnerability/q2w3-post-order/wordpress-q2w3-post-order-plugin-1-2-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47522 State: PUBLISHED Published: 2023-11-14T21:36:31.992Z Last Updated: 2025-01-07T18:59:25.981Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Photo Feed Products: Photo Feed Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Photo Feed plugin <= 2.2.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/photo-feed/wordpress-photo-feed-plugin-2-2-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47523 State: PUBLISHED Published: 2025-01-02T12:00:34.534Z Last Updated: 2025-01-02T14:52:07.635Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Ecreate Infotech Products: Auto Tag Creator Problem Types: CWE-862 Description: Missing Authorization vulnerability in Ecreate Infotech Auto Tag Creator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Tag Creator: from n/a through 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/auto-tag-creator/vulnerability/wordpress-auto-tag-creator-plugin-1-0-2-broken-access-control-vulnerabil
wordpress/plugin/auto-tag-creator/vulnerability/wordpress-auto-tag-creator-plugin-1-0-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-47524 State: PUBLISHED Published: 2023-11-14T21:30:30.391Z Last Updated: 2025-01-07T19:00:20.947Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: CodeBard Products: CodeBard's Patron Button and Widgets for Patreon Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability (requires PHP 8.x) in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin <= 2.1.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/patron-button-and-widgets-by-codebard/wordpress-codebard-s-patron-button-and-widgets-for-patreon-pl
tabase/vulnerability/patron-button-and-widgets-by-codebard/wordpress-codebard-s-patron-button-and-widgets-for-patreon-plugin-2-1-9-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47525 State: PUBLISHED Published: 2023-12-21T14:25:39.759Z Last Updated: 2024-11-20T20:19:20.771Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: A WP Life Products: Event Monster – Event Management, Tickets Booking, Upcoming Event Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Event Monster – Event Management, Tickets Booking, Upcoming Event allows Stored XSS.This issue affects Event Monster – Event Management, Tickets Booking, Upcoming Event: from n/a through 1.3.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
ng, Upcoming Event: from n/a through 1.3.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/event-monster/wordpress-event-monster-plugin-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47526 State: PUBLISHED Published: 2024-02-12T06:53:18.427Z Last Updated: 2024-08-02T21:09:37.370Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Chart Builder Team Products: Chartify – WordPress Chart Plugin Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chart Builder Team Chartify – WordPress Chart Plugin allows Stored XSS.This issue affects Chartify – WordPress Chart Plugin: from n/a through 2.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/chart-builder/word
DP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/chart-builder/wordpress-chartify-plugin-2-0-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47527 State: PUBLISHED Published: 2023-12-21T14:27:58.606Z Last Updated: 2024-08-02T21:09:37.383Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Sajjad Hossain Sagor Products: WP Edit Username Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sajjad Hossain Sagor WP Edit Username allows Stored XSS.This issue affects WP Edit Username: from n/a through 1.0.5. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/wp-edit-username/wordpress-wp-edit-username-plugin-1-0-5-cross-site-scripting-xss-vulnerab
ck.com/database/vulnerability/wp-edit-username/wordpress-wp-edit-username-plugin-1-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47528 State: PUBLISHED Published: 2023-11-14T21:18:15.186Z Last Updated: 2025-01-07T19:01:48.451Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Sajjad Hossain Sagor Products: WP Edit Username Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sajjad Hossain Sagor WP Edit Username plugin <= 1.0.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-edit-username/wordpress-wp-edit-username-plugin-1-0-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47529 State: PUBLISHED Published: 2023-11-23T20:25:56.457Z Last Updated: 2024-08-02T21:09:37.352Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ThemeIsle Products: Cloud Templates & Patterns collection Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeIsle Cloud Templates & Patterns collection.This issue affects Cloud Templates & Patterns collection: from n/a through 1.2.2. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/templates-patterns-collection/wordpress-cloud-templates-patterns-collection-plugin-1-2-2-sen
.com/database/vulnerability/templates-patterns-collection/wordpress-cloud-templates-patterns-collection-plugin-1-2-2-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE ID: CVE-2023-47530 State: PUBLISHED Published: 2023-12-18T22:57:04.362Z Last Updated: 2025-05-07T20:29:48.150Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: WPVibes Products: Redirect 404 Error Page to Homepage or Custom Page with Logs Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes Redirect 404 Error Page to Homepage or Custom Page with Logs allows SQL Injection.This issue affects Redirect 404 Error Page to Homepage or Custom Page with Logs: from n/a through 1.8.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
