rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-6646 
On BIG-IP 11.5.2-11.6.4 and Enterprise Manager 3.1.1, REST users with guest privileges may be able to escalate their privileges and run commands with admin privileges.
Problem types: description: Privilege Escalation
Affected products: vendor: n/a
product: BIG-IP, Enterprise Manager
Published: 2019-09-04T17:13:02.000Z
CVE-2019-6647 
On BIG-IP 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, 12.1.0-12.1.4.1, 11.5.2-11.6.4, when processing authentication attempts for control-plane users MCPD leaks a small amount of memory. Under rare conditions attackers with access to the management interface could eventually deplete memory on the system.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2019-09-04T16:17:16.000Z
CVE-2019-6648 
On version 1.9.0, If DEBUG logging is enable, F5 Container Ingress Service (CIS) for Kubernetes and Red Hat OpenShift (k8s-bigip-ctlr) log files may contain BIG-IP secrets such as SSL Private Keys and Private key Passphrases as provided as inputs by an AS3 Declaration.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: F5 Container Ingress Service
Published: 2019-09-04T15:49:06.000Z
CVE-2019-6649 
F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings.
Problem types: description: Information Disclosure and Unauthorized Access
Affected products: vendor: F5 Networks
product: BIG-IP, Enterprise Manager
Published: 2019-09-20T19:52:39.000Z
CVE-2019-6650 
F5 BIG-IP ASM 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 may expose sensitive information and allow the system configuration to be modified when using non-default settings.
Problem types: description: Information Disclosure and Unauthorized Access
Affected products: vendor: F5 Networks
product: BIG-IP ASM
Published: 2019-09-20T19:47:18.000Z
CVE-2019-6651 
In BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.5.1-11.6.4, BIG-IQ 7.0.0, 6.0.0-6.1.0,5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, the Configuration utility login page may not follow best security practices when handling a malicious request.
Problem types: description: Oracle
Affected products: vendor: n/a
product: BIG-IP, BIG-IQ, iWorkflow, Enterprise Manager
Published: 2019-09-25T17:39:36.000Z
CVE-2019-6652 
In BIG-IQ 6.0.0-6.1.0, services for stats do not require authentication nor do they implement any form of Transport Layer Security (TLS).
Problem types: description: Information leakage
Affected products: vendor: n/a
product: BIG-IQ
Published: 2019-09-25T17:55:56.000Z
CVE-2019-6653 
There is a Stored Cross Site Scripting vulnerability in the undisclosed page of a BIG-IQ 6.0.0-6.1.0 or 5.2.0-5.4.0 system. The attack can be stored by users granted the Device Manager and Administrator roles.
Problem types: description: XSS
Affected products: vendor: n/a
product: BIG-IQ
Published: 2019-09-25T18:00:09.000Z
CVE-2019-6654 
On versions 14.0.0-14.1.2, 13.0.0-13.1.3, 12.1.0-12.1.5, and 11.5.1-11.6.5, the BIG-IP system fails to perform Martian Address Filtering (As defined in RFC 1812 section 5.3.7) on the control plane (management interface). This may allow attackers on an adjacent system to force BIG-IP into processing packets with spoofed source addresses.
Problem types: description: Unauthorized access
Affected products: vendor: n/a
product: BIG-IP
Published: 2019-09-25T18:57:48.000Z
CVE-2019-6655 
On versions 13.0.0-13.1.0.1, 12.1.0-12.1.4.1, 11.6.1-11.6.4, and 11.5.1-11.5.9, BIG-IP platforms where AVR, ASM, APM, PEM, AFM, and/or AAM is provisioned may leak sensitive data.
