Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-42748 State: PUBLISHED Published: 2023-12-04T00:54:24.502Z Last Updated: 2024-08-02T19:30:23.917Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Description: In telecom service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed Additional Analyst Notes: - CVE Program Container: References: - https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1731138365803266049
CVE ID: CVE-2023-42749 State: PUBLISHED Published: 2023-12-04T00:54:24.762Z Last Updated: 2024-08-28T19:33:57.703Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Description: In enginnermode service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/173113836580326604
s://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1731138365803266049
CVE ID: CVE-2023-42750 State: PUBLISHED Published: 2023-11-01T09:08:15.420Z Last Updated: 2024-09-05T19:41:37.346Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Description: In gnss service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1719615756246777857
CVE ID: CVE-2023-42751 State: PUBLISHED Published: 2023-12-04T00:54:19.160Z Last Updated: 2024-10-11T17:54:36.484Z Vendors: Unisoc (Shanghai) Technologies Co., Ltd. Products: SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 Description: In gnss service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1731138365803266049
CVE ID: CVE-2023-42752 State: PUBLISHED Published: 2023-10-13T01:41:49.818Z Last Updated: 2024-08-02T19:30:24.025Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: Kernel, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora Problem Types: CWE-190 Description: An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating `skb_shared_info` in the userspace, which is exploitable in systems without SMAP protection since `skb_shared_info` contains references to function pointers. Additional Analyst Notes: - CVE Program Container: Re
since `skb_shared_info` contains references to function pointers. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html - https://access.redhat.com/security/cve/CVE-2023-42752 - https://bugzilla.redhat.com/show_bug.cgi?id=2239828 - https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=915d975b2ffa - https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=c3b704d4a4a2
CVE ID: CVE-2023-42753 State: PUBLISHED Published: 2023-09-25T20:25:59.706Z Last Updated: 2025-11-06T21:02:00.466Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 7.7 Advanced Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
t Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6 Problem Types: CWE-787 Description: An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbi
ssing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:7370 - https://access.redhat.com/errata/RHSA-2023:7379 - https://access.redhat.com/errata/RHSA-2023:7382 - https://access.redhat.com/errata/RHSA-2023:7389 - https://access.redhat.com/errata/RHSA-2023:7411 - https://access.redhat.com/errata/RHSA-2023:7418 - https://access.redhat.
tps://access.redhat.com/errata/RHSA-2023:7411 - https://access.redhat.com/errata/RHSA-2023:7418 - https://access.redhat.com/errata/RHSA-2023:7539 - https://access.redhat.com/errata/RHSA-2023:7558 - https://access.redhat.com/errata/RHSA-2024:0089 - https://access.redhat.com/errata/RHSA-2024:0113 - https://access.redhat.com/errata/RHSA-2024:0134 - https://access.redhat.com/errata/RHSA-2024:0340 - https://access.redhat.com/errata/RHSA-2024:0346 - https://access.redhat.com/errata/RHSA-2024:0347 - https://access.redhat.com/errata/RHSA-2024:0371 - https://access.redhat.com/errata/RHSA-2024:0376 - https://access.redhat.com/errata/RHSA-2024:0378 - https://access.redhat.com/errata/RHSA-2024:0402 - ht
/RHSA-2024:0376 - https://access.redhat.com/errata/RHSA-2024:0378 - https://access.redhat.com/errata/RHSA-2024:0402 - https://access.redhat.com/errata/RHSA-2024:0403 - https://access.redhat.com/errata/RHSA-2024:0412 - https://access.redhat.com/errata/RHSA-2024:0461 - https://access.redhat.com/errata/RHSA-2024:0562 - https://access.redhat.com/errata/RHSA-2024:0563 - https://access.redhat.com/errata/RHSA-2024:0593 - https://access.redhat.com/errata/RHSA-2024:0999 - https://access.redhat.com/security/cve/CVE-2023-42753 - https://bugzilla.redhat.com/show_bug.cgi?id=2239843 - https://seclists.org/oss-sec/2023/q3/216
CVE ID: CVE-2023-42754 State: PUBLISHED Published: 2023-10-05T18:25:22.372Z Last Updated: 2025-11-06T19:47:52.634Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-476 Description: A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash the system. Additional An
is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash the system. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2024:2394 - https://access.redhat.com/errata/RHSA-2024:2950 - https://access.redhat.com/errata/RHSA-2024:3138 - https://access.redhat.com/security/cve/CVE-2023-42754 - https://bugzilla.redhat.com/show_bug.cgi?id=2239845 - https://seclists.org/oss-sec/2023/q4/14
