Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-1425 State: PUBLISHED Published: 2020-02-18T12:47:55 Last Updated: 2024-08-06T04:40:18.556Z Vendors: n/a Products: n/a Problem Types: n/a Description: JAKWEB Gecko CMS has Multiple Input Validation Vulnerabilities Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72085
CVE ID: CVE-2015-1426 State: PUBLISHED Published: 2015-02-23T17:00:00 Last Updated: 2024-08-06T04:40:18.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node. Additional Analyst Notes: - CVE Program Container: References: - http://puppetlabs.com/security/cve/cve-2015-1426
CVE ID: CVE-2015-1427 State: PUBLISHED Published: 2015-02-17T15:00:00.000Z Last Updated: 2025-10-22T00:05:33.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/archive/1/534689/100/0/threaded - http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html - https://access.redhat.com/errata/RHSA-2017:0868 - http://www.sec
sticSearch-Unauthenticated-Remote-Code-Execution.html - https://access.redhat.com/errata/RHSA-2017:0868 - http://www.securityfocus.com/bid/72585 - http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/ - https://exchange.xforce.ibmcloud.com/vulnerabilities/100850 - http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html - https://www.elastic.co/community/security/
CVE ID: CVE-2015-1428 State: PUBLISHED Published: 2015-02-03T16:00:00 Last Updated: 2024-08-06T04:40:18.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/35972 - http://www.securityfocus.com/archive/1/534593/100/0/threaded - http://www.itas.vn/news/itas-team-found-ou
ploits/35972 - http://www.securityfocus.com/archive/1/534593/100/0/threaded - http://www.itas.vn/news/itas-team-found-out-multiple-sql-injection-vulnerabilities-in-sefrengo-cms-v1-6-1-74.html - https://github.com/sefrengo-cms/sefrengo-1.x/commit/0b1edd4b22a47743eff7cfaf884ba2a4e06e15eb - https://github.com/sefrengo-cms/sefrengo-1.x/commit/22c0d16bfd715631ed317cc990785ccede478f07
CVE ID: CVE-2015-1429 State: PUBLISHED Published: 2017-10-06T22:00:00 Last Updated: 2024-08-06T04:40:18.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit allows remote attackers to download arbitrary files via a .. (dot dot) in an unspecified parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.cybelesoft.com/blog/index.php/cybele-software-inc-security-bulletin-2 - https://www.perspectiverisk.com/security-advisory-thinfinity-remote-desktop-workstation-directory-traversal/
CVE ID: CVE-2015-1430 State: PUBLISHED Published: 2017-08-28T15:00:00 Last Updated: 2024-08-06T04:40:18.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in xymon 4.3.17-1. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/01/31/4
CVE ID: CVE-2015-1431 State: PUBLISHED Published: 2015-02-10T17:00:00 Last Updated: 2024-08-06T04:40:18.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to "Relative Path Overwrite." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phpbb/phpbb/pull/3316 - https://tracker.phpbb.com/browse/PHPBB3-13531 - http://seclists.org/oss-sec/2015/q1/373 - https://wiki.phpbb.com/Release_Highlights/3.0.13 - https://security.gentoo.org/glsa/201701-25 - http://www.securityfocus.com/bid/7240
phpbb.com/Release_Highlights/3.0.13 - https://security.gentoo.org/glsa/201701-25 - http://www.securityfocus.com/bid/72405 - https://exchange.xforce.ibmcloud.com/vulnerabilities/100670 - https://github.com/phpbb/phpbb/commit/eaeb88133f1f028fa06f0ebe5639668436fd469e
CVE ID: CVE-2015-1432 State: PUBLISHED Published: 2015-02-10T17:00:00 Last Updated: 2024-08-06T04:40:18.701Z Vendors: n/a Products: n/a Problem Types: n/a Description: The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2015/q1/373 - https://wiki.phpbb.com/Release_Highlights/3.0.13 - https://security.gentoo.org/glsa/201701-25 - https://exchange.xforce.ibmcloud.com/vulnerabilities/100671 - https://github.com/phpbb/
rity.gentoo.org/glsa/201701-25 - https://exchange.xforce.ibmcloud.com/vulnerabilities/100671 - https://github.com/phpbb/phpbb/commit/23069a13e203985ab124d1139e8de74b12778449 - https://github.com/phpbb/phpbb/pull/3311 - http://www.securityfocus.com/bid/72399 - https://tracker.phpbb.com/browse/PHPBB3-13526
CVE ID: CVE-2015-1433 State: PUBLISHED Published: 2015-02-03T16:00:00 Last Updated: 2024-08-06T04:40:18.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email. Additional Analyst Notes: - CVE Program Container: References: - http://trac.roundcube.net/changeset/786aa0725/github - http://www.securityfocus.com/bid/72401 - http://trac.roundcube.net/ticket/1490227 - http://roundcube.net/news/2015/01/24/security-update-1.0.5/ - http://lists.opensuse.org/opensuse-updates/2015-02/msg
7 - http://roundcube.net/news/2015/01/24/security-update-1.0.5/ - http://lists.opensuse.org/opensuse-updates/2015-02/msg00064.html - http://www.openwall.com/lists/oss-security/2015/01/31/6 - http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149877.html - http://www.openwall.com/lists/oss-security/2015/01/31/3