Problem types: description: Information leakage
Affected products: vendor: n/a
product: BIG-IP AVR, ASM, APM, PEM, AFM, and/or AAM
Published: 2019-09-25T19:00:43.000Z
CVE-2019-6656 
BIG-IP APM Edge Client before version 7.1.8 (7180.2019.508.705) logs the full apm session ID in the log files. Vulnerable versions of the client are bundled with BIG-IP APM versions 15.0.0-15.0.1, 14,1.0-14.1.0.6, 14.0.0-14.0.0.4, 13.0.0-13.1.1.5, 12.1.0-12.1.5, and 11.5.1-11.6.5. In BIG-IP APM 13.1.0 and later, the APM Clients components can be updated independently from BIG-IP software. Client version 7.1.8 (7180.2019.508.705) and later has the fix.
Problem types: description: Information disclosure.
Affected products: vendor: n/a
product: BIG-IP APM Edge Client
Published: 2019-09-25T19:03:32.000Z
CVE-2019-6657 
On BIG-IP 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, a reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the BIG-IP Configuration utility.
Problem types: description: XSS
Affected products: vendor: F5
product: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator)
Published: 2019-11-01T14:53:06.000Z
CVE-2019-6658 
On BIG-IP AFM 15.0.0-15.0.1, 14.0.0-14.1.2, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, a vulnerability in the AFM configuration utility may allow any authenticated BIG-IP user to run an SQL injection attack.
Problem types: description: SQL Injection
Affected products: vendor: F5
product: BIG-IP (AFM)
Published: 2019-11-01T14:59:18.000Z
CVE-2019-6659 
On version 14.0.0-14.1.0.1, BIG-IP virtual servers with TLSv1.3 enabled may experience a denial of service due to undisclosed incoming messages.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2019-11-15T20:27:10.000Z
CVE-2019-6660 
On BIG-IP 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.1, undisclosed HTTP requests may consume excessive amounts of systems resources which may lead to a denial of service.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2019-11-15T20:31:33.000Z
CVE-2019-6661 
When the BIG-IP APM 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.4.1, or 11.5.1-11.6.5 system processes certain requests, the APD/APMD daemon may consume excessive resources.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP APM
Published: 2019-11-15T20:35:37.000Z
CVE-2019-6662 
On BIG-IP 13.1.0-13.1.1.4, sensitive information is logged into the local log files and/or remote logging targets when restjavad processes an invalid request. Users with access to the log files would be able to view that data.
Problem types: description: Confidentiality Breach
Affected products: vendor: n/a
product: BIG-IP
Published: 2019-11-15T20:45:17.000Z
CVE-2019-6663 
The BIG-IP 15.0.0-15.0.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1 configuration utility is vulnerable to Anti DNS Pinning (DNS Rebinding) attack.
Problem types: description: Anti DNS Pinning (DNS Rebinding)
Affected products: vendor: n/a
product: BIG-IP, BIG-IQ, iWorkflow, Enterprise Manager
Published: 2019-11-15T20:40:26.000Z
CVE-2019-6664 
On BIG-IP 15.0.0 and 14.1.0-14.1.0.6, under certain conditions, network protections on the management port do not follow current best practices.
Problem types: description: Information Leakage
Affected products: vendor: n/a
product: BIG-IP
Published: 2019-11-15T20:48:08.000Z
CVE-2019-6665 
On BIG-IP ASM 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, BIG-IQ 6.0.0 and 5.2.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, an attacker with access to the device communication between the BIG-IP ASM Central Policy Builder and the BIG-IQ/Enterprise Manager/F5 iWorkflow will be able to set up the proxy the same way and intercept the traffic.
Problem types: description: Data injection
Affected products: vendor: F5
product: BIG-IP ASM
vendor: F5
product: BIG-IQ
vendor: F5
product: IWorkflow
vendor: F5
product: Enterprise Manager
Published: 2019-11-27T21:57:58.000Z
CVE-2019-6666 
On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, and 13.1.0-13.1.1.4, the TMM process may produce a core file when an upstream server or cache sends the BIG-IP an invalid age header value.
