Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-22045 State: PUBLISHED Published: 2022-01-04T21:39:03 Last Updated: 2024-08-03T18:30:24.037Z Vendors: n/a Products: VMware ESXi, VMware Workstation and VMware Fusion Problem Types: Heap-based Buffer Overflow Vulnerability Description: VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.0) contains a heap-overflow vulnerability in CD-ROM device emulation. A malicious actor with access to a virtual machine with CD-ROM device emulation may be able to exploit this vulnerability in conjunction with other issues to execute code on the hypervisor from a virtual machine. Additional Analyst Notes:
ity in conjunction with other issues to execute code on the hypervisor from a virtual machine. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0001.html - http://packetstormsecurity.com/files/165440/VMware-Security-Advisory-2022-0001.html - https://www.zerodayinitiative.com/advisories/ZDI-22-003/
CVE ID: CVE-2021-22047 State: PUBLISHED Published: 2021-10-28T15:21:26 Last Updated: 2024-08-03T18:30:23.959Z Vendors: n/a Products: Spring Data REST Problem Types: CWE-200 Description: In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for unauthorized access depending on the Spring Security configuration. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2021-22047
CVE ID: CVE-2021-22048 State: PUBLISHED Published: 2021-11-10T17:50:53 Last Updated: 2024-08-03T18:30:23.971Z Vendors: n/a Products: VMware vCenter Server and VMware Cloud Foundation Problem Types: Privilege escalation vulnerability Description: The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. A malicious actor with non-administrative access to vCenter Server may exploit this issue to elevate privileges to a higher privileged group. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2021-0025.html - http://packetstormsecurity.com/files/167733/
erences: - https://www.vmware.com/security/advisories/VMSA-2021-0025.html - http://packetstormsecurity.com/files/167733/VMware-Security-Advisory-2022-0025.2.html - http://packetstormsecurity.com/files/167795/VMware-Security-Advisory-2021-0025.3.html
CVE ID: CVE-2021-22049 State: PUBLISHED Published: 2021-11-24T16:32:59 Last Updated: 2024-08-03T18:30:24.029Z Vendors: n/a Products: VMware vCenter Server and VMware Cloud Foundation Problem Types: SSRF vulnerability Description: The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in. A malicious actor with network access to port 443 on vCenter Server may exploit this issue by accessing a URL request outside of vCenter Server or accessing an internal service. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2021-0027.html
CVE ID: CVE-2021-22050 State: PUBLISHED Published: 2022-02-16T16:37:56 Last Updated: 2024-08-03T18:30:23.946Z Vendors: n/a Products: VMware ESXi and VMware Cloud Foundation Problem Types: Denial of service vulnerability Description: ESXi contains a slow HTTP POST denial-of-service vulnerability in rhttpproxy. A malicious actor with network access to ESXi may exploit this issue to create a denial-of-service condition by overwhelming rhttpproxy service with multiple requests. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2022-0004.html
CVE ID: CVE-2021-22051 State: PUBLISHED Published: 2021-11-08T13:37:29 Last Updated: 2024-08-03T18:30:23.942Z Vendors: n/a Products: Spring Cloud Gateway Problem Types: Specifically crafted requests could make an extra request on downstream services. Description: Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or newer. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2021-22051
CVE ID: CVE-2021-22053 State: PUBLISHED Published: 2021-11-19T15:56:11 Last Updated: 2024-08-03T18:30:23.933Z Vendors: n/a Products: Spring Cloud Netflix Problem Types: CWE-94 Description: Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2021-22
xecution. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2021-22053
CVE ID: CVE-2021-22054 State: PUBLISHED Published: 2021-12-17T16:10:18 Last Updated: 2024-08-03T18:30:23.947Z Vendors: n/a Products: VMware Workspace ONE UEM console Problem Types: VMware Workspace ONE UEM console patches SSRF vulnerability Description: VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without authentication and to gain access to sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA
mation. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2021-0029.html
CVE ID: CVE-2021-22055 State: PUBLISHED Published: 2022-04-11T19:37:38 Last Updated: 2024-08-03T18:30:23.941Z Vendors: n/a Products: Photon OS Problem Types: Heap-based buffer overflow issues via Cortado ThinPrint Description: The SchedulerServer in Vmware photon allows remote attackers to inject logs through \r in the package parameter. Attackers can also insert malicious data and fake entries. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/vmware/photon/wiki/log_injection_vulnerability
CVE ID: CVE-2021-22056 State: PUBLISHED Published: 2021-12-20T20:08:27 Last Updated: 2024-08-03T18:30:23.964Z Vendors: n/a Products: VMware Workspace ONE Access and Identity Manager Problem Types: VMware Workspace Access and Identity Manager patches SSRF vulnerability Description: VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3 contain an SSRF vulnerability. A malicious actor with network access may be able to make HTTP requests to arbitrary origins and read the full response. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2021-0030.html
CVE ID: CVE-2021-22057 State: PUBLISHED Published: 2021-12-20T20:08:26 Last Updated: 2024-08-03T18:30:24.010Z Vendors: n/a Products: VMware Workspace ONE Access Problem Types: VMware Workspace Access Authentication bypass vulnerability Description: VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 contain an authentication bypass vulnerability. A malicious actor, who has successfully provided first-factor authentication, may be able to obtain second-factor authentication provided by VMware Verify. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2021-0030.html
CVE ID: CVE-2021-22060 State: PUBLISHED Published: 2022-01-07T22:39:55 Last Updated: 2024-08-03T18:30:23.916Z Vendors: n/a Products: Spring Framework Problem Types: Malicious input to cause the insertion of additional log entries. Description: In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2021-22060 - https
dditional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2021-22060 - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2021-22095 State: PUBLISHED Published: 2021-11-30T18:41:35 Last Updated: 2024-08-03T18:30:23.925Z Vendors: n/a Products: Spring AMQP Problem Types: CWE-502 Description: In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2021-22097
CVE ID: CVE-2021-22096 State: PUBLISHED Published: 2021-10-28T15:22:35 Last Updated: 2024-08-03T18:30:23.932Z Vendors: n/a Products: Spring Framework Problem Types: CWE-117 Description: In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2021-22096 - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20211125-0005/
CVE ID: CVE-2021-22097 State: PUBLISHED Published: 2021-10-28T15:24:19 Last Updated: 2024-08-03T18:30:24.007Z Vendors: n/a Products: Spring AMQP Problem Types: CWE-502 Description: In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100% CPU usage in the application if the toString() method is called. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2021-22097
CVE ID: CVE-2021-22098 State: PUBLISHED Published: 2021-08-11T20:49:28 Last Updated: 2024-08-03T18:30:23.979Z Vendors: n/a Products: UAA server Problem Types: CWE-601 Description: UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability. A malicious user can exploit the open redirect vulnerability by social engineering leading to take over of victims’ accounts in certain cases along with redirection of UAA users to a malicious sites. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2021-22098-open-redirect-vulnerability-in-uaa-server/
CVE ID: CVE-2021-22100 State: PUBLISHED Published: 2022-03-25T18:02:40 Last Updated: 2024-08-03T18:30:23.950Z Vendors: n/a Products: Cloud Controller (CAPI) by cloud foundry Problem Types: CWE-400 Description: In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a service broker that (accidentally or maliciously) causes CC instances to timeout and fail is possible. An attacker can leverage this vulnerability to cause an inability for anyone to push or manage apps. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2021-22100-cloud-controller-is-vulnerable-to-denial-of-service-due-to-misbeha
