Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-26082 State: PUBLISHED Published: 2022-05-25T20:15:25.161Z Last Updated: 2025-04-15T19:00:59.868Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Open Automation Software Products: OAS Platform Problem Types: CWE-306 Description: A file write vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1493
CVE ID: CVE-2022-26083 State: PUBLISHED Published: 2025-02-14T20:41:27.084Z Last Updated: 2025-02-18T16:29:02.579Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: n/a Products: Intel(R) IPP Cryptography software library Problem Types: Information Disclosure, CWE-1204 Description: Generation of weak initialization vector in an Intel(R) IPP Cryptography software library before version 2021.5 may allow an unauthenticated user to potentially enable information disclosure via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00667.html
CVE ID: CVE-2022-26084 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:19:15.797Z Description: No description available.
CVE ID: CVE-2022-26085 State: PUBLISHED Published: 2022-05-12T17:01:45.298Z Last Updated: 2025-04-15T19:02:29.420Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: InHand Networks Products: InRouter302 Problem Types: CWE-77 Description: An OS command injection vulnerability exists in the httpd wlscan_ASP functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.inhandnetworks.com/upload/attachment/202205/10/I
E Program Container: - CISA ADP Vulnrichment: References: - https://www.inhandnetworks.com/upload/attachment/202205/10/InHand-PSA-2022-01.pdf - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1473
CVE ID: CVE-2022-26086 State: PUBLISHED Published: 2022-11-11T15:48:40.264Z Last Updated: 2025-02-05T20:53:04.543Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: PresentMon software maintained by Intel(R) Problem Types: escalation of privilege Description: Uncontrolled search path element in the PresentMon software maintained by Intel(R) before version 1.7.1 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00711.html
CVE ID: CVE-2022-26087 State: REJECTED Published: N/A Last Updated: 2023-03-07T22:25:51.419Z Description: No description available.
CVE ID: CVE-2022-26088 State: PUBLISHED Published: 2022-11-10T00:00:00.000Z Last Updated: 2025-05-01T13:52:05.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in BMC Remedy before 22.1. Email-based Incident Forwarding allows remote authenticated users to inject HTML (such as an SSRF payload) into the Activity Log by placing it in the To: field. This affects rendering that occurs upon a click in the "number of recipients" field. NOTE: the vendor's position is that "no real impact is demonstrated." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec-consult.com/vulnerability-lab/advisory/html-injection-in-
Container: - CISA ADP Vulnrichment: References: - https://sec-consult.com/vulnerability-lab/advisory/html-injection-in-bmc-remedy-itsm-suite/ - http://seclists.org/fulldisclosure/2022/Nov/10 - http://packetstormsecurity.com/files/169863/BMC-Remedy-ITSM-Suite-9.1.10-20.02-HTML-Injection.html
CVE ID: CVE-2022-26090 State: PUBLISHED Published: 2022-04-11T19:37:00 Last Updated: 2024-08-03T04:56:37.308Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Samsung Mobile Products: SamsungContacts Problem Types: CWE-815 Description: Improper access control vulnerability in SamsungContacts prior to SMR Apr-2022 Release 1 allows that attackers can access contact information without permission. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-26091 State: PUBLISHED Published: 2022-04-11T19:37:01 Last Updated: 2024-08-03T04:56:37.781Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-284 Description: Improper access control vulnerability in Knox Manage prior to SMR Apr-2022 Release 1 allows that physical attackers can bypass Knox Manage using a function key of hardware keyboard. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-26092 State: PUBLISHED Published: 2022-04-11T19:37:02 Last Updated: 2024-08-03T04:56:37.406Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-122 Description: Improper boundary check in Quram Agif library prior to SMR Apr-2022 Release 1 allows arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-26093 State: PUBLISHED Published: 2022-04-11T19:37:03 Last Updated: 2024-08-03T04:56:37.437Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-476 Description: Null pointer dereference vulnerability in parser_irot function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-26094 State: PUBLISHED Published: 2022-04-11T19:37:04 Last Updated: 2024-08-03T04:56:37.369Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-476 Description: Null pointer dereference vulnerability in parser_auxC function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-26095 State: PUBLISHED Published: 2022-04-11T19:37:05 Last Updated: 2024-08-03T04:56:37.571Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-476 Description: Null pointer dereference vulnerability in parser_colr function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-26096 State: PUBLISHED Published: 2022-04-11T19:37:06 Last Updated: 2024-08-03T04:56:37.495Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-476 Description: Null pointer dereference vulnerability in parser_ispe function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-26097 State: PUBLISHED Published: 2022-04-11T19:37:07 Last Updated: 2024-08-03T04:56:37.487Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-476 Description: Null pointer dereference vulnerability in parser_unknown_property function in libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attacker. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-26098 State: PUBLISHED Published: 2022-04-11T19:37:07 Last Updated: 2024-08-03T04:56:37.653Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-122 Description: Heap-based buffer overflow vulnerability in sheifd_create function of libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attackers. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-26099 State: PUBLISHED Published: 2022-04-11T19:37:08 Last Updated: 2024-08-03T04:56:37.504Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Samsung Mobile Products: Samsung Mobile Devices Problem Types: CWE-476 Description: Null pointer dereference vulnerability in parser_infe function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds read by remote attackers. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=4
CVE ID: CVE-2022-26100 State: PUBLISHED Published: 2022-03-08T13:35:56 Last Updated: 2024-08-03T04:56:37.455Z Vendors: SAP SE Products: SAPCAR Problem Types: CWE-129 Description: SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive. As a result, the SAPCAR process may crash, and the attacker may obtain privileged access to the system. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3111110 - https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10
CVE ID: CVE-2022-26101 State: PUBLISHED Published: 2022-03-08T13:36:17 Last Updated: 2024-08-03T04:56:37.411Z Vendors: SAP SE Products: Fiori Launchpad Problem Types: CWE-79 Description: Fiori launchpad - versions 754, 755, 756, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10 - https://launchpad.support.sap.com/#/notes/3149805 - http://seclists.org/fulldisclosure/2022/Jun/39 - http://packetstormsecurity.com/files/167561/SAP-Fiori-Launchpad-Cross-Site-Scripting.html
CVE ID: CVE-2022-26102 State: PUBLISHED Published: 2022-03-08T13:35:51 Last Updated: 2024-08-03T04:56:37.601Z Vendors: SAP SE Products: SAP NetWeaver Application Server for ABAP Problem Types: CWE-862 Description: Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an authenticated attacker, to access content on the start screen of any transaction that is available with in the same SAP system even if he/she isn't authorized for that transaction. A successful exploitation could expose information and in worst case manipulate data before the start screen is executed, resulting in limited impact on confidentiality and integrity of
se manipulate data before the start screen is executed, resulting in limited impact on confidentiality and integrity of the application. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3145997 - https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10
CVE ID: CVE-2022-26103 State: PUBLISHED Published: 2022-03-08T13:36:23 Last Updated: 2024-08-03T04:56:37.425Z Vendors: SAP SE Products: SAP NetWeaver (Real Time Messaging Framework) Problem Types: CWE-862 Description: Under certain conditions, SAP NetWeaver (Real Time Messaging Framework) - version 7.50, allows an attacker to access information which could lead to information gathering for further exploits and attacks. Additional Analyst Notes: - CVE Program Container: References: - https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10 - https://launchpad.support.sap.com/#/notes/3132360
CVE ID: CVE-2022-26104 State: PUBLISHED Published: 2022-03-08T13:36:29 Last Updated: 2024-08-03T04:56:37.495Z Vendors: SAP SE Products: SAP Financial Consolidation Problem Types: CWE:862 Description: SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messages, resulting for an unauthorized user to alter the maintenance system message. Additional Analyst Notes: - CVE Program Container: References: - https://dam.sap.com/mac/embed/public/pdf/a/ucQrx6G.htm?rc=10 - https://launchpad.support.sap.com/#/notes/3144941
CVE ID: CVE-2022-26105 State: PUBLISHED Published: 2022-04-12T16:11:22 Last Updated: 2024-08-03T04:56:37.332Z Vendors: SAP SE Products: SAP NetWeaver Enterprise Portal Problem Types: CWE-79 Description: SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs while interacting on the Network. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865
pplication. Additional Analyst Notes: - CVE Program Container: References: - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - https://launchpad.support.sap.com/#/notes/3163583
CVE ID: CVE-2022-26106 State: PUBLISHED Published: 2022-04-12T16:11:23 Last Updated: 2024-08-03T04:56:37.602Z Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: CWE-20 Description: When a user opens a manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3143437 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2022-26107 State: PUBLISHED Published: 2022-04-12T16:11:19 Last Updated: 2024-08-03T04:56:37.673Z Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: CWE-20 Description: When a user opens a manipulated Jupiter Tesselation (.jt, JTReader.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3143437 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2022-26108 State: PUBLISHED Published: 2022-04-12T16:11:22 Last Updated: 2024-08-03T04:56:37.516Z Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: CWE-20 Description: When a user opens a manipulated Picture Exchange (.pcx, 2d.