Problem types: description: DoS
Affected products: vendor: F5
product: BIG-IP
Published: 2019-11-27T21:54:09.000Z
CVE-2019-6667 
On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.5.1-11.6.5, under certain conditions, TMM may consume excessive resources when processing traffic for a Virtual Server with the FIX (Financial Information eXchange) profile applied.
Problem types: description: DoS
Affected products: vendor: F5
product: BIG-IP
Published: 2019-11-27T21:51:43.000Z
CVE-2019-6668 
The BIG-IP APM Edge Client for macOS bundled with BIG-IP APM 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.5, and 11.5.1-11.6.5 may allow unprivileged users to access files owned by root.
Problem types: description: Privilege escalation
Affected products: vendor: F5
product: BIG-IP APM Edge Client
Published: 2019-11-27T21:47:22.000Z
CVE-2019-6669 
On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, undisclosed traffic flow may cause TMM to restart under some circumstances.
Problem types: description: DoS
Affected products: vendor: F5
product: BIG-IP
Published: 2019-11-27T21:44:38.000Z
CVE-2019-6670 
On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5, vCMP hypervisors are incorrectly exposing the plaintext unit key for their vCMP guests on the filesystem.
Problem types: description: Information disclosure
Affected products: vendor: F5
product: BIG-IP
Published: 2019-11-27T21:35:35.000Z
CVE-2019-6671 
On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, under certain conditions tmm may leak memory when processing packet fragments, leading to resource starvation.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2019-11-27T21:41:34.000Z
CVE-2019-6672 
On BIG-IP AFM 15.0.0-15.0.1, 14.0.0-14.1.2, and 13.1.0-13.1.3.1, when bad-actor detection is configured on a wildcard virtual server on platforms with hardware-based sPVA, the performance of the BIG-IP AFM system is degraded.
Problem types: description: DoS
Affected products: vendor: F5
product: BIG-IP AFM
Published: 2019-11-27T21:38:16.000Z
CVE-2019-6673 
On versions 15.0.0-15.0.1 and 14.0.0-14.1.2, when the BIG-IP is configured in HTTP/2 Full Proxy mode, specifically crafted requests may cause a disruption of service provided by the Traffic Management Microkernel (TMM).
Problem types: description: DoS
Affected products: vendor: F5
product: BIG-IP
Published: 2019-11-27T21:30:34.000Z
CVE-2019-6674 
On F5 SSL Orchestrator 15.0.0-15.0.1 and 14.0.0-14.1.2, TMM may crash when processing SSLO data in a service-chaining configuration.
Problem types: description: DoS
Affected products: vendor: F5
product: SSL Orchestrator
Published: 2019-11-27T21:00:11.000Z
CVE-2019-6675 
BIG-IP configurations using Active Directory, LDAP, or Client Certificate LDAP for management authentication with multiple servers are exposed to a vulnerability which allows an authentication bypass. This can result in a complete compromise of the system. This issue only impacts specific engineering hotfixes using the aforementioned authentication configuration. NOTE: This vulnerability does not affect any of the BIG-IP major, minor or maintenance releases you obtained from downloads.f5.com. The affected Engineering Hotfix builds are as follows: Hotfix-BIGIP-14.1.0.3.0.79.6-ENG.iso, Hotfix-BIGIP-14.1.0.3.0.97.6-ENG.iso, Hotfix-BIGIP-14.1.0.3.0.99.6-ENG.iso, Hotfix-BIGIP-14.1.0.5.0.15.5-ENG.iso, Hotfix-BIGIP-14.1.0.5.0.36.5-ENG.iso, Hotfix-BIGIP-14.1.0.5.0.40.5-ENG.iso, Hotfix-BIGIP-14.1.0.6.0.11.9-ENG.iso, Hotfix-BIGIP-14.1.0.6.0.14.9-ENG.iso, Hotfix-BIGIP-14.1.0.6.0.68.9-ENG.iso, Hotfix-BIGIP-14.1.0.6.0.70.9-ENG.iso, Hotfix-BIGIP-14.1.2.0.11.37-ENG.iso, Hotfix-BIGIP-14.1.2.0.18.37-ENG.iso, Hotfix-BIGIP-14.1.2.0.32.37-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.46.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.14.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.16.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.34.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.97.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.99.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.105.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.111.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.115.4-ENG.iso, Hotfix-BIGIP-14.1.2.1.0.122.4-ENG.iso, Hotfix-BIGIP-15.0.1.0.33.11-ENG.iso, Hotfix-BIGIP-15.0.1.0.48.11-ENG.iso
Problem types: description: Authentication Bypass
Affected products: vendor: n/a
product: BIG-IP
Published: 2019-11-26T14:49:31.000Z
CVE-2019-6676 
On versions 15.0.0-15.0.1, 14.0.0-14.1.2.2, and 13.1.0-13.1.3.1, TMM may restart on BIG-IP Virtual Edition (VE) when using virtio direct descriptors and packets 2 KB or larger.
