Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-41294 State: PUBLISHED Published: 2022-10-06T17:15:28.532533Z Last Updated: 2024-09-16T16:13:48.144Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/C:L/I:L/S:U/UI:N/PR:N/A:N/AV:N/AC:L/E:U/RL:O/RC:C) Vendors: IBM Products: Robotic Process Automation Problem Types: Gain Access Description: IBM Robotic Process Automation 21.0.0, 21.0.1, 21.0.2, 21.0.3, and 21.0.4 is vulnerable to cross origin resource sharing using the bot api. IBM X-Force ID: 236807. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/6825985 - https://exchange.xforce.ibmcloud.com/vulnerabilities/236807
CVE ID: CVE-2022-41296 State: PUBLISHED Published: 2022-12-01T17:24:48.698Z Last Updated: 2024-08-03T12:42:45.776Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: IBM Products: Db2U Problem Types: CWE-352 Description: IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237210. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6843071 - https://exchange.xforce.ibmcloud.com/vulnerabilities/237210
CVE ID: CVE-2022-41297 State: PUBLISHED Published: 2022-12-01T17:30:14.457Z Last Updated: 2025-04-24T19:58:40.075Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: IBM Products: Db2U Problem Types: CWE-352 Description: IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 237212. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6843071 - https://exchange.xforce.ibmcloud.com/vulnerabilities/237212
CVE ID: CVE-2022-41299 State: PUBLISHED Published: 2022-12-09T18:09:42.187Z Last Updated: 2025-04-22T18:31:28.533Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Cloud Transformation Advisor Problem Types: CWE-79 Description: IBM Cloud Transformation Advisor 2.0.1 through 3.3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 237214. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/suppo
214. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6846257 - https://exchange.xforce.ibmcloud.com/vulnerabilities/237214
CVE ID: CVE-2022-41301 State: PUBLISHED Published: 2022-10-03T00:00:00 Last Updated: 2024-08-03T12:42:45.846Z Vendors: n/a Products: Subassembly Composer Problem Types: Memory Corruption Description: A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0018
CVE ID: CVE-2022-41302 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-14T15:35:25.441Z Vendors: n/a Products: FBX SDK Problem Types: Out-Of-Bounds Read Description: An Out-Of-Bounds Read Vulnerability in Autodesk FBX SDK version 2020. and prior may lead to code execution or information disclosure through maliciously crafted FBX files. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0022
CVE ID: CVE-2022-41303 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-14T15:34:18.931Z Vendors: n/a Products: FBX SDK Problem Types: Out-Of-Bounds Write Description: A user may be tricked into opening a malicious FBX file which may exploit a use-after-free vulnerability in Autodesk FBX SDK 2020 version causing the application to reference a memory location controlled by an unauthorized third party, thereby running arbitrary code on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0022
CVE ID: CVE-2022-41304 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-14T15:31:33.455Z Vendors: n/a Products: FBX SDK Problem Types: Use-After-Free Description: An Out-Of-Bounds Write Vulnerability in Autodesk FBX SDK 2020 version and prior may lead to code execution through maliciously crafted FBX files or information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0022
CVE ID: CVE-2022-41305 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-14T13:56:15.123Z Vendors: n/a Products: Subassembly Composer Problem Types: Memory Corruption Description: A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0019
CVE ID: CVE-2022-41306 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-14T15:30:23.554Z Vendors: n/a Products: Autodesk® Design Review Problem Types: Memory corruption Description: A maliciously crafted PCT file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0022
CVE ID: CVE-2022-41307 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-14T15:29:18.485Z Vendors: n/a Products: Subassembly Composer Problem Types: Memory Corruption Description: A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0020
CVE ID: CVE-2022-41308 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-05-14T15:27:17.374Z Vendors: n/a Products: Subassembly Composer Problem Types: Memory Corruption Description: A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability by read access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0021
CVE ID: CVE-2022-41309 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-05-07T14:58:42.604Z Vendors: n/a Products: Autodesk Design Review Problem Types: Memory corruption Read Description: A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE ID: CVE-2022-41310 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-05-07T14:56:52.763Z Vendors: n/a Products: Autodesk Design Review Problem Types: Memory corruption Read Description: A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0004
