Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-30269 State: PUBLISHED Published: 2022-07-26T22:11:30 Last Updated: 2024-08-03T06:48:34.866Z Vendors: n/a Products: n/a Problem Types: n/a Description: Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity. They allow for custom application installation via either STS software, the C toolkit, or the ACE1000 Easy Configurator. In the case of the Easy Configurator, application images (as PLX/DAT/APP/CRC files) are uploaded via the Web UI. In case of the C toolkit, they are transferred and installed using SFTP/SSH. In each case, application images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for
images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/blog/ - https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06
CVE ID: CVE-2022-30270 State: PUBLISHED Published: 2022-07-26T22:11:27 Last Updated: 2024-08-03T06:48:34.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Motorola ACE1000 RTU through 2022-05-02 has default credentials. It exposes an SSH interface on port 22/TCP. This interface is used for remote maintenance and for SFTP file-transfer operations that are part of engineering software functionality. Access to this interface is controlled by 5 preconfigured accounts (root, abuilder, acelogin, cappl, ace), all of which come with default credentials. Although the ACE1000 documentation mentions the root, abuilder and acelogin accounts and instructs users to change the default cre
he ACE1000 documentation mentions the root, abuilder and acelogin accounts and instructs users to change the default credentials, the cappl and ace accounts remain undocumented and thus are unlikely to have their credentials changed. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/blog/ - https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06
CVE ID: CVE-2022-30271 State: PUBLISHED Published: 2022-07-26T22:11:24 Last Updated: 2024-08-03T06:48:34.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Motorola ACE1000 RTU through 2022-05-02 ships with a hardcoded SSH private key and initialization scripts (such as /etc/init.d/sshd_service) only generate a new key if no private-key file exists. Thus, this hardcoded key is likely to be used by default. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.forescout.com/blog/ - https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06
CVE ID: CVE-2022-30272 State: PUBLISHED Published: 2022-07-26T22:10:35 Last Updated: 2024-08-03T06:48:34.768Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Motorola ACE1000 RTU through 2022-05-02 mishandles firmware integrity. It utilizes either the STS software suite or ACE1000 Easy Configurator for performing firmware updates. In case of the Easy Configurator, firmware updates are performed through access to the Web UI where file system, kernel, package, bundle, or application images can be installed. Firmware updates for the Front End Processor (FEP) module are performed via access to the SSH interface (22/TCP), where a .hex file image is transferred and a bootloader scri
ule are performed via access to the SSH interface (22/TCP), where a .hex file image is transferred and a bootloader script invoked. File system, kernel, package, and bundle updates are supplied as RPM (RPM Package Manager) files while FEP updates are supplied as S-rec files. In all cases, firmware images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/blog/ - https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06
CVE ID: CVE-2022-30273 State: PUBLISHED Published: 2022-07-26T21:21:34 Last Updated: 2024-08-03T06:48:34.760Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Motorola MDLC protocol through 2022-05-02 mishandles message integrity. It supports three security modes: Plain, Legacy Encryption, and New Encryption. In Legacy Encryption mode, traffic is encrypted via the Tiny Encryption Algorithm (TEA) block-cipher in ECB mode. This mode of operation does not offer message integrity and offers reduced confidentiality above the block level, as demonstrated by an ECB Penguin attack against any block ciphers. Additional Analyst Notes: - CVE Program Container: References: - https://www.fo
enguin attack against any block ciphers. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/blog/ - https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation - https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-05
CVE ID: CVE-2022-30274 State: PUBLISHED Published: 2022-07-26T22:06:38 Last Updated: 2024-08-03T06:48:34.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Motorola ACE1000 RTU through 2022-05-02 uses ECB encryption unsafely. It can communicate with an XRT LAN-to-radio gateway by means of an embedded client. Credentials for accessing this gateway are stored after being encrypted with the Tiny Encryption Algorithm (TEA) in ECB mode using a hardcoded key. Similarly, the ACE1000 RTU can route MDLC traffic over Extended Command and Management Protocol (XCMP) and Network Layer (XNL) networks via the MDLC driver. Authentication to the XNL port is protected by TEA in ECB mode using
d Network Layer (XNL) networks via the MDLC driver. Authentication to the XNL port is protected by TEA in ECB mode using a hardcoded key. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/blog/ - https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06