s: - https://www.cloudfoundry.org/blog/cve-2021-22100-cloud-controller-is-vulnerable-to-denial-of-service-due-to-misbehaving-service-brokers/
CVE ID: CVE-2021-22101 State: PUBLISHED Published: 2021-10-27T14:18:07 Last Updated: 2024-08-03T18:30:23.963Z Vendors: n/a Products: Cloud Foundry Cloud Controller Problem Types: CWE-400 Description: Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated attackers to cause denial of service by using REST HTTP requests with label_selectors on multiple V3 endpoints by generating an enormous SQL query. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2021-22101-cloud-controller-is-vulnerable-to-unauthenticated-denial-of-service/
CVE ID: CVE-2021-22112 State: PUBLISHED Published: 2021-02-23T18:48:02 Last Updated: 2024-08-03T18:30:24.008Z Vendors: n/a Products: Spring Security Problem Types: Privilege Escalation by changing security context Description: Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those priv
ser to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2021/02/19/7 - https://lists.apache.org/thread.html/redbd004a503b3520ae5746c2ab5e93fd7da807a8c128e60d2002cd9b%40%3Cissues.nifi.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - https://tanzu.vmware.com/security/cve-2021-22112 - https://lists.apache.org/thread.html/r37423ec7eea340e92a409452c35b649dce02fdc467f0b3f52086c177%40%3Cpluto-dev.portals.apache.org%3E - https://lists.apache.org/thread.html/ra6389b1b82
c35b649dce02fdc467f0b3f52086c177%40%3Cpluto-dev.portals.apache.org%3E - https://lists.apache.org/thread.html/ra6389b1b82108a3b6bbcd22979f7665fd437c2a3408c9509a15a9ca1%40%3Cpluto-dev.portals.apache.org%3E - https://lists.apache.org/thread.html/r2cb05e499807900ba23e539643eead9c5f0652fd271f223f89da1804%40%3Cpluto-scm.portals.apache.org%3E - https://lists.apache.org/thread.html/r163b3e4e39803882f5be05ee8606b2b9812920e196daa2a82997ce14%40%3Cpluto-dev.portals.apache.org%3E - https://lists.apache.org/thread.html/r390783b3b1c59b978131ac08390bf77fbb3863270cbde59d5b0f5fde%40%3Cpluto-dev.portals.apache.org%3E - https://lists.apache.org/thread.html/r3868207b967f926819fe3aa8d33f1666429be589bb4a62104a49f4
dev.portals.apache.org%3E - https://lists.apache.org/thread.html/r3868207b967f926819fe3aa8d33f1666429be589bb4a62104a49f4e3%40%3Cpluto-dev.portals.apache.org%3E - https://lists.apache.org/thread.html/r413e380088c427f56102968df89ef2f336473e1b56b7d4b3a571a378%40%3Cpluto-dev.portals.apache.org%3E - https://lists.apache.org/thread.html/r89aa1b48a827f5641310305214547f1d6b2101971a49b624737c497f%40%3Cpluto-dev.portals.apache.org%3E - https://lists.apache.org/thread.html/ra53677224fe4f04c2599abc88032076faa18dc84b329cdeba85d4cfc%40%3Cpluto-scm.portals.apache.org%3E - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2021-22113 State: PUBLISHED Published: 2021-02-23T16:04:45 Last Updated: 2024-08-03T18:30:23.940Z Vendors: n/a Products: Spring Cloud Netflix Zuul Problem Types: Sensitive Headers restriction bypass Description: Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing the “Sensitive Headers” restriction when executing requests with specially constructed URLs. Applications that use Spring Security's StrictHttpFirewall (enabled by default for all URLs) are not affected by the vulnerability, as they reject requests that allow bypassing. Additional Analyst Notes: - CVE Program Container: References: -
rability, as they reject requests that allow bypassing. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2021-22113
CVE ID: CVE-2021-22114 State: PUBLISHED Published: 2021-03-01T17:23:42 Last Updated: 2024-08-03T18:30:23.920Z Vendors: n/a Products: Spring Integration Zip extension Problem Types: Arbitrary file write vulnerability Description: Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder. Additional Analyst Notes: - CVE Program Contai
xtraction directory, the final path ends up outside of the target folder. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2021-22114
CVE ID: CVE-2021-22115 State: PUBLISHED Published: 2021-04-08T17:28:05 Last Updated: 2024-08-03T18:30:23.946Z Vendors: n/a Products: Cloud Control API Problem Types: Clear text logging of credentials Description: Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging config field is changed. CAPI database logs service broker password in plain text whenever a job to clean up orphaned items is run by Cloud Controller. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2021-22115-capi-logs-service-broker-credentials/