CVE ID: CVE-2015-1434 State: PUBLISHED Published: 2015-02-16T15:00:00 Last Updated: 2024-08-06T04:40:18.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in my little forum before 2.3.4 allow remote administrators to execute arbitrary SQL commands via the (1) letter parameter in a user action or (2) edit_category parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/534681/100/0/threaded - http://www.securityfocus.com/bid/72575 - http://mylittleforum.net/forum/index.php?id=8182 - http://packetstormsecurity.com/files/130356/My-Little-Forum-2.3.3-Cross-Site-Scripting-S
m.net/forum/index.php?id=8182 - http://packetstormsecurity.com/files/130356/My-Little-Forum-2.3.3-Cross-Site-Scripting-SQL-Injection.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/100855 - https://www.htbridge.com/advisory/HTB23248
CVE ID: CVE-2015-1435 State: PUBLISHED Published: 2015-02-16T15:00:00 Last Updated: 2024-08-06T04:40:18.569Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in my little forum before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the back parameter to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/534681/100/0/threaded - http://www.securityfocus.com/bid/72582 - https://exchange.xforce.ibmcloud.com/vulnerabilities/100856 - http://mylittleforum.net/forum/index.php?id=8182 - http://packetstormsecurity.com/files/130356/My-Little-Forum-2.3.3-Cross-Site-
ylittleforum.net/forum/index.php?id=8182 - http://packetstormsecurity.com/files/130356/My-Little-Forum-2.3.3-Cross-Site-Scripting-SQL-Injection.html - https://www.htbridge.com/advisory/HTB23248
CVE ID: CVE-2015-1436 State: PUBLISHED Published: 2015-02-16T15:00:00 Last Updated: 2024-08-06T04:40:18.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Easing Slider plugin before 2.2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the edit parameter in the (1) easingslider_manage_customizations or (2) easingslider_edit_sliders page to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/100861 - http://packetstormsecurity.com/files/130355/WordPress-Easing-Slider-2.2.0.6-Cross-Site-Scripting.html - https://wo
861 - http://packetstormsecurity.com/files/130355/WordPress-Easing-Slider-2.2.0.6-Cross-Site-Scripting.html - https://wordpress.org/plugins/easing-slider/changelog/ - http://www.securityfocus.com/archive/1/534680/100/0/threaded - http://www.securityfocus.com/bid/72572 - https://www.htbridge.com/advisory/HTB23249
CVE ID: CVE-2015-1437 State: PUBLISHED Published: 2015-02-04T16:00:00 Last Updated: 2024-08-06T04:40:18.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Asus RT-N10+ D1 router with firmware 2.1.1.1.70 allow remote attackers to inject arbitrary web script or HTML via the flag parameter to (1) result_of_get_changed_status.asp or (2) error_page.htm. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/100563 - http://packetstormsecurity.com/files/130187/Asus-RT-N10-Plus-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/534612/100/0/threaded - ht
es/130187/Asus-RT-N10-Plus-Cross-Site-Scripting.html - http://www.securityfocus.com/archive/1/534612/100/0/threaded - https://exchange.xforce.ibmcloud.com/vulnerabilities/100566 - http://www.securityfocus.com/bid/72369 - http://www.securityfocus.com/archive/1/534580/100/0/threaded - http://www.securityfocus.com/archive/1/534579/100/0/threaded
CVE ID: CVE-2015-1438 State: PUBLISHED Published: 2017-07-25T18:00:00 Last Updated: 2024-08-06T04:40:18.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in Panda Security Kernel Memory Access Driver 1.0.0.13 allows attackers to execute arbitrary code with kernel privileges via a crafted size input for allocated kernel paged pool and allocated non-paged pool buffers. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/132682/Panda-Security-1.0.0.13-Arbitrary-Code-Execution.html - http://www.securityfocus.com/bid/75715 - https://www.portcullis-security.com/security-research-and-downloads/security-adviso
://www.securityfocus.com/bid/75715 - https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-1438/ - http://seclists.org/fulldisclosure/2015/Jul/42 - http://seclists.org/fulldisclosure/2015/Jul/61
CVE ID: CVE-2015-1441 State: PUBLISHED Published: 2015-02-03T16:00:00 Last Updated: 2024-08-06T04:40:18.705Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://piwigo.org/releases/2.6.5 - http://secunia.com/advisories/62606 - http://piwigo.org/releases/2.7.3 - http://piwigo.org/forum/viewtopic.php?id=25016 - http://www.securityfocus.com/bid/72400 - http://piwigo.org/releases/2.5.6
