deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-34713
Published: 2024-05-14
Description: sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authorized to connect to a ssh server using `sshproxy` can inject options to the `ssh` command executed by `sshproxy`. All versions of `sshproxy` are impacted. The problem is patched starting in version 1.6.3. The only workaround is to use the `force_command` option in `sshproxy.yaml`, but it's rarely relevant.
CVSS Score: 3.5 (LOW)
CWE: CWE-77
References: https://github.com/cea-hpc/sshproxy/commit/f7eabd05d5f0f951e[PII_REDACTED]7cad9a7d9580; https://github.com/cea-hpc/sshproxy/security/advisories/GHSA-jmqp-37m5-49wh; https://github.com/cea-hpc/sshproxy/commit/f7eabd05d5f0f951e[PII_REDACTED]7cad9a7d9580
CVE: CVE-2024-34714
Published: 2024-05-14
Description: The Hoppscotch Browser Extension is a browser extension for Hoppscotch, a community-driven end-to-end open-source API development ecosystem. Due to an oversight during a change made to the extension in the commit d4e8e4830326f46ba17acd1307977ecd32a85b58, a critical check for the origin list was missed and allowed for messages to be sent to the extension which the extension gladly processed and responded back with the results of, while this wasn't supposed to happen and be blocked by the origin not being present in the origin list.

This vulnerability exposes Hoppscotch Extension users to sites which call into Hoppscotch Extension APIs internally. This fundamentally allows any site running on the browser with the extension installed to bypass CORS restrictions if the user is running extensions with the given version. This security hole was patched in the commit 7e364b928ab722dc682d0fcad713a96cc38477d6 which was released along with the extension version `0.35`. As a workaround, Chrome users can use the Extensions Settings to disable the extension access to only the origins that you want. Firefox doesn't have an alternative to upgrading to a fixed version.
CVSS Score: 7.6 (HIGH)
CWE: CWE-354
References: https://github.com/hoppscotch/hoppscotch-extension/commit/7e364b928ab722dc682d0fcad713a96cc38477d6; https://github.com/hoppscotch/hoppscotch-extension/commit/d4e8e4830326f46ba17acd1307977ecd32a85b58; https://github.com/hoppscotch/hoppscotch-extension/security/advisories/GHSA-jjh5-pvqx-gg5v
CVE: CVE-2024-34716
Published: 2024-05-14
Description: PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with customer-thread feature flag enabled is present starting from PrestaShop 8.1.0 and prior to PrestaShop 8.1.6. When the customer thread feature flag is enabled through the front-office contact form, a hacker can upload a malicious file containing an XSS that will be executed when an admin opens the attached file in back office. The script injected can access the session and the security token, which allows it to perform any authenticated action in the scope of the administrator's right. This vulnerability is patched in 8.1.6. A workaround is to disable the customer-thread feature-flag.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79, CWE-79
References: https://github.com/PrestaShop/PrestaShop/releases/tag/8.1.6; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-45vm-3j38-7p78; https://github.com/PrestaShop/PrestaShop/releases/tag/8.1.6
CVE: CVE-2024-34717
Published: 2024-05-14
Description: PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random secure_key parameter in the url. This issue is patched in version 8.1.6. No known workarounds are available.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/PrestaShop/PrestaShop/releases/tag/8.1.6; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-7pjr-2rgh-fc5g; https://github.com/PrestaShop/PrestaShop/releases/tag/8.1.6
CVE: CVE-2024-34771
Published: 2024-05-14
Description: A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 2). The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-589937.html; https://cert-portal.siemens.com/productcert/html/ssa-589937.html
CVE: CVE-2024-34772
Published: 2024-05-14
Description: A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 4). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/html/ssa-589937.html; https://cert-portal.siemens.com/productcert/html/ssa-589937.html