: from n/a through 1.8.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/redirect-404-error-page-to-homepage-or-custom-page/wordpress-redirect-404-error-page-to-homepage-or-custom-page-with-logs-plugin-1-8-7-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-47531 State: PUBLISHED Published: 2023-11-18T21:57:37.006Z Last Updated: 2024-08-28T14:30:30.883Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: DroitThemes Products: Droit Dark Mode Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in DroitThemes Droit Dark Mode.This issue affects Droit Dark Mode: from n/a through 1.1.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/droit-dark-mode/wordpress-droit-dark-mode-plugin-1-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-47532 State: PUBLISHED Published: 2023-11-14T21:14:48.925Z Last Updated: 2025-01-07T19:03:05.769Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Themeum Products: WP Crowdfunding Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themeum WP Crowdfunding plugin <= 2.1.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-crowdfunding/wordpress-wp-crowdfunding-plugin-2-1-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47533 State: PUBLISHED Published: 2023-11-14T21:06:43.634Z Last Updated: 2025-01-07T19:03:54.608Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: wpdevart Products: Countdown and CountUp, WooCommerce Sales Timer Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Countdown and CountUp, WooCommerce Sales Timer plugin <= 1.8.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/countdown-wpdevart-extended/wordpress-countdown-and-countup-woocommerce-sales-timer-plugin-1-8-2-cross-site-scripting-
y/countdown-wpdevart-extended/wordpress-countdown-and-countup-woocommerce-sales-timer-plugin-1-8-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-47534 State: PUBLISHED Published: 2024-03-12T15:09:19.802Z Last Updated: 2024-08-12T18:01:16.372Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:U/RC:R) Vendors: Fortinet Products: FortiClientEMS Problem Types: CWE-1236 Description: A improper neutralization of formula elements in a csv file in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.10, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8 allows attacker to execute unauthorized code or commands via specially crafted packets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-390
CVE ID: CVE-2023-47535 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:04.586Z Description: No description available.
CVE ID: CVE-2023-47536 State: PUBLISHED Published: 2023-12-13T08:06:01.706Z Last Updated: 2025-05-22T18:19:35.135Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:F/RL:O/RC:R) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-284 Description: An improper access control vulnerability [CWE-284] in FortiOS version 7.2.0, version 7.0.13 and below, version 6.4.14 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below may allow a remote unauthenticated attacker to bypass the firewall deny geolocalisation policy via timing the bypass with a GeoIP database update. Additional Analyst Notes: - CVE Program Container: -
lisation policy via timing the bypass with a GeoIP database update. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-432
CVE ID: CVE-2023-47537 State: PUBLISHED Published: 2024-02-15T13:59:24.770Z Last Updated: 2024-08-02T21:09:37.377Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiOS Problem Types: CWE-295 Description: An improper certificate validation vulnerability in Fortinet FortiOS 7.0.0 - 7.0.13, 7.2.0 - 7.2.6, 7.4.0 - 7.4.1 and 6.4 all versions allows a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the FortiLink communication channel between the FortiOS device and FortiSwitch. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-
ional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-301
CVE ID: CVE-2023-47538 State: REJECTED Published: N/A Last Updated: 2025-09-24T02:55:09.416Z Description: No description available.
CVE ID: CVE-2023-47539 State: PUBLISHED Published: 2025-03-18T13:56:56.681Z Last Updated: 2025-03-19T03:55:48.590Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiMail Problem Types: CWE-284 Description: An improper access control vulnerability in FortiMail version 7.4.0 configured with RADIUS authentication and remote_wildcard enabled may allow a remote unauthenticated attacker to bypass admin login via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-439
CVE ID: CVE-2023-47540 State: PUBLISHED Published: 2024-04-09T14:24:23.806Z Last Updated: 2024-08-02T21:09:37.377Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiSandbox Problem Types: CWE-78 Description: An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSandbox version 4.4.0 through 4.4.2 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.5 and 3.2.0 through 3.2.4 and 3.0.5 through 3.0.7 may allows attacker to execute unauthorized code or commands via CLI. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.
s via CLI. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-411
CVE ID: CVE-2023-47541 State: PUBLISHED Published: 2024-04-09T14:24:20.501Z Last Updated: 2024-08-02T21:09:37.349Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiSandbox Problem Types: CWE-22 Description: An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiSandbox version 4.4.0 through 4.4.2 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.5 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.0 through 3.0.7 and 2.5.0 through 2.5.2 and 2.4.0 through 2.4.1 and 2.3.0 through 2.3.3 and 2.2.0 through 2.2.2 and 2.1.0 through 2.1.3 and 2.0.0 through 2.0.3 allows attacker to exec
and 2.3.0 through 2.3.3 and 2.2.0 through 2.2.2 and 2.1.0 through 2.1.3 and 2.0.0 through 2.0.3 allows attacker to execute unauthorized code or commands via CLI. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-416
CVE ID: CVE-2023-47542 State: PUBLISHED Published: 2024-04-09T14:24:24.616Z Last Updated: 2025-02-26T18:40:53.696Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiManager Problem Types: CWE-1336 Description: A improper neutralization of special elements used in a template engine [CWE-1336] in FortiManager versions 7.4.1 and below, versions 7.2.4 and below, and 7.0.10 and below allows attacker to execute unauthorized code or commands via specially crafted templates. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-419