CVE ID: CVE-2015-1442 State: PUBLISHED Published: 2015-02-06T15:00:00 Last Updated: 2024-08-06T04:40:18.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in views/zero_transact_user.php in the administrative backend in ZeroCMS 1.3.3, 1.3.2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the user_id parameter in a Modify Account action. NOTE: The article_id parameter to zero_view_article.php vector is already covered by CVE-2014-4034. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130192/ZeroCMS-1.3.3-SQL-Injection.html - http://seclists.org/oss-sec/2015/q1/379
- http://packetstormsecurity.com/files/130192/ZeroCMS-1.3.3-SQL-Injection.html - http://seclists.org/oss-sec/2015/q1/379 - http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-14.html - http://sroesemann.blogspot.de/2015/01/sroeadv-2015-13.html - http://seclists.org/oss-sec/2015/q1/380 - http://seclists.org/fulldisclosure/2015/Feb/4 - http://sroesemann.blogspot.de/2015/02/addition-for-advisory-sroeadv-2015-14.html - http://www.securityfocus.com/bid/72398
CVE ID: CVE-2015-1443 State: PUBLISHED Published: 2017-08-28T15:00:00 Last Updated: 2024-08-06T04:40:18.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: The httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allows remote attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - http://www.fli4l.de/fileadmin/fli4l/security/advisory-FFL-1113.txt - http://www.openwall.com/lists/oss-security/2015/02/01/5 - http://seclists.org/oss-sec/2015/q1/376
CVE ID: CVE-2015-1444 State: PUBLISHED Published: 2015-02-06T15:00:00 Last Updated: 2024-08-06T04:40:18.729Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the web administration frontend in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allow remote attackers to inject arbitrary web script or HTML via the (1) conntrack.cgi, (2) index.cgi, (3) log_syslog.cgi, (4) problems.cgi, (5) status.cgi, (6) status_network.cgi, or (7) status_system.cgi script in admin/. Additional Analyst Notes: - CVE Program Container: References: - http://www.fli4l.de/fileadmin/fli4l/security/advisory-FFL-1113.txt - http://seclists.
E Program Container: References: - http://www.fli4l.de/fileadmin/fli4l/security/advisory-FFL-1113.txt - http://seclists.org/oss-sec/2015/q1/376 - https://exchange.xforce.ibmcloud.com/vulnerabilities/100610 - http://seclists.org/oss-sec/2015/q1/381
CVE ID: CVE-2015-1445 State: PUBLISHED Published: 2017-08-28T15:00:00 Last Updated: 2024-08-06T04:40:18.749Z Vendors: n/a Products: n/a Problem Types: n/a Description: HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30. Additional Analyst Notes: - CVE Program Container: References: - http://www.fli4l.de/fileadmin/fli4l/security/advisory-FFL-1113.txt - http://www.openwall.com/lists/oss-security/2015/02/01/5 - http://seclists.org/oss-sec/2015/q1/376
CVE ID: CVE-2015-1448 State: PUBLISHED Published: 2015-02-02T15:00:00 Last Updated: 2024-08-06T04:40:18.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: The integrated management service on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allows remote attackers to bypass authentication and perform administrative actions via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-753
am Container: References: - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-753139.pdf
CVE ID: CVE-2015-1449 State: PUBLISHED Published: 2015-02-02T15:00:00 Last Updated: 2024-08-06T04:40:18.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the integrated web server on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allows remote attackers to execute arbitrary code via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-753139.pdf
CVE ID: CVE-2015-1450 State: PUBLISHED Published: 2015-02-02T15:00:00Z Last Updated: 2024-09-17T02:10:44.928Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Restaurant Biller allows remote attackers to execute arbitrary SQL commands via the cid parameter in a category action to index.php. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130122/Restaurantbiller-SQL-Injection-Shell-Upload.html
CVE ID: CVE-2015-1451 State: PUBLISHED Published: 2015-02-02T16:00:00 Last Updated: 2024-08-06T04:40:18.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiOS 5.0 Patch 7 build 4457 allow remote authenticated users to inject arbitrary web script or HTML via the (1) WTP Name or (2) WTP Active Software Version field in a CAPWAP Join request. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Jan/125 - http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiOS_Multiple_Vulnerabilities.pdf - http://www.fortiguard.com/advisory/FG-IR-15-002/ - htt
ocuments/advisory/Fortinet_FortiOS_Multiple_Vulnerabilities.pdf - http://www.fortiguard.com/advisory/FG-IR-15-002/ - http://secunia.com/advisories/61661 - http://www.securityfocus.com/bid/72383