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3143437 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2022-26109 State: PUBLISHED Published: 2022-04-12T16:11:21 Last Updated: 2024-08-03T04:56:37.502Z Vendors: SAP SE Products: SAP 3D Visual Enterprise Viewer Problem Types: CWE-20 Description: When a user opens a manipulated Portable Document Format (.pdf, PDFView.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the application crashes and becomes temporarily unavailable to the user until restart of the application. Additional Analyst Notes: - CVE Program Container: References: - https://launchpad.support.sap.com/#/notes/3143437 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2022-26110 State: PUBLISHED Published: 2022-04-06T01:07:11 Last Updated: 2024-08-03T04:56:37.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in HTCondor 8.8.x before 8.8.16, 9.0.x before 9.0.10, and 9.1.x before 9.6.0. When a user authenticates to an HTCondor daemon via the CLAIMTOBE method, the user can then impersonate any entity when issuing additional commands to that daemon. Additional Analyst Notes: - CVE Program Container: References: - https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2022-0003/ - https://lists.debian.org/debian-lts-announce/2022/04/msg00016.html - https://www.debian.org/security/2022/dsa-5144
CVE ID: CVE-2022-26111 State: PUBLISHED Published: 2022-04-25T14:38:12 Last Updated: 2024-08-03T04:56:37.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: The BeanShell components of IRISNext through 9.8.28 allow execution of arbitrary commands on the target server by creating a custom search (or editing an existing/predefined search) of the documents. The search components permit adding BeanShell expressions that result in Remote Code Execution in the context of the IRISNext application user, running on the web server. Additional Analyst Notes: - CVE Program Container: References: - https://varsnext.iriscorporate.com/ - https://github.com/post-cyberlabs/CVE-Advisory/blob/main/
Container: References: - https://varsnext.iriscorporate.com/ - https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2022-26111.pdf
CVE ID: CVE-2022-26112 State: PUBLISHED Published: 2022-09-23T08:05:13.000Z Last Updated: 2025-05-27T14:46:56.726Z Vendors: Apache Software Foundation Products: Apache Pinot Problem Types: Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support Description: In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0 Additional Analyst Notes: -
default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h
CVE ID: CVE-2022-26113 State: PUBLISHED Published: 2022-07-18T16:36:04 Last Updated: 2024-10-22T20:56:16.857Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:F/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiClientWindows Problem Types: Execute unauthorized code or commands Description: An execution with unnecessary privileges vulnerability [CWE-250] in FortiClientWindows 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.10 may allow a local attacker to perform an arbitrary file write on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-044
CVE ID: CVE-2022-26114 State: PUBLISHED Published: 2022-09-06T15:15:12 Last Updated: 2024-10-22T20:54:19.134Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:P/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiMail Problem Types: Execute unauthorized code or commands Description: An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated attacker to trigger a cross-site scripting (XSS) attack via sending specially crafted mail messages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-045
CVE ID: CVE-2022-26115 State: PUBLISHED Published: 2023-02-16T18:07:32.040Z Last Updated: 2024-10-22T20:49:13.825Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:X/RC:X) Vendors: Fortinet Products: FortiSandbox Problem Types: CWE-916 Description: A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-20-220
CVE ID: CVE-2022-26116 State: PUBLISHED Published: 2022-05-11T07:20:10 Last Updated: 2024-10-25T13:31:55.266Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiNAC Problem Types: Execute unauthorized code or commands Description: Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.2 and below may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters. Add
llow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-062
CVE ID: CVE-2022-26117 State: PUBLISHED Published: 2022-07-18T00:00:00 Last Updated: 2024-10-25T13:31:44.796Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: Fortinet FortiNAC Problem Types: Execute unauthorized code or commands Description: An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
databases via the CLI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/orangecertcc/security-research/security/advisories/GHSA-r259-5p5p-2q47 - https://fortiguard.com/psirt/FG-IR-22-058
CVE ID: CVE-2022-26118 State: PUBLISHED Published: 2022-07-18T16:40:52 Last Updated: 2024-10-25T13:30:41.578Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiManager , FortiAnalyzer Problem Types: Escalation of privilege Description: A privilege chaining vulnerability [CWE-268] in FortiManager and FortiAnalyzer 6.0.x, 6.2.x, 6.4.0 through 6.4.7, 7.0.0 through 7.0.3 may allow a local and authenticated attacker with a restricted shell to escalate their privileges to root due to incorrect permissions of some folders and executable files on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vu
ons of some folders and executable files on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-056