auren-research/cyber-sec huggingface dataset:
cveID: CVE-2016-3427
vendorProject: Oracle
product: Java SE and JRockit
vulnerabilityName: Oracle Java SE and JRockit Unspecified Vulnerability
dateAdded: 2023-05-12
shortDescription: Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-06-02
knownRansomwareCampaignUse: Unknown
notes: https://www.oracle.com/security-alerts/cpuapr2016v3.html; https://nvd.nist.gov/vuln/detail/CVE-2016-3427
cveID: CVE-2016-8735
vendorProject: Apache
product: Tomcat
vulnerabilityName: Apache Tomcat Remote Code Execution Vulnerability
dateAdded: 2023-05-12
shortDescription: Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-06-02
knownRansomwareCampaignUse: Unknown
notes: https://tomcat.apache.org/security-9.html; https://nvd.nist.gov/vuln/detail/CVE-2016-8735
cwes: CWE-284
cveID: CVE-2023-29336
vendorProject: Microsoft
product: Win32k
vulnerabilityName: Microsoft Win32K Privilege Escalation Vulnerability
dateAdded: 2023-05-09
shortDescription: Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation up to SYSTEM privileges.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-05-30
knownRansomwareCampaignUse: Unknown
notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-29336; https://nvd.nist.gov/vuln/detail/CVE-2023-29336
cwes: CWE-416
cveID: CVE-2023-1389
vendorProject: TP-Link
product: Archer AX21
vulnerabilityName: TP-Link Archer AX-21 Command Injection Vulnerability
dateAdded: 2023-05-01
shortDescription: TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-05-22
knownRansomwareCampaignUse: Unknown
notes: https://www.tp-link.com/us/support/download/archer-ax21/v3/#Firmware; https://nvd.nist.gov/vuln/detail/CVE-2023-1389
cwes: CWE-77
cveID: CVE-2021-45046
vendorProject: Apache
product: Log4j2
vulnerabilityName: Apache Log4j2 Deserialization of Untrusted Data Vulnerability
dateAdded: 2023-05-01
shortDescription: Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-05-22
knownRansomwareCampaignUse: Known
notes: https://logging.apache.org/log4j/2.x/security.html; https://nvd.nist.gov/vuln/detail/CVE-2021-45046
cwes: CWE-917
cveID: CVE-2023-21839
vendorProject: Oracle
product: WebLogic Server
vulnerabilityName: Oracle WebLogic Server Unspecified Vulnerability
dateAdded: 2023-05-01
shortDescription: Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-05-22
knownRansomwareCampaignUse: Unknown
notes: https://www.oracle.com/security-alerts/cpujan2023.html; https://nvd.nist.gov/vuln/detail/CVE-2023-21839
cveID: CVE-2023-28432
vendorProject: MinIO
product: MinIO
vulnerabilityName: MinIO Information Disclosure Vulnerability
dateAdded: 2023-04-21
shortDescription: MinIO contains a vulnerability in a cluster deployment where MinIO returns all environment variables, which allows for information disclosure.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-05-12
knownRansomwareCampaignUse: Unknown
notes: https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q; https://nvd.nist.gov/vuln/detail/CVE-2023-28432
cwes: CWE-200
cveID: CVE-2023-27350
vendorProject: PaperCut
product: MF/NG
vulnerabilityName: PaperCut MF/NG Improper Access Control Vulnerability
dateAdded: 2023-04-21
shortDescription: PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-05-12
knownRansomwareCampaignUse: Known
notes: https://www.papercut.com/kb/Main/PO-1216-and-PO-1219; https://nvd.nist.gov/vuln/detail/CVE-2023-27350
cwes: CWE-284
cveID: CVE-2023-2136
vendorProject: Google
product: Chromium Skia
vulnerabilityName: Google Chrome Skia Integer Overflow Vulnerability
dateAdded: 2023-04-21
shortDescription: Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-05-12
knownRansomwareCampaignUse: Unknown
notes: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html; https://nvd.nist.gov/vuln/detail/CVE-2023-2136
cwes: CWE-190
cveID: CVE-2017-6742
vendorProject: Cisco
product: IOS and IOS XE Software
vulnerabilityName: Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
dateAdded: 2023-04-19
shortDescription: The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-05-10
knownRansomwareCampaignUse: Unknown
notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170629-snmp; https://nvd.nist.gov/vuln/detail/CVE-2017-6742
cwes: CWE-119
cveID: CVE-2019-8526
vendorProject: Apple
product: macOS