CVE ID: CVE-2021-22116 State: PUBLISHED Published: 2021-06-08T11:23:58 Last Updated: 2024-08-03T18:30:23.992Z Vendors: n/a Products: RabbitMQ Problem Types: CWE-400 Description: RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2021-22116 - https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html
CVE ID: CVE-2021-22117 State: PUBLISHED Published: 2021-05-18T12:47:11 Last Updated: 2024-08-03T18:30:23.929Z Vendors: n/a Products: RabbitMQ Problem Types: CWE-94 Description: RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing attackers with sufficient local filesystem permissions to add arbitrary plugins. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2021-22117
CVE ID: CVE-2021-22118 State: PUBLISHED Published: 2021-05-27T14:48:16 Last Updated: 2024-08-03T18:30:23.944Z Vendors: n/a Products: Spring Framework Problem Types: CWE-269 Description: In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2021-22118 - https://www.oracle.com//s
tes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2021-22118 - https://www.oracle.com//security-alerts/cpujul2021.html - https://security.netapp.com/advisory/ntap-20210713-0005/ - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-22119 State: PUBLISHED Published: 2021-06-29T16:15:05 Last Updated: 2024-08-03T18:30:23.943Z Vendors: n/a Products: Spring Security Problem Types: CWE-400 Description: Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session or multiple sessions. Additional Analyst
which has the potential of exhausting system resources using a single session or multiple sessions. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2021-22119 - https://lists.apache.org/thread.html/r163b3e4e39803882f5be05ee8606b2b9812920e196daa2a82997ce14%40%3Cpluto-dev.portals.apache.org%3E - https://lists.apache.org/thread.html/r390783b3b1c59b978131ac08390bf77fbb3863270cbde59d5b0f5fde%40%3Cpluto-dev.portals.apache.org%3E - https://lists.apache.org/thread.html/r3868207b967f926819fe3aa8d33f1666429be589bb4a62104a49f4e3%40%3Cpluto-dev.portals.apache.org%3E - https://lists.apache.org/thread.html/r89aa1b48a827f5641310305214547f1d6b2101971a4
40%3Cpluto-dev.portals.apache.org%3E - https://lists.apache.org/thread.html/r89aa1b48a827f5641310305214547f1d6b2101971a49b624737c497f%40%3Cpluto-dev.portals.apache.org%3E - https://lists.apache.org/thread.html/ra53677224fe4f04c2599abc88032076faa18dc84b329cdeba85d4cfc%40%3Cpluto-scm.portals.apache.org%3E - https://lists.apache.org/thread.html/r08a449010786e0bcffa4b5781b04fcb55d6eafa62cb79b8347680aad%40%3Cissues.nifi.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2021-22122 State: PUBLISHED Published: 2021-02-08T15:55:39 Last Updated: 2024-10-25T14:00:24.537Z Vendors: Fortinet Products: Fortinet FortiWeb Problem Types: Execute unauthorized code or commands Description: An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to perform a reflected cross site scripting attack (XSS) by injecting malicious payload in different vulnerable API end-points. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-122
CVE ID: CVE-2021-22123 State: PUBLISHED Published: 2021-06-01T19:58:35 Last Updated: 2024-10-25T13:58:34.151Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Fortinet Products: Fortinet FortiWeb Problem Types: Execute unauthorized code or commands Description: An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated attacker to execute arbitrary commands on the system via the SAML server configuration page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-20-120
CVE ID: CVE-2021-22124 State: PUBLISHED Published: 2021-08-04T18:18:25 Last Updated: 2024-10-25T13:52:14.952Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiSandbox, FortiAuthenticator Problem Types: Denial of service Description: An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6; and FortiAuthenticator before 6.0.6 may allow an unauthenticated attacker to bring the device into an unresponsive state via specifically-crafted long request parameters. Additional Analyst Notes: - CVE Program Con