Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-22988 State: PUBLISHED Published: 2024-02-23T00:00:00.000Z Last Updated: 2025-06-10T13:26:43.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because the filename is based on a predictable timestamp. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://zkteco.com - https://gist.github.com/whiteman007/b50a9b64007a5d7bcb7a8bee61d2cb47 - https://www.vicarius.io/vsociety/posts/revealing-cve-2024-22988-a-unique-dive-into-exploiting-access-control-gaps-in-zkbio-wdms-uncover-the-untold-crafted-for
/revealing-cve-2024-22988-a-unique-dive-into-exploiting-access-control-gaps-in-zkbio-wdms-uncover-the-untold-crafted-for-beginners-with-a-rare-glimpse-into-pentesting-strategies - https://www.zkteco.com/en/Security_Bulletinsibs/12
CVE ID: CVE-2024-23031 State: PUBLISHED Published: 2024-02-01T00:00:00.000Z Last Updated: 2025-06-04T15:24:01.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in is_water parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/weng-xianhu/eyoucms/issues/57
CVE ID: CVE-2024-23032 State: PUBLISHED Published: 2024-02-01T00:00:00.000Z Last Updated: 2025-06-20T20:01:13.968Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in num parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/weng-xianhu/eyoucms/issues/57
CVE ID: CVE-2024-23033 State: PUBLISHED Published: 2024-02-01T00:00:00.000Z Last Updated: 2025-05-29T15:02:27.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in the path parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/weng-xianhu/eyoucms/issues/57
CVE ID: CVE-2024-23034 State: PUBLISHED Published: 2024-02-01T00:00:00.000Z Last Updated: 2025-05-29T15:02:18.619Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in the input parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/weng-xianhu/eyoucms/issues/57
CVE ID: CVE-2024-23049 State: PUBLISHED Published: 2024-02-05T00:00:00.000Z Last Updated: 2025-06-17T19:47:55.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/88250/symphony/issues/82
CVE ID: CVE-2024-23052 State: PUBLISHED Published: 2024-02-01T00:00:00 Last Updated: 2024-08-27T19:30:08.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/By-Yexing/Vulnerability_JAVA/blob/main/2024/WukongCRM_9.0.md#1remote-code-execution-vulnerability - https://github.com/WuKongOpenSource/WukongCRM-9.0-JAVA/issues/28
CVE ID: CVE-2024-23054 State: PUBLISHED Published: 2024-02-05T00:00:00 Last Updated: 2024-08-01T22:51:11.248Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package listed in ++plone++static/components not existing in the public package index (npm). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://plone.com - http://ploneorg.com - https://github.com/c0d3x27/CVEs/blob/main/CVE-2024-23054/README.md
CVE ID: CVE-2024-23055 State: PUBLISHED Published: 2024-01-25T00:00:00.000Z Last Updated: 2025-06-17T14:19:33.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validation of input by the HOST headers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://plone.com - http://ploneorg.com - https://github.com/c0d3x27/CVEs/tree/main/CVE-2024-23055
CVE ID: CVE-2024-23057 State: PUBLISHED Published: 2024-01-11T00:00:00 Last Updated: 2024-08-30T19:15:07.770Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the tz parameter in the setNtpCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/5/TOTOlink%20A3300R%20setNtpCfg.md
CVE ID: CVE-2024-23058 State: PUBLISHED Published: 2024-01-11T00:00:00 Last Updated: 2024-10-01T20:18:03.993Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pass parameter in the setTr069Cfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/6/TOTOlink%20A3300R%20setTr069Cfg.md
CVE ID: CVE-2024-23059 State: PUBLISHED Published: 2024-01-11T00:00:00.000Z Last Updated: 2025-06-03T14:25:52.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the username parameter in the setDdnsCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/2/TOTOlink%20A3300R%20setDdnsCfg.md
CVE ID: CVE-2024-23060 State: PUBLISHED Published: 2024-01-11T00:00:00.000Z Last Updated: 2025-06-17T19:56:36.948Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDmzCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/4/TOTOLINK%20A3300R%20setDmzCfg.md
CVE ID: CVE-2024-23061 State: PUBLISHED Published: 2024-01-11T00:00:00.000Z Last Updated: 2025-06-20T16:35:29.260Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the minute parameter in the setScheduleCfg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/3/TOTOLINK%20A3300R%20setScheduleCfg.md
CVE ID: CVE-2024-23076 State: PUBLISHED Published: 2024-04-10T00:00:00 Last Updated: 2024-10-25T20:17:57.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFreeChart v1.5.4 was discovered to contain a NullPointerException via the component /labels/BubbleXYItemLabelGenerator.java. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://jfreechart.com - https://github.com/jfree/jfreechart -