CVE ID: CVE-2015-1452 State: PUBLISHED Published: 2015-02-02T16:00:00 Last Updated: 2024-08-06T04:40:18.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Control and Provisioning of Wireless Access Points (CAPWAP) daemon in Fortinet FortiOS 5.0 Patch 7 build 4457 allows remote attackers to cause a denial of service (locked CAPWAP Access Controller) via a large number of ClientHello DTLS messages. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2015/Jan/125 - http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiOS_Multiple_Vulnerabilities.pdf - http://www.fortiguard.com/advisory/FG-IR-15-002/ - http://s
nts/advisory/Fortinet_FortiOS_Multiple_Vulnerabilities.pdf - http://www.fortiguard.com/advisory/FG-IR-15-002/ - http://secunia.com/advisories/61661 - http://www.securityfocus.com/bid/72383
CVE ID: CVE-2015-1453 State: PUBLISHED Published: 2015-02-02T16:00:00 Last Updated: 2024-08-06T04:40:18.736Z Vendors: n/a Products: n/a Problem Types: n/a Description: The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which makes it easier for attackers to obtain passwords and possibly other sensitive data by leveraging the key to decrypt data in the Shared Preferences. Additional Analyst Notes: - CVE Program Container: References: - http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiClient_Multiple_Vulnerabilities.pdf - http://seclists.org/fulldisclosure/2015/Jan/124 - http://www.securityfocus.com/bid/72383
CVE ID: CVE-2015-1454 State: PUBLISHED Published: 2015-02-02T16:00:00Z Last Updated: 2024-09-16T17:14:47.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blue Coat ProxyClient before 3.3.3.3 and 3.4.x before 3.4.4.10 and Unified Agent before 4.1.3.151952 does not properly validate certain certificates, which allows man-in-the-middle attackers to spoof ProxySG Client Managers, and consequently modify configurations and execute arbitrary software updates, via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://bto.bluecoat.com/security-advisory/sa89 - http://secunia.com/advisories/62617
CVE ID: CVE-2015-1455 State: PUBLISHED Published: 2015-02-03T16:00:00 Last Updated: 2024-08-06T04:40:18.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fortinet FortiAuthenticator 3.0.0 has a password of (1) slony for the slony PostgreSQL user and (2) www-data for the www-data PostgreSQL user, which makes it easier for remote attackers to obtain access via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130156/Fortinet-FortiAuthenticator-XSS-Disclosure-Bypass.html - http://www.securityfocus.com/bid/72378 - http://www.fortiguard.com/advisory/FG-IR-15-003/ - http://www.security-assessment.com/files/docum
yfocus.com/bid/72378 - http://www.fortiguard.com/advisory/FG-IR-15-003/ - http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiAuthenticator_Multiple_Vulnerabilities.pdf
CVE ID: CVE-2015-1456 State: PUBLISHED Published: 2015-02-03T16:00:00 Last Updated: 2024-08-06T04:40:18.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fortinet FortiAuthenticator 3.0.0 logs the PostgreSQL usernames and passwords in cleartext, which allows remote administrators to obtain sensitive information by reading the log at debug/startup/. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130156/Fortinet-FortiAuthenticator-XSS-Disclosure-Bypass.html - http://www.securityfocus.com/bid/72378 - http://www.fortiguard.com/advisory/FG-IR-15-003/ - http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiAut
ww.fortiguard.com/advisory/FG-IR-15-003/ - http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiAuthenticator_Multiple_Vulnerabilities.pdf
CVE ID: CVE-2015-1457 State: PUBLISHED Published: 2015-02-03T16:00:00 Last Updated: 2024-08-06T04:40:18.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fortinet FortiAuthenticator 3.0.0 allows local users to read arbitrary files via the -f flag to the dig command. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130156/Fortinet-FortiAuthenticator-XSS-Disclosure-Bypass.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/100560 - http://www.securityfocus.com/bid/72378 - http://www.fortiguard.com/advisory/FG-IR-15-003/ - http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiAuthenticator_Multiple_Vu
sory/FG-IR-15-003/ - http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiAuthenticator_Multiple_Vulnerabilities.pdf
CVE ID: CVE-2015-1458 State: PUBLISHED Published: 2015-02-03T16:00:00 Last Updated: 2024-08-06T04:40:18.617Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fortinet FortiAuthenticator 3.0.0 allows local users to bypass intended restrictions and gain privileges by creating /tmp/privexec/dbgcore_enable_shell_access and executing the "shell" command. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130156/Fortinet-FortiAuthenticator-XSS-Disclosure-Bypass.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/100559 - http://www.securityfocus.com/bid/72378 - http://www.security-assessment.com/files/documents/advisory/Fortinet_
/100559 - http://www.securityfocus.com/bid/72378 - http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiAuthenticator_Multiple_Vulnerabilities.pdf