CVE ID: CVE-2023-42755 State: PUBLISHED Published: 2023-10-05T18:25:23.117Z Last Updated: 2025-11-08T07:10:59.010Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 9 Problem Types: CWE-125 Description: A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service. Additional Analyst Notes: - CV
ion. This issue may allow a local user to crash the system and cause a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:2950 - https://access.redhat.com/errata/RHSA-2024:3138 - https://access.redhat.com/security/cve/CVE-2023-42755 - https://bugzilla.redhat.com/show_bug.cgi?id=2239847 - https://seclists.org/oss-sec/2023/q3/229
CVE ID: CVE-2023-42756 State: PUBLISHED Published: 2023-09-28T13:55:37.430Z Last Updated: 2025-11-06T19:47:59.667Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Problem Types: CWE-362 Description: A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local user to crash the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
may allow a local user to crash the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2024:2394 - https://access.redhat.com/security/cve/CVE-2023-42756 - https://bugzilla.redhat.com/show_bug.cgi?id=2239848 - https://seclists.org/oss-sec/2023/q3/242
CVE ID: CVE-2023-42757 State: PUBLISHED Published: 2024-05-07T00:00:00.000Z Last Updated: 2025-03-26T20:47:52.918Z Vendors: n/a Products: n/a Problem Types: n/a Description: Process Explorer before 17.04 allows attackers to make it functionally unavailable (a denial of service for analysis) by renaming an executable file to a new extensionless 255-character name and launching it with NtCreateUserProcess. This can occur through an issue in wcscat_s error handling. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.safebreach.com/blog/magicdot-a-hackers-magic-show-of-disappearing-dots-and-spaces/ - https://github.com/SafeBreach-Labs/MagicDot -
.com/blog/magicdot-a-hackers-magic-show-of-disappearing-dots-and-spaces/ - https://github.com/SafeBreach-Labs/MagicDot - https://www.blackhat.com/asia-24/briefings/schedule/#magicdot-a-hackers-magic-show-of-disappearing-dots-and-spaces-36561
CVE ID: CVE-2023-42765 State: PUBLISHED Published: 2024-02-06T21:34:09.540Z Last Updated: 2024-08-02T19:30:24.199Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Westermo Products: Lynx Problem Types: CWE-79 Description: An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username" parameter in the SNMP configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-023-04
CVE ID: CVE-2023-42766 State: PUBLISHED Published: 2024-01-19T20:03:09.700Z Last Updated: 2025-06-17T21:19:23.684Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel NUC 8 Compute Element BIOS firmware Problem Types: escalation of privilege, CWE-20 Description: Improper input validation in some Intel NUC 8 Compute Element BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01028.html
CVE ID: CVE-2023-42768 State: PUBLISHED Published: 2023-10-10T12:34:06.101Z Last Updated: 2024-09-19T13:36:25.727Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: F5 Products: BIG-IP Problem Types: CWE-613 Description: When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
hed End of Technical Support (EoTS) are not evaluated. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K26910459
CVE ID: CVE-2023-42769 State: PUBLISHED Published: 2023-10-26T16:15:17.707Z Last Updated: 2025-01-16T21:28:22.775Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sielco, Sielco Products: Analog FM transmitter, Radio Link Problem Types: CWE-284 Description: The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session, bypass authentication, and manipulate the transmitter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-08 - https://www.sielco.org/en/contacts
CVE ID: CVE-2023-42770 State: PUBLISHED Published: 2023-11-21T00:14:18.734Z Last Updated: 2025-06-11T14:03:28.764Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Red Lion Controls Products: ST-IPm-8460, ST-IPm-6350, VT-mIPm-135-D, VT-mIPm-245-D, VT-IPm2m-213-D, VT-IPm2m-113-D Problem Types: CWE-288 Description: Red Lion SixTRAK and VersaTRAK Series RTUs with authenticated users enabled (UDR-A) any Sixnet UDR message will meet an authentication challenge over UDP/IP. When the same message is received over TCP/IP the RTU will simply accept the message with no authentication challenge. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
the message with no authentication challenge. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-320-01 - https://https://support.redlion.net/hc/en-us/articles/19339209248269-RLCSIM-2023-05-Authentication-Bypass-and-Remote-Code-Execution
CVE ID: CVE-2023-42771 State: PUBLISHED Published: 2023-10-03T00:17:00.358Z Last Updated: 2024-09-20T13:36:28.745Z Vendors: FURUNO SYSTEMS Co.,Ltd. Products: ACERA 1320, ACERA 1310 Problem Types: Authentication bypass Description: Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adjacent unauthenticated attacker who can access the affected product to download configuration files and/or log files, and upload configuration files and/or firmware. They are affected when running in ST(Standalone) mode. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www