Problem types: description: DoS
Affected products: vendor: F5
product: BIG-IP
Published: 2019-12-23T16:41:06.000Z
CVE-2019-6677 
On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, under certain conditions when using custom TCP congestion control settings in a TCP profile, TMM stops processing traffic when processed by an iRule.
Problem types: description: DoS
Affected products: vendor: F5
product: BIG-IP
Published: 2019-12-23T16:50:26.000Z
CVE-2019-6678 
On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, the TMM process may restart when the packet filter feature is enabled.
Problem types: description: DoS
Affected products: vendor: F5
product: BIG-IP
Published: 2019-12-23T16:57:49.000Z
CVE-2019-6679 
On BIG-IP versions 15.0.0-15.0.1, 14.1.0.2-14.1.2.2, 14.0.0.5-14.0.1, 13.1.1.5-13.1.3.1, 12.1.4.1-12.1.5, 11.6.4-11.6.5, and 11.5.9-11.5.10, the access controls implemented by scp.whitelist and scp.blacklist are not properly enforced for paths that are symlinks. This allows authenticated users with SCP access to overwrite certain configuration files that would otherwise be restricted.
Problem types: description: DoS
Affected products: vendor: F5
product: BIG-IP
Published: 2019-12-23T17:06:16.000Z
CVE-2019-6680 
On BIG-IP versions 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5, while processing traffic through a standard virtual server that targets a FastL4 virtual server (VIP on VIP), hardware appliances may stop responding.
Problem types: description: DoS
Affected products: vendor: F5
product: BIG-IP
Published: 2019-12-23T17:18:32.000Z
CVE-2019-6681 
On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, a memory leak in Multicast Forwarding Cache (MFC) handling in tmrouted.
Problem types: description: DoS
Affected products: vendor: F5
product: BIG-IP
Published: 2019-12-23T17:10:07.000Z
CVE-2019-6682 
On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, the BIG-IP ASM system may consume excessive resources when processing certain types of HTTP responses from the origin web server. This vulnerability is only known to affect resource-constrained systems in which the security policy is configured with response-side features, such as Data Guard or response-side learning.
Problem types: description: DoS
Affected products: vendor: F5
product: BIG-IP ASM
Published: 2019-12-23T16:54:57.000Z
CVE-2019-6683 
On versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IP virtual servers with Loose Initiation enabled on a FastL4 profile may be subject to excessive flow usage under undisclosed conditions.
Problem types: description: DoS
Affected products: vendor: F5
product: BIG-IP Virtual Edition
Published: 2019-12-23T17:01:24.000Z
CVE-2019-6684 
On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, under certain conditions, a multi-bladed BIG-IP Virtual Clustered Multiprocessing (vCMP) may drop broadcast packets when they are rebroadcast to the vCMP guest secondary blades. An attacker can leverage the fragmented broadcast IP packets to perform any type of fragmentation-based attack.
