Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-39896 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:36:50.165Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-284 Description: Improper access control vulnerabilities in Contacts prior to SMR Dec-2022 Release 1 allows to access sensitive information via implicit intent. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE ID: CVE-2022-39897 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:36:26.061Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-200 Description: Exposure of Sensitive Information vulnerability in kernel prior to SMR Dec-2022 Release 1 allows attackers to access the kernel address information via log. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE ID: CVE-2022-39898 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:35:28.251Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-284 Description: Improper access control vulnerability in IIccPhoneBook prior to SMR Dec-2022 Release 1 allows attackers to access some information of usim. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE ID: CVE-2022-39899 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:34:34.771Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-287 Description: Improper authentication vulnerability in Samsung WindowManagerService prior to SMR Dec-2022 Release 1 allows attacker to send the input event using S Pen gesture. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE ID: CVE-2022-39900 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:34:01.737Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-284 Description: Improper access control vulnerability in Nice Catch prior to SMR Dec-2022 Release 1 allows physical attackers to access contents of all toast generated in the application installed in Secure Folder through Nice Catch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE ID: CVE-2022-39901 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:33:01.441Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-287 Description: Improper authentication in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to disable the network traffic encryption between UE and gNodeB. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE ID: CVE-2022-39902 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-22T19:50:23.884Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-285 Description: Improper authorization in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to get sensitive information including IMEI via emergency call. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE ID: CVE-2022-39903 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-22T18:41:08.229Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-200 Description: Improper access control vulnerability in RCS call prior to SMR Dec-2022 Release 1 allows local attackers to access RCS incoming call number. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE ID: CVE-2022-39904 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:32:21.769Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-200 Description: Exposure of Sensitive Information vulnerability in Samsung Settings prior to SMR Dec-2022 Release 1 allows local attackers to access the Network Access Identifier via log. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE ID: CVE-2022-39905 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:30:09.017Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-285 Description: Implicit intent hijacking vulnerability in Telecom application prior to SMR Dec-2022 Release 1 allows attacker to access sensitive information via implicit intent. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE ID: CVE-2022-39906 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:11:58.731Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-284 Description: Improper access control vulnerability in SecTelephonyProvider prior to SMR Dec-2022 Release 1 allows attackers to access message information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE ID: CVE-2022-39907 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:11:31.779Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-190 Description: Integer overflow vulnerability in Samsung decoding library for video thumbnails prior to SMR Dec-2022 Release 1 allows local attacker to perform Out-Of-Bounds Write. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE ID: CVE-2022-39908 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-22T18:16:35.131Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-367 Description: TOCTOU vulnerability in Samsung decoding library for video thumbnails prior to SMR Dec-2022 Release 1 allows local attacker to perform Out-Of-Bounds Write. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=12
CVE ID: CVE-2022-39909 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:25:10.131Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Samsung Mobile Products: Samsung Gear IconX PC Manager Problem Types: CWE-345 Description: Insufficient verification of data authenticity vulnerability in Samsung Gear IconX PC Manager prior to version 2.1.221019.51 allows local attackers to create arbitrary file using symbolic link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12
CVE ID: CVE-2022-39910 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:24:49.634Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Pass Problem Types: CWE-284 Description: Improper access control vulnerability in Samsung Pass prior to version 4.0.06.7 allow physical attackers to access data of Samsung Pass on a certain state of an unlocked device using pop-up view. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12
CVE ID: CVE-2022-39911 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:24:29.184Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Pass Problem Types: CWE-703 Description: Improper check or handling of exceptional conditions vulnerability in Samsung Pass prior to version 4.0.06.1 allows attacker to access Samsung Pass. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12
CVE ID: CVE-2022-39912 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:24:03.123Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-280 Description: Improper handling of insufficient permissions vulnerability in setSecureFolderPolicy in PersonaManagerService prior to Android T(13) allows local attackers to set some setting value in Secure folder. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12
CVE ID: CVE-2022-39913 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:23:47.804Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor in Persona Manager prior to Android T(13) allows local attacker to access user profiles information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12
CVE ID: CVE-2022-39914 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:23:32.710Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-200 Description: Exposure of Sensitive Information from an Unauthorized Actor vulnerability in Samsung DisplayManagerService prior to Android T(13) allows local attacker to access connected DLNA device information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12
CVE ID: CVE-2022-39915 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-23T15:19:38.383Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Calendar Problem Types: CWE-284 Description: Improper access control vulnerability in Calendar prior to versions 11.6.08.0 in Android Q(10), 12.2.11.3000 in Android R(11), 12.3.07.2000 in Android S(12), and 12.4.02.0 in Android T(13) allows attackers to access sensitive information via implicit intent. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.samsungmobile.com/serviceWeb.smsb?year=2022&month=12
CVE ID: CVE-2022-39916 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39917 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39918 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39919 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39920 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39921 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39922 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39923 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39924 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39925 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39926 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39927 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39928 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39929 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39930 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39931 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39932 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39933 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39934 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39935 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39936 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39937 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39938 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39939 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39940 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39941 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39942 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39943 State: REJECTED Published: N/A Last Updated: 2022-12-15T00:00:00 Description: No description available.