vulnerabilityName: Apple macOS Use-After-Free Vulnerability
dateAdded: 2023-04-17
shortDescription: Apple macOS contains a use-after-free vulnerability that could allow for privilege escalation.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-05-08
knownRansomwareCampaignUse: Unknown
notes: https://support.apple.com/en-us/HT209600; https://nvd.nist.gov/vuln/detail/CVE-2019-8526
cwes: CWE-416
cveID: CVE-2023-2033
vendorProject: Google
product: Chromium V8
vulnerabilityName: Google Chromium V8 Type Confusion Vulnerability
dateAdded: 2023-04-17
shortDescription: Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-05-08
knownRansomwareCampaignUse: Unknown
notes: https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_14.html; https://nvd.nist.gov/vuln/detail/CVE-2023-2033
cwes: CWE-843
cveID: CVE-2023-20963
vendorProject: Android
product: Framework
vulnerabilityName: Android Framework Privilege Escalation Vulnerability
dateAdded: 2023-04-13
shortDescription: Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-05-04
knownRansomwareCampaignUse: Unknown
notes: https://source.android.com/docs/security/bulletin/2023-03-01; https://nvd.nist.gov/vuln/detail/CVE-2023-20963
cwes: CWE-295
cveID: CVE-2023-29492
vendorProject: Novi Survey
product: Novi Survey
vulnerabilityName: Novi Survey Insecure Deserialization Vulnerability
dateAdded: 2023-04-13
shortDescription: Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-05-04
knownRansomwareCampaignUse: Unknown
notes: https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx; https://nvd.nist.gov/vuln/detail/CVE-2023-29492
cwes: CWE-94
cveID: CVE-2023-28252
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
dateAdded: 2023-04-11
shortDescription: Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-05-02
knownRansomwareCampaignUse: Known
notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-28252; https://nvd.nist.gov/vuln/detail/CVE-2023-28252
cwes: CWE-122
cveID: CVE-2023-28205
vendorProject: Apple
product: Multiple Products
vulnerabilityName: Apple Multiple Products WebKit Use-After-Free Vulnerability
dateAdded: 2023-04-10
shortDescription: Apple iOS, iPadOS, macOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-05-01
knownRansomwareCampaignUse: Unknown
notes: https://support.apple.com/en-us/HT213720,https://support.apple.com/en-us/HT213721,https://support.apple.com/en-us/HT213722,https://support.apple.com/en-us/HT213723; https://nvd.nist.gov/vuln/detail/CVE-2023-28205
cwes: CWE-416
cveID: CVE-2023-28206
vendorProject: Apple
product: iOS, iPadOS, and macOS
vulnerabilityName: Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability
dateAdded: 2023-04-10
shortDescription: Apple iOS, iPadOS, and macOS IOSurfaceAccelerator contain an out-of-bounds write vulnerability that allows an app to execute code with kernel privileges.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-05-01
knownRansomwareCampaignUse: Unknown
notes: https://support.apple.com/en-us/HT213720, https://support.apple.com/en-us/HT213721; https://nvd.nist.gov/vuln/detail/CVE-2023-28206
cwes: CWE-787
cveID: CVE-2021-27876
vendorProject: Veritas
product: Backup Exec Agent
vulnerabilityName: Veritas Backup Exec Agent File Access Vulnerability
dateAdded: 2023-04-07
shortDescription: Veritas Backup Exec (BE) Agent contains a file access vulnerability that could allow an attacker to specially craft input parameters on a data management protocol command to access files on the BE Agent machine.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-04-28
knownRansomwareCampaignUse: Known
notes: https://www.veritas.com/support/en_US/security/VTS21-001; https://nvd.nist.gov/vuln/detail/CVE-2021-27876
cwes: CWE-287
cveID: CVE-2021-27877
vendorProject: Veritas
product: Backup Exec Agent
vulnerabilityName: Veritas Backup Exec Agent Improper Authentication Vulnerability
dateAdded: 2023-04-07
shortDescription: Veritas Backup Exec (BE) Agent contains an improper authentication vulnerability that could allow an attacker unauthorized access to the BE Agent via SHA authentication scheme.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-04-28
knownRansomwareCampaignUse: Known
notes: https://www.veritas.com/support/en_US/security/VTS21-001; https://nvd.nist.gov/vuln/detail/CVE-2021-27877
cwes: CWE-287