CVE ID: CVE-2022-41311 State: PUBLISHED Published: 2023-02-07T16:52:03.034Z Last Updated: 2025-11-04T19:14:03.361Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: Moxa Products: SDS-3008 Series Industrial Ethernet Switch Problem Types: CWE-79 Description: A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can send an HTTP request to trigger this vulnerability.Form field id="webLocationMessage_text" name="webLocationMessage_text" Additional Analyst Notes: - CVE Program Container:
rm field id="webLocationMessage_text" name="webLocationMessage_text" Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1619 - https://www.moxa.com/en/support/product-support/security-advisory/sds-3008-series-multiple-web-vulnerabilities
CVE ID: CVE-2022-41312 State: PUBLISHED Published: 2023-02-07T16:52:03.117Z Last Updated: 2025-11-04T19:14:04.460Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: Moxa Products: SDS-3008 Series Industrial Ethernet Switch Problem Types: CWE-79 Description: A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can send an HTTP request to trigger this vulnerability.Form field id="Switch Description", name "switch_description" Additional Analyst Notes: - CVE Program Container: - CISA AD
rm field id="Switch Description", name "switch_description" Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1619 - https://www.moxa.com/en/support/product-support/security-advisory/sds-3008-series-multiple-web-vulnerabilities
CVE ID: CVE-2022-41313 State: PUBLISHED Published: 2023-02-07T16:52:03.195Z Last Updated: 2025-11-04T19:14:05.557Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: Moxa Products: SDS-3008 Series Industrial Ethernet Switch Problem Types: CWE-79 Description: A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can send an HTTP request to trigger this vulnerability.Form field id="switch_contact" Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
rm field id="switch_contact" Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1619 - https://www.moxa.com/en/support/product-support/security-advisory/sds-3008-series-multiple-web-vulnerabilities
CVE ID: CVE-2022-41314 State: PUBLISHED Published: 2023-02-16T20:00:30.335Z Last Updated: 2025-01-27T18:12:28.041Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Network Adapter installer software Problem Types: escalation of privilege Description: Uncontrolled search path in some Intel(R) Network Adapter installer software may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00770.html
CVE ID: CVE-2022-41315 State: PUBLISHED Published: 2022-11-17T22:12:15.395924Z Last Updated: 2024-09-17T01:20:49.352Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Ezoic Inc. Products: Ezoic (WordPress plugin) Problem Types: CWE-79 Description: Auth. Stored Cross-Site Scripting (XSS) vulnerability in Ezoic plugin <= 2.8.8 on WordPress. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ezoic-integration/wordpress-ezoic-plugin-2-8-8-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2022-41316 State: PUBLISHED Published: 2022-10-12T00:00:00.000Z Last Updated: 2025-05-15T14:59:25.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com - https://discuss.hashicorp.com/t/hcsec-2022-24-vaults-tls-cert-auth-method-only-loaded-crl-after-first
ss.hashicorp.com - https://discuss.hashicorp.com/t/hcsec-2022-24-vaults-tls-cert-auth-method-only-loaded-crl-after-first-request/45483 - https://security.netapp.com/advisory/ntap-20221201-0001/
CVE ID: CVE-2022-41317 State: PUBLISHED Published: 2022-12-25T00:00:00.000Z Last Updated: 2025-04-14T18:34:22.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/squid-cache/squid/security/advisories/GHSA-rcg9-7fqm-83mq - http://www.squid-cache.org/Versions/v4/changesets/SQUID-2022_1.patch - http://www.s
ity/advisories/GHSA-rcg9-7fqm-83mq - http://www.squid-cache.org/Versions/v4/changesets/SQUID-2022_1.patch - http://www.squid-cache.org/Versions/v5/changesets/SQUID-2022_1.patch - https://www.openwall.com/lists/oss-security/2022/09/23/1
CVE ID: CVE-2022-41318 State: PUBLISHED Published: 2022-12-25T00:00:00.000Z Last Updated: 2025-04-14T18:33:53.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a client. This is fixed in 5.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/squid-cache/squid/security/advisories/GHSA-394c-rr7q-6g78 - http://www.squid-cache.org/Ver
erences: - https://github.com/squid-cache/squid/security/advisories/GHSA-394c-rr7q-6g78 - http://www.squid-cache.org/Versions/v4/changesets/SQUID-2022_2.patch - http://www.squid-cache.org/Versions/v5/changesets/SQUID-2022_2.patch - https://www.openwall.com/lists/oss-security/2022/09/23/2
CVE ID: CVE-2022-41319 State: PUBLISHED Published: 2022-09-23T00:00:00.000Z Last Updated: 2025-05-27T14:52:20.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross-Site Scripting (XSS) vulnerability affects the Veritas Desktop Laptop Option (DLO) application login page (aka the DLOServer/restore/login.jsp URI). This affects versions before 9.8 (e.g., 9.1 through 9.7). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.veritas.com/content/support/en_US/security/VTS22-014