CVE: CVE-2024-34773
Published: 2024-05-14
Description: A vulnerability has been identified in Solid Edge (All versions < V224.0 Update 2). The affected applications contain a stack overflow vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://cert-portal.siemens.com/productcert/html/ssa-589937.html; https://cert-portal.siemens.com/productcert/html/ssa-589937.html
CVE: CVE-2024-34914
Published: 2024-05-14
Description: php-censor v2.1.4 and fixed in v.2.1.5 was discovered to utilize a weak hashing algorithm for its remember_key value. This allows attackers to bruteforce to bruteforce the remember_key value to gain access to accounts that have checked "remember me" when logging in.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-328
References: https://chmod744.super.site/redacted-vulnerability; https://chmod744.super.site/redacted-vulnerability
CVE: CVE-2024-34950
Published: 2024-05-14
Description: D-Link DIR-822+ v1.0.5 was discovered to contain a stack-based buffer overflow vulnerability in the SetNetworkTomographySettings module.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://dear-sunshine-ba5.notion.site/D-Link-DIR-822-v1-0-5-Stack-Overflow-e77ff3d9c31f4a98bfa0fa71eca54000; https://dear-sunshine-ba5.notion.site/D-Link-DIR-822-v1-0-5-Stack-Overflow-e77ff3d9c31f4a98bfa0fa71eca54000
CVE: CVE-2024-35009
Published: 2024-05-14
Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/share_switch.php?mudi=switch&dataType=&fieldName=state&fieldName2=state&tabName=banner&dataID=6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Thirtypenny77/cms/blob/main/5.md; https://github.com/Thirtypenny77/cms/blob/main/5.md
CVE: CVE-2024-35010
Published: 2024-05-14
Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/banner_deal.php?mudi=del&dataType=&dataTypeCN=%E5%9B%BE%E7%89%87%E5%B9%BF%E5%91%8A&theme=cs&dataID=6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Thirtypenny77/cms/blob/main/6.md; https://github.com/Thirtypenny77/cms/blob/main/6.md
CVE: CVE-2024-35011
Published: 2024-05-14
Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType_deal.php?mudi=rev&nohrefStr=close.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://github.com/Thirtypenny77/cms/blob/main/8.md; https://github.com/Thirtypenny77/cms/blob/main/8.md
CVE: CVE-2024-35012
Published: 2024-05-14
Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType_deal.php?mudi=add&nohrefStr=close.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: https://github.com/Thirtypenny77/cms/blob/main/7.md; https://github.com/Thirtypenny77/cms/blob/main/7.md
CVE: CVE-2024-3241
Published: 2024-05-14
Description: The Ultimate Blocks  WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/a645daee-42ea-43f8-9480-ef3be69606e0/; https://wpscan.com/vulnerability/a645daee-42ea-43f8-9480-ef3be69606e0/
CVE: CVE-2024-3372
Published: 2024-05-14
Description: Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be performed pre-authentication and may cause unexpected application behavior including unavailability of serverStatus responses. This issue affects MongoDB Server v7.0 versions prior to 7.0.6, MongoDB Server v6.0 versions prior to 6.0.14 and MongoDB Server v.5.0 versions prior to 5.0.25.

CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://jira.mongodb.org/browse/SERVER-85263; https://jira.mongodb.org/browse/SERVER-85263
CVE: CVE-2024-3374
Published: 2024-05-14
Description: An unauthenticated user can trigger a fatal assertion in the server while generating ftdc diagnostic metrics due to attempting to build a BSON object that exceeds certain memory sizes. This issue affects MongoDB Server v5.0 versions prior to and including 5.0.16 and MongoDB Server v6.0 versions prior to and including 6.0.5.

CVSS Score: 5.3 (MEDIUM)
CWE: CWE-617
References: https://jira.mongodb.org/browse/SERVER-75601; https://jira.mongodb.org/browse/SERVER-75601
CVE: CVE-2024-3579
Published: 2024-05-14
Description: Open-source project Online Shopping System Advanced is vulnerable to Reflected Cross-Site Scripting (XSS). An attacker might trick somebody into using a crafted URL, which will cause a script to be run in user's browser. 

CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cert.pl/en/posts/2024/05/CVE-2024-3579; https://cert.pl/posts/2024/05/CVE-2024-3579; https://cert.pl/en/posts/2024/05/CVE-2024-3579
CVE: CVE-2024-4138
Published: 2024-05-14
Description: Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can enable/disable the sharing rule of other users affecting the integrity of the application. Confidentiality and Availability are not affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3434666; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3434666
CVE: CVE-2024-4139
Published: 2024-05-14
Description: Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can delete rules of other users affecting the integrity of the application. Confidentiality and Availability are not affected.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://me.sap.com/notes/3434666; https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html; https://me.sap.com/notes/3434666
CVE: CVE-2024-4144
Published: 2024-05-14
Description: The Simple Basic Contact Form plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 20240502. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on the functionality of other plugins installed in the environment.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: https://plugins.trac.wordpress.org/browser/simple-basic-contact-form/trunk/simple-basic-contact-form.php#L543; https://plugins.trac.wordpress.org/changeset/3085036/; https://www.wordfence.com/threat-intel/vulnerabilities/id/ded1944f-662d-4d25-8277-4b1dc63b2144?source=cve
CVE: CVE-2024-4333
Published: 2024-05-14
Description: The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via several parameters in versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/assets/js/jquery.countdown.min.js; https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/trunk/assets/js/typed.min.js; https://plugins.trac.wordpress.org/changeset/3085825/
CVE: CVE-2024-4392
Published: 2024-05-14
Description: The Jetpack – WP Security, Backup, Speed, & Growth plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpvideo shortcode in all versions up to, and including, 13.3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/jetpack/tags/13.3.1/modules/videopress/class.videopress-player.php#L335; https://www.wordfence.com/threat-intel/vulnerabilities/id/11dceac7-7ff8-4384-9046-919c38947c32?source=cve; https://plugins.trac.wordpress.org/browser/jetpack/tags/13.3.1/modules/videopress/class.videopress-player.php#L335
CVE: CVE-2024-4440
Published: 2024-05-14
Description: The 140+ Widgets | Best Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/xpro-elementor-addons/trunk/widgets/contact-form/contact-form.php#L1438; https://plugins.trac.wordpress.org/browser/xpro-elementor-addons/trunk/widgets/course-grid/course-grid.php#L1918; https://plugins.trac.wordpress.org/browser/xpro-elementor-addons/trunk/widgets/custom-field/custom-field.php#L1150
CVE: CVE-2024-4445
Published: 2024-05-14
Description: The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the several functions in versions up to, and including, 6.20.01. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to edit plugin settings, including storing cross-site scripting, in multisite environments.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-601
References: https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/trunk/classes/mu.class.php?rev=2946135; https://plugins.trac.wordpress.org/changeset/3082085/#file655; https://www.wordfence.com/threat-intel/vulnerabilities/id/830f53a4-da3b-4a95-99f1-c4a4c8e6944c?source=cve
CVE: CVE-2024-4473
Published: 2024-05-14
Description: The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "aThemes: Portfolio" widget in all versions up to, and including, 1.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/changeset/3082233/sydney-toolbox; https://www.wordfence.com/threat-intel/vulnerabilities/id/60f16abd-951b-48a0-a363-0221f7e0957d?source=cve; https://plugins.trac.wordpress.org/changeset/3082233/sydney-toolbox
CVE: CVE-2024-4624
Published: 2024-05-14
Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eael_ext_toc_title_tag’ parameter in versions up to, and including, 5.9.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/tags/5.9.19/includes/Traits/Elements.php#L550; https://plugins.trac.wordpress.org/changeset/3085420/; https://www.wordfence.com/threat-intel/vulnerabilities/id/bedad627-0ccb-41c1-be8d-753f57be618f?source=cve
CVE: CVE-2024-4761
Published: 2024-05-14
Description: Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html; https://issues.chromium.org/issues/339458194; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6G7EYH2JAK5OJPVNC6AXYQ5K7YGYNCDN/
CVE: CVE-2024-4810
Published: 2024-05-14
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
This CVE has been replaced by CVE-2024-36015.
CVE: CVE-2024-4859
Published: 2024-05-14
Description: Solidus <= 4.3.4 is affected by a Stored Cross-Site Scripting vulnerability in the order tracking URL.

CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2024-15; https://www.tenable.com/security/research/tra-2024-15
CVE: CVE-2024-4860
Published: 2024-05-14
Description: The 'WordPress RSS Aggregator' WordPress Plugin, versions < 4.23.9 are affected by a Cross-Site Scripting (XSS) vulnerability due to the lack of sanitization of the  'notice_id'  GET parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.tenable.com/security/research/tra-2024-16; https://www.tenable.com/security/research/tra-2024-16
CVE: CVE-2024-4871
Published: 2024-05-14
Description: A vulnerability was found in Satellite. When running a remote execution job on a host, the host's SSH key is not being checked. When the key changes, the Satellite still connects it because it uses "-o StrictHostKeyChecking=no". This flaw can lead to a man-in-the-middle attack (MITM), denial of service, leaking of secrets the remote execution job contains, or other issues that may arise from the attacker's ability to forge an SSH key. This issue does not directly allow unauthorized remote execution on the Satellite, although it can leak secrets that may lead to it.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-322
References: https://access.redhat.com/errata/RHBA-2024:4589; https://access.redhat.com/security/cve/CVE-2024-4871; https://bugzilla.redhat.com/show_bug.cgi?id=2278627
CVE: CVE-2023-24203
Published: 2024-05-14
Description: Cross Site Scripting vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitary code via the company or query parameter(s).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/momo1239/CVE-2023-24203-and-CVE-2023-24204; https://momonguyen.com/2023/cve-2023-24203/; https://www.sourcecodester.com
CVE: CVE-2023-24204
Published: 2024-05-14
Description: SQL injection vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitrary code via the name parameter in get-quote.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89
References: https://github.com/momo1239/CVE-2023-24203-and-CVE-2023-24204; https://momonguyen.com/2023/cve-2023-24203/; https://www.sourcecodester.com
CVE: CVE-2023-36640
Published: 2024-05-14
Description: A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiPAM versions 1.0.0 through 1.0.3, FortiOS versions 7.2.0, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.16 allows attacker to execute unauthorized code or commands via specially crafted commands
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-134
References: https://fortiguard.com/psirt/FG-IR-23-137; https://fortiguard.com/psirt/FG-IR-23-137
CVE: CVE-2023-40720
Published: 2024-05-14
Description: An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiVoiceEntreprise version 7.0.0 through 7.0.1 and before 6.4.8 allows an authenticated attacker to read the SIP configuration of other users via crafted HTTP or HTTPS requests.
CVSS Score: 7.1 (HIGH)
CWE: CWE-639
References: https://fortiguard.com/psirt/FG-IR-23-282; https://fortiguard.com/psirt/FG-IR-23-282
CVE: CVE-2023-44247
Published: 2024-05-14
Description: A double free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 6.4 all versions may allow a privileged attacker to execute code or commands via crafted HTTP or HTTPs requests.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-415
References: https://fortiguard.com/psirt/FG-IR-23-195; https://fortiguard.com/psirt/FG-IR-23-195
CVE: CVE-2023-45583
Published: 2024-05-14
Description: A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.5, 7.0.0 through 7.0.11, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6 FortiPAM versions 1.1.0, 1.0.0 through 1.0.3 FortiOS versions 7.4.0, 7.2.0 through 7.2.5, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15 FortiSwitchManager versions 7.2.0 through 7.2.2, 7.0.0 through 7.0.2 allows attacker to execute unauthorized code or commands via specially crafted cli commands and http requests.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-134
References: https://fortiguard.com/psirt/FG-IR-23-137; https://fortiguard.com/psirt/FG-IR-23-137
CVE: CVE-2023-45586
Published: 2024-05-14
Description: An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.12 & FortiProxy SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.13 allows an authenticated VPN user to send (but not receive) packets spoofing the IP of another user via crafted network packets.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-345, CWE-345
References: https://fortiguard.com/psirt/FG-IR-23-225; https://fortiguard.com/psirt/FG-IR-23-225
CVE: CVE-2023-46714
Published: 2024-05-14
Description: A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.1 through 7.2.6 and version 7.4.0 through 7.4.1 allows a privileged attacker over the administrative interface to execute arbitrary code or commands via crafted HTTP or HTTPs requests.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121
References: https://fortiguard.com/psirt/FG-IR-23-415; https://fortiguard.com/psirt/FG-IR-23-415
CVE: CVE-2023-50180
Published: 2024-05-14
Description: An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiADC version 7.4.1 and below, version 7.2.3 and below, version 7.1.4 and below, version 7.0.5 and below, version 6.2.6 and below may allow a read-only admin to view data pertaining to other admins.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-497
References: https://fortiguard.com/psirt/FG-IR-23-433; https://fortiguard.com/psirt/FG-IR-23-433