cveID: CVE-2021-27878
vendorProject: Veritas
product: Backup Exec Agent
vulnerabilityName: Veritas Backup Exec Agent Command Execution Vulnerability
dateAdded: 2023-04-07
shortDescription: Veritas Backup Exec (BE) Agent contains a command execution vulnerability that could allow an attacker to use a data management protocol command to execute a command on the BE Agent machine.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-04-28
knownRansomwareCampaignUse: Known
notes: https://www.veritas.com/support/en_US/security/VTS21-001; https://nvd.nist.gov/vuln/detail/CVE-2021-27878
cwes: CWE-287
cveID: CVE-2019-1388
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability
dateAdded: 2023-04-07
shortDescription: Microsoft Windows Certificate Dialog contains a privilege escalation vulnerability, allowing attackers to run processes in an elevated context.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-04-28
knownRansomwareCampaignUse: Known
notes: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1388; https://nvd.nist.gov/vuln/detail/CVE-2019-1388
cwes: CWE-269
cveID: CVE-2023-26083
vendorProject: Arm
product: Mali Graphics Processing Unit (GPU)
vulnerabilityName: Arm Mali GPU Kernel Driver Information Disclosure Vulnerability
dateAdded: 2023-04-07
shortDescription: Arm Mali GPU Kernel Driver contains an information disclosure vulnerability that allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-04-28
knownRansomwareCampaignUse: Unknown
notes: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://nvd.nist.gov/vuln/detail/CVE-2023-26083
cwes: CWE-401
cveID: CVE-2022-27926
vendorProject: Synacor
product: Zimbra Collaboration Suite (ZCS)
vulnerabilityName: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
dateAdded: 2023-04-03
shortDescription: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-04-24
knownRansomwareCampaignUse: Unknown
notes: https://wiki.zimbra.com/wiki/Security_Center; https://nvd.nist.gov/vuln/detail/CVE-2022-27926
cwes: CWE-79
CWE-138
cveID: CVE-2013-3163
vendorProject: Microsoft
product: Internet Explorer
vulnerabilityName: Microsoft Internet Explorer Memory Corruption Vulnerability
dateAdded: 2023-03-30
shortDescription: Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial of service via a crafted website.
requiredAction: The impacted product is end-of-life and should be disconnected if still in use.
dueDate: 2023-04-20
knownRansomwareCampaignUse: Unknown
notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-055; https://nvd.nist.gov/vuln/detail/CVE-2013-3163
cwes: CWE-94
cveID: CVE-2017-7494
vendorProject: Samba
product: Samba
vulnerabilityName: Samba Remote Code Execution Vulnerability
dateAdded: 2023-03-30
shortDescription: Samba contains a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share and then cause the server to load and execute it.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-04-20
knownRansomwareCampaignUse: Known
notes: https://www.samba.org/samba/security/CVE-2017-7494.html; https://nvd.nist.gov/vuln/detail/CVE-2017-7494
cwes: CWE-94
cveID: CVE-2022-42948
vendorProject: Fortra
product: Cobalt Strike
vulnerabilityName: Fortra Cobalt Strike User Interface Remote Code Execution Vulnerability
dateAdded: 2023-03-30
shortDescription: Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-04-20
knownRansomwareCampaignUse: Unknown
notes: https://www.cobaltstrike.com/blog/out-of-band-update-cobalt-strike-4-7-2/; https://nvd.nist.gov/vuln/detail/CVE-2022-42948
cwes: CWE-79
CWE-116
cveID: CVE-2022-39197
vendorProject: Fortra
product: Cobalt Strike
vulnerabilityName: Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability
dateAdded: 2023-03-30
shortDescription: Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-04-20
knownRansomwareCampaignUse: Unknown
notes: https://www.cobaltstrike.com/blog/out-of-band-update-cobalt-strike-4-7-1/; https://nvd.nist.gov/vuln/detail/CVE-2022-39197
cwes: CWE-20
CWE-79
cveID: CVE-2021-30900
vendorProject: Apple
product: iOS, iPadOS, and macOS
vulnerabilityName: Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
dateAdded: 2023-03-30
shortDescription: Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-04-20
knownRansomwareCampaignUse: Unknown