(Standalone) mode. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.furunosystems.co.jp/news/info/vulner20231002.html - https://jvn.jp/en/vu/JVNVU94497038/
CVE ID: CVE-2023-42772 State: PUBLISHED Published: 2024-09-16T16:38:42.667Z Last Updated: 2025-11-03T21:49:35.298Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: UEFI firmware for some Intel(R) reference processors Problem Types: escalation of privilege, CWE-822 Description: Untrusted pointer dereference in UEFI firmware for some Intel(R) reference processors may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01071.html
CVE ID: CVE-2023-42773 State: PUBLISHED Published: 2024-05-16T20:47:20.527Z Last Updated: 2024-08-02T19:30:24.492Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Power Gadget software for Windows Problem Types: escalation of privilege, CWE-707 Description: Improper neutralization in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01037.html
CVE ID: CVE-2023-42774 State: PUBLISHED Published: 2023-11-20T11:46:35.478Z Last Updated: 2024-08-28T19:45:07.592Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-276 Description: in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information through incorrect default permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md
CVE ID: CVE-2023-42775 State: REJECTED Published: N/A Last Updated: 2025-02-13T17:09:40.005Z Description: No description available.
CVE ID: CVE-2023-42776 State: PUBLISHED Published: 2024-02-14T13:38:20.289Z Last Updated: 2024-08-15T14:43:13.205Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: n/a Products: Intel(R) SGX DCAP software for Windows Problem Types: information disclosure, CWE-20 Description: Improper input validation in some Intel(R) SGX DCAP software for Windows before version 1.19.100.3 may allow an authenticateed user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01014.html
CVE ID: CVE-2023-42780 State: PUBLISHED Published: 2023-10-14T09:46:09.845Z Last Updated: 2024-09-17T15:31:24.756Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-200 Description: Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dag_ids and the stack-traces of import errors for those DAGs with import errors. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability. Additional Analyst Notes: - CVE Program Container: - C
or newer to mitigate the risk associated with this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/34355 - https://lists.apache.org/thread/h5tvsvov8j55wojt5sojdprs05oby34d
CVE ID: CVE-2023-42781 State: PUBLISHED Published: 2023-11-12T13:14:09.700Z Last Updated: 2025-02-13T17:09:41.138Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-200 Description: Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome. Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
ted with this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/34939 - https://lists.apache.org/thread/7dnl8nszdxqyns57f3dw0sloy5dfl9o1 - http://www.openwall.com/lists/oss-security/2023/11/12/2
CVE ID: CVE-2023-42782 State: PUBLISHED Published: 2023-10-10T16:50:26.310Z Last Updated: 2024-09-18T20:50:44.592Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiAnalyzer Problem Types: CWE-345 Description: A insufficient verification of data authenticity vulnerability [CWE-345] in FortiAnalyzer version 7.4.0 and below 7.2.3 allows a remote unauthenticated attacker to send messages to the syslog server of FortiAnalyzer via the knoweldge of an authorized device serial number. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-221
CVE ID: CVE-2023-42783 State: PUBLISHED Published: 2023-11-14T18:04:50.699Z Last Updated: 2024-08-30T18:27:39.061Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiWLM Problem Types: CWE-23 Description: A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.2 through 8.4.0 and 8.3.2 through 8.3.0 and 8.2.2 allows attacker to read arbitrary files via crafted http requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-143
CVE ID: CVE-2023-42784 State: PUBLISHED Published: 2025-03-11T14:54:28.924Z Last Updated: 2025-03-11T16:10:57.143Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-228 Description: An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-115
CVE ID: CVE-2023-42785 State: PUBLISHED Published: 2025-01-14T14:08:47.926Z Last Updated: 2025-01-14T20:56:29.240Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiOS Problem Types: CWE-476 Description: A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all versions allows attacker to trigger a denial of service via a crafted http request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-293
CVE ID: CVE-2023-42786 State: PUBLISHED Published: 2025-01-14T14:08:51.276Z Last Updated: 2025-01-14T20:56:06.441Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:F/RL:X/RC:C) Vendors: Fortinet Products: FortiOS Problem Types: CWE-476 Description: A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all versions allows attacker to trigger a denial of service via a crafted http request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.fortinet.com/psirt/FG-IR-23-293