Program Container: - CISA ADP Vulnrichment: References: - http://jfreechart.com - https://github.com/jfree/jfreechart - https://gist.github.com/LLM4IG/115de1f7c3051403f0301cee0d293518
CVE ID: CVE-2024-23077 State: PUBLISHED Published: 2024-04-10T00:00:00 Last Updated: 2024-08-21T13:40:15.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the component /chart/plot/CompassPlot.java. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://jfreechart.com - https://github.com/jfree/jfreechart - htt
gram Container: - CISA ADP Vulnrichment: References: - http://jfreechart.com - https://github.com/jfree/jfreechart - https://gist.github.com/LLM4IG/f55de46e65fb5a19b7815adb36fd858b
CVE ID: CVE-2024-23078 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-08-01T22:51:11.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: JGraphT Core v1.5.2 was discovered to contain a NullPointerException via the component org.jgrapht.alg.util.ToleranceDoubleComparator::compare(Double, Double). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://jgrapht.com - https:/
. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://jgrapht.com - https://github.com/jgrapht/jgrapht - https://gist.github.com/LLM4IG/5feabadf06a88102df316174123e2770
CVE ID: CVE-2024-23079 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-10-31T15:19:54.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: JGraphT Core v1.5.2 was discovered to contain a NullPointerException via the component org.jgrapht.alg.util.ToleranceDoubleComparator::compare(Double, Double). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://jgrapht.com - https:/
. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://jgrapht.com - https://github.com/jgrapht/jgrapht - https://gist.github.com/LLM4IG/c19779800945cd0a400d2150fb83d079
CVE ID: CVE-2024-23080 State: PUBLISHED Published: 2024-04-10T00:00:00 Last Updated: 2024-08-27T14:16:15.311Z Vendors: n/a Products: n/a Problem Types: n/a Description: Joda Time v2.12.5 was discovered to contain a NullPointerException via the component org.joda.time.format.PeriodFormat::wordBased(Locale). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://joda.com - https://github.com/JodaOrg/joda
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://joda.com - https://github.com/JodaOrg/joda-time - https://gist.github.com/LLM4IG/6614bfa658295d7af07a6d37e06db27f
CVE ID: CVE-2024-23081 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-08-01T22:51:11.278Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThreeTen Backport v1.6.8 was discovered to contain a NullPointerException via the component org.threeten.bp.LocalDate::compareTo(ChronoLocalDate). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://threeten.com - https://github.com/
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://threeten.com - https://github.com/ThreeTen/threetenbp - https://gist.github.com/LLM4IG/3cc9183dcd887020368a0bafeafec5e3
CVE ID: CVE-2024-23082 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-08-01T22:51:11.294Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThreeTen Backport v1.6.8 was discovered to contain an integer overflow via the component org.threeten.bp.format.DateTimeFormatter::parse(CharSequence, ParsePosition). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://threeten.com -
ication. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://threeten.com - https://github.com/ThreeTen/threetenbp - https://gist.github.com/LLM4IG/d2618f5f4e5ac37eb75cff5617e58b90
CVE ID: CVE-2024-23083 State: PUBLISHED Published: 2024-04-10T00:00:00 Last Updated: 2024-11-07T20:06:02.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: Time4J Base v5.9.3 was discovered to contain a NullPointerException via the component net.time4j.format.internal.FormatUtils::useDefaultWeekmodel(Locale). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://time4j.com - https://githu
itional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://time4j.com - https://github.com/MenoData/Time4J - https://gist.github.com/LLM4IG/624598834f6699e3617d47c675227e97
CVE ID: CVE-2024-23084 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-08-20T14:52:30.047Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apfloat v1.10.1 was discovered to contain an ArrayIndexOutOfBoundsException via the component org.apfloat.internal.DoubleCRTMath::add(double[], double[]). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://apfloat.com - https://gith
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://apfloat.com - https://github.com/mtommila/apfloat - https://gist.github.com/LLM4IG/5b7dd0a87db14d9c95d4c0ea62e0195b
CVE ID: CVE-2024-23085 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-08-01T22:51:11.209Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apfloat v1.10.1 was discovered to contain a NullPointerException via the component org.apfloat.internal.DoubleScramble::scramble(double[], int, int[]). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://apfloat.com - https://github.
