Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
/?p=project/cgi-io.git%3Ba=commitdiff%3Bh=901b0f0463c9d16a8cf5b9ed37118d8484bc9176 - https://git.openwrt.org/?p=project/cgi-io.git%3Ba=patch%3Bh=901b0f0463c9d16a8cf5b9ed37118d8484bc9176
CVE ID: CVE-2022-38334 State: PUBLISHED Published: 2022-09-15T00:00:00 Last Updated: 2024-08-03T10:54:03.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: XPDF v4.04 and earlier was discovered to contain a stack overflow via the function Catalog::countPageTree() at Catalog.cc. Additional Analyst Notes: - CVE Program Container: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=42122 - https://forum.xpdfreader.com/viewtopic.php?f=3&t=42314&p=43872
CVE ID: CVE-2022-38335 State: PUBLISHED Published: 2022-09-27T17:10:22.000Z Last Updated: 2025-05-21T14:55:58.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.vtiger.com/ - https://code.vtiger.com/vtiger/vtigercrm - https://github.com/sbaresearch/advisories/tree/public/2022/SBA-ADV-20220328-01_Vtiger_CRM_Stored_Cross-Site_Scripting
CVE ID: CVE-2022-38336 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-24T14:35:46.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.ssh-mitm.at/vulnerabilities/CVE-2022-38336.html
CVE ID: CVE-2022-38337 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-24T14:34:43.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid login attempt which can result in a Denial of Service (DoS) for the user if services like fail2ban are used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.ssh-mitm.at/vulnerabilities/CVE-2022-38337.html - https://mobaxterm.mobatek.net/download-home-edition.html
CVE ID: CVE-2022-38339 State: PUBLISHED Published: 2022-09-19T00:00:00 Last Updated: 2024-08-03T10:54:03.501Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: Safe Software FME Server v2021.2.5, v2022.0.0.2 and below contains a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login page. Additional Analyst Notes: - CVE Program Container: References: - https://community.safe.com/s/article/FME-Server-Stored-Cross-Site-Scripting-XSS-Vulnerabilities - https://www.cycura.com/blog/safe-software-inc-fme-server-vulnerabil
er-Stored-Cross-Site-Scripting-XSS-Vulnerabilities - https://www.cycura.com/blog/safe-software-inc-fme-server-vulnerability-disclosure/
CVE ID: CVE-2022-38340 State: PUBLISHED Published: 2022-09-20T00:00:00.000Z Last Updated: 2025-05-29T13:45:58.032Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerability via the component fmedataupload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://community.safe.com/s/article/Known-Issue-FME-Server-vulnerability-with-arbitrary-path-traversal-and-file-upload - https://www.cycura.com/blog/safe-software-inc-fme-server-vulnerability-disclosure/ - https:
-traversal-and-file-upload - https://www.cycura.com/blog/safe-software-inc-fme-server-vulnerability-disclosure/ - https://community.safe.com/s/article/Known-Issue-Arbitrary-file-upload-with-any-authenticated-FME-Server-account
CVE ID: CVE-2022-38341 State: PUBLISHED Published: 2022-09-19T00:00:00 Last Updated: 2024-08-03T10:54:03.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: Safe Software FME Server v2021.2.5 and below does not employ server-side validation. Additional Analyst Notes: - CVE Program Container: References: - https://community.safe.com/s/article/Known-Issue-Lack-of-server-side-validation-when-creating-a-new-user-in-FME-Server - https://www.cycura.com/blog/safe-software-inc-fme-server-vulnerability-disclosure/
CVE ID: CVE-2022-38342 State: PUBLISHED Published: 2022-09-13T00:00:00 Last Updated: 2024-08-03T10:54:03.187Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:L/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a XML External Entity (XXE) vulnerability which allows authenticated attackers to perform data exfiltration or Server-Side Request Forgery (SSRF) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://community.safe.com/s/article/Known-Issue-FME-Server-XXE-vulnerability-via-adding-a-repository-item - https://www.cycura.com/blog/safe-software-inc-f
/Known-Issue-FME-Server-XXE-vulnerability-via-adding-a-repository-item - https://www.cycura.com/blog/safe-software-inc-fme-server-vulnerability-disclosure/
CVE ID: CVE-2022-38349 State: PUBLISHED Published: 2023-08-22T00:00:00.000Z Last Updated: 2025-11-03T19:27:23.122Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.freedesktop.org/poppler/poppler/-/issues/1282 - https://gitlab.freedesktop.org/poppler/poppler/-/commit/4564a002bcb6094cc460bc0d5ddff9423fe6dd28