CVE ID: CVE-2022-30275 State: PUBLISHED Published: 2022-07-26T21:21:46 Last Updated: 2024-08-03T06:48:34.779Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Motorola MOSCAD Toolbox software through 2022-05-02 relies on a cleartext password. It utilizes an MDLC driver to communicate with MOSCAD/ACE RTUs for engineering purposes. Access to these communications is protected by a password stored in cleartext in the wmdlcdrv.ini driver configuration file. In addition, this password is used for access control to MOSCAD/STS projects protected with the Legacy Password feature. In this case, an insecure CRC of the password is present in the project file: this CRC is validated against
rd feature. In this case, an insecure CRC of the password is present in the project file: this CRC is validated against the password in the driver configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/blog/ - https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-05
CVE ID: CVE-2022-30276 State: PUBLISHED Published: 2022-07-26T22:14:09 Last Updated: 2024-08-03T06:48:35.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Motorola MOSCAD and ACE line of RTUs through 2022-05-02 omit an authentication requirement. They feature IP Gateway modules which allow for interfacing between Motorola Data Link Communication (MDLC) networks (potentially over a variety of serial, RF and/or Ethernet links) and TCP/IP networks. Communication with RTUs behind the gateway is done by means of the proprietary IPGW protocol (5001/TCP). This protocol does not have any authentication features, allowing any attacker capable of communicating with the port in questi
otocol does not have any authentication features, allowing any attacker capable of communicating with the port in question to invoke (a subset of) desired functionality. Additional Analyst Notes: - CVE Program Container: References: - https://www.forescout.com/blog/ - https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-04
CVE ID: CVE-2022-30277 State: PUBLISHED Published: 2022-06-01T16:38:50.425711Z Last Updated: 2024-09-16T17:43:27.280Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Becton Dickinson (BD) Products: BD Synapsys™ Problem Types: CWE-613 Description: BD Synapsys™, versions 4.20, 4.20 SR1, and 4.30, contain an insufficient session expiration vulnerability. If exploited, threat actors may be able to access, modify or delete sensitive information, including electronic protected health information (ePHI), protected health information (PHI) and personally identifiable information (PII). Additional Analyst Notes: - CVE Program Container: References: - https://cybersec
onally identifiable information (PII). Additional Analyst Notes: - CVE Program Container: References: - https://cybersecurity.bd.com/bulletins-and-patches/bd-synapsys-insufficient-session-expiration
CVE ID: CVE-2022-30278 State: PUBLISHED Published: 2022-05-10T19:47:30 Last Updated: 2024-08-03T06:48:34.884Z Vendors: Synopsys Products: Black Duck Hub Problem Types: CWE-79 Description: A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to improper validation of user-supplied input to MadCap Flare's framework embedded within Black Duck Hub's Help Documentation to supply content. An attacker could exploit this vulnerability by convincing a user to click a link designed to pass malicious input to the interface. A successful exploit could allow the attac
ing a user to click a link designed to pass malicious input to the interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks and gain access to sensitive browser-based information. Additional Analyst Notes: - CVE Program Container: References: - https://www.synopsys.com/blogs/software-security/cyrc-advisory-cross-site-scripting-vulnerability-black-duck-hub/
CVE ID: CVE-2022-30279 State: PUBLISHED Published: 2022-05-12T14:49:27 Last Updated: 2024-08-03T06:48:34.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Stormshield Network Security (SNS) 4.3.x before 4.3.8. The event logging of the ASQ sofbus lacbus plugin triggers the dereferencing of a NULL pointer, leading to a crash of SNS. An attacker could exploit this vulnerability via forged sofbus lacbus traffic to cause a firmware crash. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.stormshield.eu/2022-015
CVE ID: CVE-2022-30280 State: PUBLISHED Published: 2023-07-24T00:00:00 Last Updated: 2024-10-24T14:53:56.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: /SecurityManagement/html/createuser.jsf in Nokia NetAct 22 allows CSRF. A remote attacker is able to create users with arbitrary privileges, even administrative privileges. The application (even if it implements a CSRF token for the random GET request) does not ever verify a CSRF token. With a little help of social engineering/phishing (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker's choosing. If the victim is a normal user, a successful
rs of a web application into executing actions of the attacker's choosing. If the victim is a normal user, a successful CSRF attack can force the user to perform state changing requests like transferring funds, changing their email address, and so forth. If the victim is an administrative account, CSRF can compromise the entire web application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.telecomitalia.com/tit/it/innovazione/cybersecurity/red-team.html - https://www.gruppotim.it/it/footer/red-team.html
CVE ID: CVE-2022-30283 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T14:51:20.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: In UsbCoreDxe, tampering with the contents of the USB working buffer using DMA while certain USB transactions are in process leads to a TOCTOU problem that could be used by an attacker to cause SMRAM corruption and escalation of privileges The UsbCoreDxe module creates a working buffer for USB transactions outside of SMRAM. The code which uses can be inside of SMM, making the working buffer untrusted input. The buffer can be corrupted by DMA transfers. The SMM code code attempts to sanitize pointers to ensure all pointer