CVE ID: CVE-2022-39944 State: PUBLISHED Published: 2022-10-26T00:00:00.000Z Last Updated: 2025-05-07T18:33:27.944Z Vendors: Apache Software Foundation Products: Apache Linkis Problem Types: Remote code execution vulnerability Description: In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures a JDBC EC with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis <= 1.2.0 will be affected, We recommend users to update to 1.3.0. Additional Analyst Notes: - CVE Pro
s of Apache Linkis <= 1.2.0 will be affected, We recommend users to update to 1.3.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/rxytj48q17304snonjtyt5lnlw64gccc
CVE ID: CVE-2022-39945 State: PUBLISHED Published: 2022-11-02T00:00:00 Last Updated: 2024-10-22T20:52:37.091Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiMail Problem Types: Improper access control Description: An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references (IDOR). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://
ct references (IDOR). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-066
CVE ID: CVE-2022-39946 State: PUBLISHED Published: 2023-06-13T08:41:41.234Z Last Updated: 2024-10-22T20:46:16.560Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiNAC Problem Types: CWE-284 Description: An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8.6 all versions, 8.5 all versions may allow a remote attacker authenticated on the administrative interface to perform unauthorized jsp calls via crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://f
afted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-332
CVE ID: CVE-2022-39947 State: PUBLISHED Published: 2023-01-03T16:58:37.035Z Last Updated: 2024-10-23T14:50:58.743Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C) Vendors: Fortinet Products: FortiADC Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.2, FortiADC version 6.2.0 through 6.2.3, FortiADC version version 6.1.0 through 6.1.6, FortiADC version 6.0.0 through 6.0.4, FortiADC version 5.4.0 through 5.4.5 may allow an attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Additional Analyst Note
low an attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-061
CVE ID: CVE-2022-39948 State: PUBLISHED Published: 2023-02-16T18:06:29.870Z Last Updated: 2024-10-22T20:49:38.976Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:U/RC:R) Vendors: Fortinet Products: FortiProxy, FortiOS Problem Types: CWE-295 Description: An improper certificate validation vulnerability [CWE-295] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all versions and FortiProxy 7.0.0 through 7.0.6, 2.0 all versions, 1.2 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the FortiOS/FortiProxy device and remote servers hostin
a Man-in-the-Middle attack on the communication channel between the FortiOS/FortiProxy device and remote servers hosting threat feeds (when the latter are configured as Fabric connectors in FortiOS/FortiProxy) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-257
CVE ID: CVE-2022-39949 State: PUBLISHED Published: 2022-11-02T00:00:00 Last Updated: 2024-10-22T20:52:28.614Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:R) Vendors: Fortinet Products: Fortinet FortiEDR Problem Types: Execute unauthorized code or commands Description: An improper control of a resource through its lifetime vulnerability [CWE-664] in FortiEDR CollectorWindows 4.0.0 through 4.1, 5.0.0 through 5.0.3.751, 5.1.0 may allow a privileged user to terminate the FortiEDR processes with special tools and bypass the EDR protection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-218
CVE ID: CVE-2022-39950 State: PUBLISHED Published: 2022-11-02T00:00:00 Last Updated: 2024-10-25T13:17:01.104Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiAnalyzer, FortiManager Problem Types: Execute unauthorized code or commands Description: An improper neutralization of input during web page generation vulnerability [CWE-79] exists in FortiManager and FortiAnalyzer 6.0.0 all versions, 6.2.0 all versions, 6.4.0 through 6.4.8, and 7.0.0 through 7.0.4. Report templates may allow a low privilege level attacker to perform an XSS attack via posting a crafted CKeditor "protected" comment as described in CVE-2020-9281
level attacker to perform an XSS attack via posting a crafted CKeditor "protected" comment as described in CVE-2020-9281. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-228
CVE ID: CVE-2022-39951 State: PUBLISHED Published: 2023-03-07T16:04:38.353Z Last Updated: 2024-10-23T14:31:46.031Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-I
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-254
CVE ID: CVE-2022-39952 State: PUBLISHED Published: 2023-02-16T18:06:55.108Z Last Updated: 2024-10-23T14:32:41.984Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C) Vendors: Fortinet Products: FortiNAC Problem Types: CWE-73 Description: A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
y crafted HTTP request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-300