notes: https://support.apple.com/en-us/HT21286, https://support.apple.com/en-us/HT212868, https://support.apple.com/kb/HT212872; https://nvd.nist.gov/vuln/detail/CVE-2021-30900
cwes: CWE-20
CWE-787
cveID: CVE-2022-38181
vendorProject: Arm
product: Mali Graphics Processing Unit (GPU)
vulnerabilityName: Arm Mali GPU Kernel Driver Use-After-Free Vulnerability
dateAdded: 2023-03-30
shortDescription: Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-04-20
knownRansomwareCampaignUse: Unknown
notes: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://nvd.nist.gov/vuln/detail/CVE-2022-38181
cwes: CWE-416
cveID: CVE-2023-0266
vendorProject: Linux
product: Kernel
vulnerabilityName: Linux Kernel Use-After-Free Vulnerability
dateAdded: 2023-03-30
shortDescription: Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-04-20
knownRansomwareCampaignUse: Unknown
notes: https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queue-5.10/alsa-pcm-move-rwsem-lock-inside-snd_ctl_elem_read-to-prevent-uaf.patch?id=72783cf35e6c55bca84c4bb7b776c58152856fd4; https://nvd.nist.gov/vuln/detail/CVE-2023-0266
cwes: CWE-416
cveID: CVE-2022-3038
vendorProject: Google
product: Chromium Network Service
vulnerabilityName: Google Chromium Network Service Use-After-Free Vulnerability
dateAdded: 2023-03-30
shortDescription: Google Chromium Network Service contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-04-20
knownRansomwareCampaignUse: Unknown
notes: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html; https://nvd.nist.gov/vuln/detail/CVE-2022-3038
cwes: CWE-416
cveID: CVE-2022-22706
vendorProject: Arm
product: Mali Graphics Processing Unit (GPU)
vulnerabilityName: Arm Mali GPU Kernel Driver Unspecified Vulnerability
dateAdded: 2023-03-30
shortDescription: Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-04-20
knownRansomwareCampaignUse: Unknown
notes: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://nvd.nist.gov/vuln/detail/CVE-2022-22706
cwes: CWE-119
cveID: CVE-2023-26360
vendorProject: Adobe
product: ColdFusion
vulnerabilityName: Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
dateAdded: 2023-03-15
shortDescription: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-04-05
knownRansomwareCampaignUse: Unknown
notes: https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html; https://nvd.nist.gov/vuln/detail/CVE-2023-26360
cwes: CWE-284
cveID: CVE-2023-23397
vendorProject: Microsoft
product: Office
vulnerabilityName: Microsoft Office Outlook Privilege Escalation Vulnerability
dateAdded: 2023-03-14
shortDescription: Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-04-04
knownRansomwareCampaignUse: Unknown
notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-23397, https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/, ; https://nvd.nist.gov/vuln/detail/CVE-2023-23397
cwes: CWE-294
cveID: CVE-2023-24880
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
dateAdded: 2023-03-14
shortDescription: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-04-04
knownRansomwareCampaignUse: Known
notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-24880; https://nvd.nist.gov/vuln/detail/CVE-2023-24880
cwes: CWE-863
cveID: CVE-2022-41328
vendorProject: Fortinet
product: FortiOS
vulnerabilityName: Fortinet FortiOS Path Traversal Vulnerability
dateAdded: 2023-03-14
shortDescription: Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-04-04
knownRansomwareCampaignUse: Unknown
notes: https://www.fortiguard.com/psirt/FG-IR-22-369; https://nvd.nist.gov/vuln/detail/CVE-2022-41328
cwes: CWE-22
cveID: CVE-2021-39144
vendorProject: XStream
product: XStream
vulnerabilityName: XStream Remote Code Execution Vulnerability
dateAdded: 2023-03-10
shortDescription: XStream contains a remote code execution vulnerability that allows an attacker to manipulate the processed input stream and replace or inject objects that result in the execution of a local command on the server. This vulnerability can affect multiple products, including but not limited to VMware Cloud Foundation.
requiredAction: Apply updates per vendor instructions.
dueDate: 2023-03-31
knownRansomwareCampaignUse: Unknown
notes: https://www.vmware.com/security/advisories/VMSA-2022-0027.html, https://x-stream.github.io/CVE-2021-39144.html; https://nvd.nist.gov/vuln/detail/CVE-2021-39144
cwes: CWE-94
CWE-502