CVE ID: CVE-2022-38351 State: PUBLISHED Published: 2022-09-19T20:27:30.000Z Last Updated: 2025-05-29T15:40:51.805Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in Suprema BioStar (aka Bio Star) 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PUT request to the update profile page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://nobugescapes.com/wp-content/uploads/2022/08/Part1.docx - https://nobugescapes.com/blog/privilege-escalation-from-user-operator-to-system-administrator/
CVE ID: CVE-2022-38352 State: PUBLISHED Published: 2022-09-15T01:05:42 Last Updated: 2024-08-03T10:54:03.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This vulnerability allows attackers to execute arbitrary code via a crafted payload. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/top-think/framework/issues/2749
CVE ID: CVE-2022-38355 State: PUBLISHED Published: 2022-12-13T21:12:06.551Z Last Updated: 2025-04-16T16:04:52.712Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Daikin Products: SVMPC1 , SVMPC2 Problem Types: CWE-284 Description: Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to attackers with access to the local area network (LAN) to disclose sensitive information stored by the affected product without requiring authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-284-02
CVE ID: CVE-2022-38356 State: PUBLISHED Published: 2023-05-25T10:25:12.133Z Last Updated: 2025-01-08T21:59:08.157Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: StylemixThemes Products: WordPress Header Builder Plugin – Pearl Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes WordPress Header Builder Plugin – Pearl plugin <= 1.3.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/pearl-header-builder/wordpress-pearl-plugin-1-3-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2022-38357 State: PUBLISHED Published: 2022-08-15T22:07:49 Last Updated: 2024-08-03T10:54:03.231Z Vendors: n/a Products: Eyes of Network Web Problem Types: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Description: Improper neutralization of special elements leaves the Eyes of Network Web application vulnerable to an iFrame injection attack, via the url parameter of /module/module_frame/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2022-29
CVE ID: CVE-2022-38358 State: PUBLISHED Published: 2022-08-15T22:04:14 Last Updated: 2024-08-03T10:54:03.707Z Vendors: n/a Products: Eyes of Network Problem Types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: Improper neutralization of input during web page generation leaves the Eyes of Network web application vulnerable to cross-site scripting attacks at /module/admin_notifiers/rules.php and /module/report_event/indext.php via the parameters rule_notification, rule_name, and rule_name_old, and at /module/admin_user/add_modify_user.php via the parameters user_name and user_email. Additional Analyst Notes: - CVE Program Container: Reference
odify_user.php via the parameters user_name and user_email. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2022-29
CVE ID: CVE-2022-38359 State: PUBLISHED Published: 2022-08-15T22:05:17 Last Updated: 2024-08-03T10:54:03.294Z Vendors: n/a Products: Eyes of Network Problem Types: Cross-Site Request Forgery (CSRF) Description: Cross-site request forgery attacks can be carried out against the Eyes of Network web application, due to an absence of adequate protections. An attacker can, for instance, delete the admin user by directing an authenticated user to the URL https://<target-address>/module/admin_user/index.php?DataTables_Table_0_length=10&user_selected%5B%5D=1&user_mgt_list=delete_user&action=submit by means of a crafted link. Additional Analyst Notes: - CVE Program Container: References: - https://www
r&action=submit by means of a crafted link. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2022-29
CVE ID: CVE-2022-38362 State: PUBLISHED Published: 2022-08-16T14:10:09 Last Updated: 2024-08-03T10:54:03.738Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: Remote Code Execution Description: Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb - http://www.openwall.com/lists/oss-security/2022/08/16/1
CVE ID: CVE-2022-38367 State: PUBLISHED Published: 2022-09-05T17:30:21 Last Updated: 2024-08-03T10:54:03.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Netic User Export add-on before 2.0.6 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user to export all users from Jira by making an HTTP request to the affected endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://marketplace.atlassian.com/apps/1220535/user-export-for-jira - https://gist.github.com/CveCt0r/72a0b6292cd8d80499cf5971ae58147f