put. The buffer can be corrupted by DMA transfers. The SMM code code attempts to sanitize pointers to ensure all pointers refer to the working buffer, but when a pointer is not found in the list of pointers to sanitize, the current action is not aborted, leading to undefined behavior. This issue was discovered by Insyde engineering based on the general description provided by Intel's iSTARE group. Fixed in: Kernel 5.0: Version 05.09. 21 Kernel 5.1: Version 05.17.21 Kernel 5.2: Version 05.27.21 Kernel 5.3: Version 05.36.21 Kernel 5.4: Version 05.44.21 Kernel 5.5: Version 05.52.21 https://www.insyde.com/security-pledge/SA-2022063 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vu
52.21 https://www.insyde.com/security-pledge/SA-2022063 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge - https://www.insyde.com/security-pledge/SA-2022063
CVE ID: CVE-2022-30284 State: PUBLISHED Published: 2022-05-04T21:35:20 Last Updated: 2024-08-03T06:48:34.846Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not validate arguments). NOTE: the vendor believes it would be unrealistic for an application to call NmapProcess with arguments taken from input data that arrived over an untrusted network, and thus the CVSS score corresponds to an unrealistic use case. None of the NmapProcess documentation implies that this is an expecte
CVSS score corresponds to an unrealistic use case. None of the NmapProcess documentation implies that this is an expected use case Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://pypi.org/project/python-libnmap/ - https://www.swascan.com/security-advisory-libnmap-2/ - https://github.com/savon-noir/python-libnmap/releases - https://libnmap.readthedocs.io/en/latest/process.html#using-libnmap-process
CVE ID: CVE-2022-30285 State: PUBLISHED Published: 2022-08-02T21:38:53 Last Updated: 2024-08-03T06:48:34.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Quest KACE Systems Management Appliance (SMA) through 12.0, a hash collision is possible during authentication. This may allow authentication with invalid credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.quest.com/kace/ - https://support.quest.com/kace-systems-management-appliance/kb/338232/quest-response-to-kace-sma-vulnerabilities-cve-2022-30285
CVE ID: CVE-2022-30286 State: PUBLISHED Published: 2022-05-09T12:01:36 Last Updated: 2024-08-03T06:48:36.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: pyscriptjs (aka PyScript Demonstrator) in PyScript through 2022-05-04 allows a remote user to read Python source code. Additional Analyst Notes: - CVE Program Container: References: - https://cyber-guy.gitbook.io/cyber-guy/pocs/pyscript-file-read - https://github.com/pyscript/pyscript/commits/main - https://cyber-guy.gitbook.io/cyber-guy/blogs/the-art-of-vulnerability-chaining-pyscript - http://packetstormsecurity.com/files/167069/PyScript-2022-05-04-Alpha-Source-Code-Disclosure.html - https://www.exploit-db.com/exploits/5091
curity.com/files/167069/PyScript-2022-05-04-Alpha-Source-Code-Disclosure.html - https://www.exploit-db.com/exploits/50918
CVE ID: CVE-2022-30287 State: PUBLISHED Published: 2022-07-28T21:08:21 Last Updated: 2024-10-19T13:05:46.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserialization of PHP objects. Additional Analyst Notes: - CVE Program Container: References: - https://www.horde.org/apps/webmail - https://blog.sonarsource.com/horde-webmail-rce-via-email/ - https://lists.debian.org/debian-lts-announce/2022/08/msg00022.html
CVE ID: CVE-2022-30288 State: PUBLISHED Published: 2022-05-04T22:31:33 Last Updated: 2024-08-22T14:47:12.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://spec.graphql.org/October2021/#sec-Fragment-spreads-must-not-form-cycles - https://github.com/ohler55/agoo/issues/109 - https://github.com/nicholasal
/#sec-Fragment-spreads-must-not-form-cycles - https://github.com/ohler55/agoo/issues/109 - https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/agoo.md
CVE ID: CVE-2022-30289 State: PUBLISHED Published: 2022-07-05T11:59:52 Last Updated: 2024-08-03T06:48:36.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored Cross-site Scripting (XSS) vulnerability was identified in the Data Import functionality of OpenCTI through 5.2.4. An attacker can abuse the vulnerability to upload a malicious file that will then be executed by a victim when they open the file location. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenCTI-Platform/opencti/releases - https://www.enisa.europa.eu/topics/threat-risk-management/vulnerability-disclosure
CVE ID: CVE-2022-30290 State: PUBLISHED Published: 2022-07-05T12:43:40 Last Updated: 2024-08-03T06:48:34.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. An attacker can abuse the identified vulnerability in order to arbitrarily change their registered e-mail address as well as their API key, even though such action is not possible through the interface, legitimately. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenCTI-Platform/opencti/releases - https://www.enisa.europa.eu/topics/threat-risk-management/vulnerability-disclosure
CVE ID: CVE-2022-30292 State: PUBLISHED Published: 2022-05-04T22:53:14 Last Updated: 2024-08-03T06:48:36.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in sqbaselib.cpp in SQUIRREL 3.2 due to lack of a certain sq_reservestack call. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/albertodemichelis/squirrel/commit/a6413aa690e0bdfef648c68693349a7b878fe60d - https://github.com/sprushed/CVE-2022-30292 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WBUYGYXDQX3OSAYHP4TCG3JS7PJTIE75/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.