onal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://apfloat.com - https://github.com/mtommila/apfloat - https://gist.github.com/LLM4IG/a4a54fc4abe044976a66af9fffedfc94
CVE ID: CVE-2024-23086 State: PUBLISHED Published: 2024-04-08T00:00:00 Last Updated: 2024-10-28T13:54:07.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apfloat v1.10.1 was discovered to contain a stack overflow via the component org.apfloat.internal.DoubleModMath::modPow(double. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://apfloat.com - https://github.com/mtommila/apfloat - h
E Program Container: - CISA ADP Vulnrichment: References: - http://apfloat.com - https://github.com/mtommila/apfloat - https://gist.github.com/LLM4IG/63ad1a4d1e3955043b7a90fdbf36676b
CVE ID: CVE-2024-23091 State: PUBLISHED Published: 2024-07-30T00:00:00.000Z Last Updated: 2025-03-18T19:23:00.788Z Vendors: n/a Products: n/a Problem Types: n/a Description: Weak password hashing using MD5 in funzioni.php in HotelDruid before 1.32 allows an attacker to obtain plaintext passwords from hash values. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.hoteldruid.com/en/download.html - https://medium.com/%40cnetsec/security-advisory-cve-2024-23091-weak-password-hashing-using-md5-f18a6fe3a473
CVE ID: CVE-2024-23094 State: PUBLISHED Published: 2024-02-22T00:00:00.000Z Last Updated: 2025-04-22T16:21:04.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: Flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /cover/addons/info_media_gallery/action/edit_addon_post.php Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/TinkAnet/cve/blob/main/csrf3.md
CVE ID: CVE-2024-23105 State: PUBLISHED Published: 2024-05-14T16:19:14.223Z Last Updated: 2024-08-01T22:51:11.244Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiPortal Problem Types: CWE-348 Description: A Use Of Less Trusted Source [CWE-348] vulnerability in Fortinet FortiPortal version 7.0.0 through 7.0.6 and version 7.2.0 through 7.2.1 allows an unauthenticated attack to bypass IP protection through crafted HTTP or HTTPS packets. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-24-021
CVE ID: CVE-2024-23106 State: PUBLISHED Published: 2025-01-14T14:10:00.950Z Last Updated: 2025-02-18T21:34:28.472Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiClientEMS Problem Types: CWE-307 Description: An improper restriction of excessive authentication attempts [CWE-307] in FortiClientEMS version 7.2.0 through 7.2.4 and before 7.0.10 allows an unauthenticated attacker to try a brute force attack against the FortiClientEMS console via crafted HTTP or HTTPS requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-476
CVE ID: CVE-2024-23107 State: PUBLISHED Published: 2024-06-03T07:55:21.908Z Last Updated: 2024-08-01T22:51:11.271Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-200 Description: An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiWeb version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, 6.3 all versions may allow an authenticated attacker to read password hashes of other administrators via CLI commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-191
CVE ID: CVE-2024-23108 State: PUBLISHED Published: 2024-02-05T13:26:15.727Z Last Updated: 2025-04-24T15:54:48.080Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiSIEM Problem Types: CWE-78 Description: An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 7.1.0 through 7.1.1 and 7.0.0 through 7.0.2 and 6.7.0 through 6.7.8 and 6.6.0 through 6.6.3 and 6.5.0 through 6.5.2 and 6.4.0 through 6.4.2 allows attacker to execute unauthorized code or commands via via crafted API requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Contain
code or commands via via crafted API requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-130
CVE ID: CVE-2024-23109 State: PUBLISHED Published: 2024-02-05T13:26:02.611Z Last Updated: 2024-08-01T22:51:11.339Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiSIEM Problem Types: CWE-78 Description: An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 7.1.0 through 7.1.1 and 7.0.0 through 7.0.2 and 6.7.0 through 6.7.8 and 6.6.0 through 6.6.3 and 6.5.0 through 6.5.2 and 6.4.0 through 6.4.2 allows attacker to execute unauthorized code or commands via via crafted API requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Contain
CVE ID: CVE-2024-23110 State: PUBLISHED Published: 2024-06-11T14:31:59.230Z Last Updated: 2024-08-01T22:51:11.248Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiOS Problem Types: CWE-121 Description: A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0 all versions allows attacker to execute unauthorized code or commands via specially crafted commands Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-460
CVE ID: CVE-2024-23111 State: PUBLISHED Published: 2024-06-11T14:32:00.312Z Last Updated: 2025-08-27T20:42:53.533Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-79 Description: An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions reboot page may allow a remote privileged attacker with super-admin access to execute JavaScript code via crafted HTTP GET requests. Additional Analyst Notes:
ged attacker with super-admin access to execute JavaScript code via crafted HTTP GET requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-471
CVE ID: CVE-2024-23112 State: PUBLISHED Published: 2024-03-12T15:09:17.877Z Last Updated: 2024-08-01T22:51:11.269Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-639 Description: An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticated attacker to gain access to another user’s bookmark via URL manipulation. Additional Analyst Notes: - CISA ADP Vuln