CVE ID: CVE-2022-38368 State: PUBLISHED Published: 2022-08-15T20:59:09 Last Updated: 2024-08-03T10:54:03.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authentication, an authenticated VPN user can inject arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://docs.aviatrix.com/HowTos/PSIRT_Advisories.html#aviatrix-controller-and-gateways-unauthorized-access
CVE ID: CVE-2022-38369 State: PUBLISHED Published: 2022-09-05T09:50:09 Last Updated: 2024-08-03T10:54:03.709Z Vendors: Apache Software Foundation Products: Apache IoTDB Problem Types: Description: Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/7nk03ywvx3t3yjbcxzt7zy4nyc89y9b0 - http://www.openwall.com/lists/oss-security/2022/09/05/1
CVE ID: CVE-2022-38370 State: PUBLISHED Published: 2022-09-05T09:50:10 Last Updated: 2024-08-03T10:54:03.893Z Vendors: Apache Software Foundation Products: Apache IoTDB Problem Types: Description: Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should upgrade to version 0.13.1 which addresses this issue. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/kcpqgstvgf8sxy9ktxm1836nlwc8xy3j - http://www.openwall.com/lists/oss-security/2022/09/05/2
CVE ID: CVE-2022-38371 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2025-05-13T09:38:10.488Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Siemens Products: APOGEE MBC (PPC) (BACnet), APOGEE MBC (PPC) (P2 Ethernet), APOGEE MEC (PPC) (BACnet), APOGEE MEC (PPC) (P2 Ethernet), APOGEE PXC Compact (BACnet), APOGEE PXC Compact (P2 Ethernet), APOGEE PXC Modular (BACnet), APOGEE PXC Modular (P2 Ethernet), Desigo PXC00-E.D, Desigo PXC00-U, Desigo PXC001-E.D, Desigo PXC100-E.D, Desigo PXC12-E.D, Desigo PXC128-U, Desigo PXC200-E.D, Desigo PXC22-E.D, Desigo PXC22.1-E.D, Desigo PXC36.1-E.D, Desigo PXC50-E.D, Desigo PXC64-U, Desigo PXM20-E, Nucleus NET fo
sigo PXC22-E.D, Desigo PXC22.1-E.D, Desigo PXC36.1-E.D, Desigo PXC50-E.D, Desigo PXC64-U, Desigo PXM20-E, Nucleus NET for Nucleus PLUS V1, Nucleus NET for Nucleus PLUS V2, Nucleus ReadyStart V3 V2012, Nucleus ReadyStart V3 V2017, Nucleus Source Code, TALON TC Compact (BACnet), TALON TC Modular (BACnet) Problem Types: CWE-400 Description: A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (Al
net) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), Desigo PXC00-E.D (All versions >= V2.3 < V6.30.37), Desigo PXC00-U (All versions >= V2.3 < V6.30.37), Desigo PXC001-E.D (All versions >= V2.3 < V6.30.37), Desigo PXC100-E.D (All versions >= V2.3 < V6.30.37), Desigo PXC12-E.D (All versions >= V2.3 < V6.30.37), Desigo PXC128-U (All versions >= V2.3 < V6.30.37), Desigo PXC200-E.D (All versions >= V2.3 < V6.30.37), Desigo PXC22-E.D (All versions >= V2.3 < V6.30.37), Desigo PXC22.1-E.D (All versions >= V2.3 < V6.30.37), Desigo PXC36.1-E.D (All versi
D (All versions >= V2.3 < V6.30.37), Desigo PXC22.1-E.D (All versions >= V2.3 < V6.30.37), Desigo PXC36.1-E.D (All versions >= V2.3 < V6.30.37), Desigo PXC50-E.D (All versions >= V2.3 < V6.30.37), Desigo PXC64-U (All versions >= V2.3 < V6.30.37), Desigo PXM20-E (All versions >= V2.3 < V6.30.37), Nucleus NET for Nucleus PLUS V1 (All versions < V5.2a), Nucleus NET for Nucleus PLUS V2 (All versions < V5.4), Nucleus ReadyStart V3 V2012 (All versions < V2012.08.1), Nucleus ReadyStart V3 V2017 (All versions < V2017.02.4), Nucleus Source Code (All versions including affected FTP server), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The FTP se
erver), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The FTP server does not properly release memory resources that were reserved for incomplete connection attempts by FTP clients. This could allow a remote attacker to generate a denial of service condition on devices that incorporate a vulnerable version of the FTP server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-313313.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-935500.pdf - https://cert-portal.siemens.com/productcert/html/ssa-935500.html - https://cert-portal.siemens.co
t/pdf/ssa-935500.pdf - https://cert-portal.siemens.com/productcert/html/ssa-935500.html - https://cert-portal.siemens.com/productcert/html/ssa-313313.html
CVE ID: CVE-2022-38372 State: PUBLISHED Published: 2022-11-02T00:00:00 Last Updated: 2024-10-25T13:21:01.406Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiTester Problem Types: Improper access control Description: A hidden functionality vulnerability [CWE-1242] in FortiTester CLI 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow a local, privileged user to obtain a root shell on the device via an undocumented command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-283