CVE ID: CVE-2022-41320 State: PUBLISHED Published: 2022-09-23T04:34:45.000Z Last Updated: 2025-05-27T14:50:41.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: Veritas System Recovery (VSR) versions 18 and 21 store a network destination password in the Windows registry during configuration of the backup configuration. This vulnerability could provide a Windows user (who has sufficient privileges) to access a network file system that they were not authorized to access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.veritas.com/content/support/en_US/security/VTS21-002
CVE ID: CVE-2022-41322 State: PUBLISHED Published: 2022-09-23T04:55:54.000Z Last Updated: 2025-06-01T11:02:27.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code execution. The user must display attacker-controlled content in the terminal, then click on a notification popup. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kovidgoyal/kitty/commit/f05783e64d5fa62e1aed603e8d69aced5e49824f - https://bugs.gentoo.org/868543 - https://github.com/kovidgoyal/kitty/compare/v0.26.1...v0.26.2 - https://sw.kovidgoya
- https://bugs.gentoo.org/868543 - https://github.com/kovidgoyal/kitty/compare/v0.26.1...v0.26.2 - https://sw.kovidgoyal.net/kitty/changelog/#detailed-list-of-changes - https://security.gentoo.org/glsa/202209-22 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RRNAPU33PHEH64P77YL3AJO6CTZGHTX/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/47RK7MBSVY5BWDUTYMJUFPBAYFSWMTOI/
CVE ID: CVE-2022-41323 State: PUBLISHED Published: 2022-10-16T00:00:00.000Z Last Updated: 2025-05-14T14:39:38.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://groups.google.com/forum/#%21forum/django-announce - https://docs.djangoproject.com/en/4.0/releases/security/ - https://www.djangoproject.com/weblog/2022/oct/04/security-releases/ - https://github.com/django/django/c
ses/security/ - https://www.djangoproject.com/weblog/2022/oct/04/security-releases/ - https://github.com/django/django/commit/5b6b257fa7ec37ff27965358800c67e2dd11c924 - https://security.netapp.com/advisory/ntap-20221124-0001/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fe
rg/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
CVE ID: CVE-2022-41324 State: PUBLISHED Published: 2024-06-20T00:00:00.000Z Last Updated: 2025-03-14T00:45:33.044Z Vendors: n/a Products: n/a Problem Types: n/a Description: Northern.tech Mender 3.3.x before 3.3.2 and 3.4.x before 3.4.0 has Incorrect Access Control and allows low-privileged users default read access to some sensitive device information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://northern.tech - https://mender.io/blog/cve-2022-45929-cve-2022-41324-improper-access-control-for-low-privileged-users
CVE ID: CVE-2022-41325 State: PUBLISHED Published: 2022-12-06T00:00:00.000Z Last Updated: 2025-04-23T19:35:53.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code under some conditions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://twitter.com/0xMitsurugi - https://www.synacktiv.com/sites/default/files/2022-11/vlc_vnc_int_overflow-CVE-2022-41325.pdf - https://www.videolan.org/security/sb-vlc3018.html - https://www.
files/2022-11/vlc_vnc_int_overflow-CVE-2022-41325.pdf - https://www.videolan.org/security/sb-vlc3018.html - https://www.debian.org/security/2022/dsa-5297
CVE ID: CVE-2022-41326 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-29T15:09:53.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to improper authorization controls. A successful exploit could allow remote code execution within the context of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mitel.com/support/security-advisories - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0009
CVE ID: CVE-2022-41327 State: PUBLISHED Published: 2023-06-13T08:41:41.742Z Last Updated: 2024-10-23T14:27:14.451Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-319 Description: A cleartext transmission of sensitive information vulnerability [CWE-319] in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.8, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.8 allows an authenticated attacker with readonly superadmin privileges to intercept traffic in order to obtain other adminstrators cookies via diagnose CLI commands. Additional Analyst Notes: - CVE Program Conta
in order to obtain other adminstrators cookies via diagnose CLI commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-380
CVE ID: CVE-2022-41328 State: PUBLISHED Published: 2023-03-07T16:04:52.461Z Last Updated: 2025-10-21T23:15:24.263Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiOS Problem Types: CWE-22 Description: A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-2
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-369