BUYGYXDQX3OSAYHP4TCG3JS7PJTIE75/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DMIKSVTKNU5FRCUUNAYMCQLOJA3K3S2I/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BV7SJJ44AGAX4ILIVPREIXPJ2GOG3FKV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M3FQILX7UUEERSDPMZP3MKGTMY2E7ESU/
CVE ID: CVE-2022-30293 State: PUBLISHED Published: 2022-05-06T04:33:24 Last Updated: 2024-08-03T06:48:36.424Z Vendors: n/a Products: n/a Problem Types: n/a Description: In WebKitGTK through 2.36.0 (and WPE WebKit), there is a heap-based buffer overflow in WebCore::TextureMapperLayer::setContentsLayer in WebCore/platform/graphics/texmap/TextureMapperLayer.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ChijinZ/security_advisories/tree/master/webkitgtk-2.36.0 - https://bugs.webkit.org/show_bug.cgi?id=237187 - http://www.openwall.com/lists/oss-security/2022/05/30/1 - https://www.debian.org/security/2022/dsa-5154 - https://www.debian.org/security/2022/dsa
sts/oss-security/2022/05/30/1 - https://www.debian.org/security/2022/dsa-5154 - https://www.debian.org/security/2022/dsa-5155 - https://security.gentoo.org/glsa/202208-39
CVE ID: CVE-2022-30294 State: REJECTED Published: 2022-05-06T04:32:56 Last Updated: 2022-06-13T17:26:34 Description: No description available.
CVE ID: CVE-2022-30295 State: PUBLISHED Published: 2022-05-06T04:43:47 Last Updated: 2024-08-03T06:48:34.838Z Vendors: n/a Products: n/a Problem Types: n/a Description: uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning. This is related to a reset of a value to 0x2. Additional Analyst Notes: - CVE Program Container: References: - https://www.nozominetworks.com/blog/nozomi-networks-discovers-unpatched-dns-bug-in-popular-c-standard-library-putting-iot-at-risk/ - https://www.kb.cert.org/vuls/id/473698
CVE ID: CVE-2022-30296 State: PUBLISHED Published: 2022-08-18T19:59:24.000Z Last Updated: 2025-02-25T16:56:18.743Z Vendors: n/a Products: version Problem Types: information disclosure Description: Insufficiently protected credentials in the Intel(R) Datacenter Group Event iOS application, all versions, may allow an unauthenticated user to potentially enable information disclosure via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00703.html
CVE ID: CVE-2022-30297 State: PUBLISHED Published: 2022-11-11T15:48:39.241Z Last Updated: 2025-02-05T20:53:20.086Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: n/a Products: Intel(R) EMA software Problem Types: escalation of privilege Description: Cross-site scripting in the Intel(R) EMA software before version 1.8.0 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00716.html
CVE ID: CVE-2022-30298 State: PUBLISHED Published: 2022-09-06T15:10:29 Last Updated: 2024-10-25T13:30:11.492Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiSOAR Problem Types: Escalation of privilege Description: An improper privilege management vulnerability [CWE-269] in Fortinet FortiSOAR before 7.2.1 allows a GUI user who has already found a way to modify system files (via another, unrelated and hypothetical exploit) to execute arbitrary Python commands as root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-152
CVE ID: CVE-2022-30299 State: PUBLISHED Published: 2023-02-16T18:05:34.338Z Last Updated: 2024-10-23T14:50:18.955Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-23 Description: A path traversal vulnerability [CWE-23] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions may allow an authenticated attacker to retrieve specific parts of files from the underlying file system via specially crafted web requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.co
equests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-146