CVE ID: CVE-2022-38373 State: PUBLISHED Published: 2022-11-02T00:00:00 Last Updated: 2024-10-25T13:20:50.572Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: Fortinet FortiDeceptor Problem Types: Execute unauthorized code or commands Description: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiDeceptor management interface 4.2.0, 4.1.0 through 4.1.1, 4.0.2 may allow an authenticated user to perform a cross site scripting (XSS) attack via sending requests with specially crafted lure resource ID. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
ly crafted lure resource ID. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-331
CVE ID: CVE-2022-38374 State: PUBLISHED Published: 2022-11-02T00:00:00 Last Updated: 2024-10-25T13:20:38.157Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:U/RC:R) Vendors: Fortinet Products: Fortinet FortiADC Problem Types: Execute unauthorized code or commands Description: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiADC 7.0.0 - 7.0.2 and 6.2.0 - 6.2.4 allows an attacker to execute unauthorized code or commands via the URL and User fields observed in the traffic and event logviews. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-232
CVE ID: CVE-2022-38375 State: PUBLISHED Published: 2023-02-16T18:06:21.944Z Last Updated: 2024-10-23T14:46:49.340Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiNAC Problem Types: CWE-285 Description: An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-329
CVE ID: CVE-2022-38376 State: PUBLISHED Published: 2023-02-16T18:06:24.667Z Last Updated: 2024-10-22T20:49:55.702Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiNAC Problem Types: CWE-79 Description: Multiple improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilities [CWE-79] in Fortinet FortiNAC portal UI before 9.4.1 allows an attacker to perform an XSS attack via crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-273
CVE ID: CVE-2022-38377 State: PUBLISHED Published: 2022-11-25T15:47:41.422Z Last Updated: 2024-10-22T20:52:08.654Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiManager, FortiAnalyzer Problem Types: CWE-284 Description: An improper access control vulnerability [CWE-284] in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11 and FortiAnalyzer 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.0 through 6.0.12 may allow a remote and authenticated admin user assigned to a specific ADOM to access other ADOMs information such as device information a
and authenticated admin user assigned to a specific ADOM to access other ADOMs information such as device information and dashboard information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-20-143
CVE ID: CVE-2022-38378 State: PUBLISHED Published: 2023-02-16T18:06:36.339Z Last Updated: 2024-10-22T20:49:30.558Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiOS, FortiProxy Problem Types: CWE-269 Description: An improper privilege management vulnerability [CWE-269] in Fortinet FortiOS version 7.2.0 and before 7.0.7 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allows an attacker that has access to the admin profile section (System subsection Administrator Users) to modify their own profile and upgrade their privileges to Read Write via CLI or GUI commands. Additional Analyst Notes: - CVE Program Containe
ile and upgrade their privileges to Read Write via CLI or GUI commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-346
CVE ID: CVE-2022-38379 State: PUBLISHED Published: 2022-12-06T16:00:58.746Z Last Updated: 2024-10-22T20:51:29.381Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiSOAR Problem Types: CWE-79 Description: Improper neutralization of input during web page generation [CWE-79] in FortiSOAR 7.0.0 through 7.0.3 and 7.2.0 may allow an authenticated attacker to inject HTML tags via input fields of various components within FortiSOAR. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-220
CVE ID: CVE-2022-38380 State: PUBLISHED Published: 2022-11-02T00:00:00 Last Updated: 2024-10-22T20:52:46.827Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Improper access control Description: An improper access control [CWE-284] vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticated read-only user to modify the interface settings via the API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-174