Problem types: description: DoS
Affected products: vendor: F5
product: BIG-IP
Published: 2019-12-23T17:23:13.000Z
CVE-2019-6685 
On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, users with access to edit iRules are able to create iRules which can lead to an elevation of privilege, configuration modification, and arbitrary system command execution.
Problem types: description: Privilege escalation
Affected products: vendor: F5
product: BIG-IP
Published: 2019-12-23T17:30:59.000Z
CVE-2019-6686 
On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, the Traffic Management Microkernel (TMM) might stop responding after the total number of diameter connections and pending messages on a single virtual server has reached 32K.
Problem types: description: DoS
Affected products: vendor: F5
product: BIG-IP
Published: 2019-12-23T17:14:27.000Z
CVE-2019-6687 
On versions 15.0.0-15.0.1.1, the BIG-IP ASM Cloud Security Services profile uses a built-in verification mechanism that fails to properly authenticate the X.509 certificate of remote endpoints.
Problem types: description: MitM
Affected products: vendor: F5
product: BIG-IP ASM
Published: 2019-12-23T17:46:20.000Z
CVE-2019-6688 
On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5 and BIG-IQ versions 6.0.0-6.1.0 and 5.2.0-5.4.0, a user is able to obtain the secret that was being used to encrypt a BIG-IP UCS backup file while sending SNMP query to the BIG-IP or BIG-IQ system, however the user can not access to the UCS files.
Problem types: description: Information disclosure
Affected products: vendor: F5
product: BIG-IP
vendor: F5
product: BIG-IQ
Published: 2019-12-23T17:58:55.000Z
CVE-2019-6689 
An issue was discovered in Dillon Kane Tidal Workload Automation Agent 3.2.0.5 (formerly known as Cisco Workload Automation or CWA). The Enterprise Scheduler for AIX allows local users to gain privileges via Command Injection in crafted Tidal Job Buffers (TJB) parameters. NOTE: this vulnerability exists because the CVE-2014-3272 solution did not address AIX operating systems.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-04-26T18:37:09.000Z
CVE-2019-6690 
python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T17:02:07.000Z
CVE-2019-6691 
phpwind 9.0.2.170426 UTF8 allows SQL Injection via the admin.php?m=backup&c=backup&a=doback tabledb[] parameter, related to the "--backup database" option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-23T09:00:00.000Z
CVE-2019-6692 
A malicious DLL preload vulnerability in Fortinet FortiClient for Windows 6.2.0 and below allows a privileged attacker to perform arbitrary code execution via forging that DLL.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: n/a
product: Fortinet FortiClient for Windows
Published: 2019-10-24T13:46:16.000Z
CVE-2019-6693 
Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data includes users' passwords (except the administrator's password), private keys' passphrases and High Availability password (when set).
Problem types: description: Information disclosure
Affected products: vendor: Fortinet
product: FortiGate
Published: 2019-11-21T15:08:05.000Z
CVE-2019-6695 
Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-party programs by recreating the image through specific methods.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: n/a
product: Fortinet FortiManager
Published: 2019-08-23T20:07:33.000Z
CVE-2019-6696 
An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may allow an attacker to perform an URL redirect attack via a specifically crafted request to the admin initial password change webpage.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiOS
Published: 2020-03-15T22:03:22.000Z
CVE-2019-6697 
An Improper Neutralization of Input vulnerability affecting FortiGate version 6.2.0 through 6.2.1, 6.0.0 through 6.0.6 in the hostname parameter of a DHCP packet under DHCP monitor page may allow an unauthenticated attacker in the same network as the FortiGate to perform a Stored Cross Site Scripting attack (XSS) by sending a crafted DHCP packet.
Problem types: cwe_id: CWE-79
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiOS
cpes: cpe:2.3:o:fortinet:fortios:6.2.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:6.2.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:X/RC:X
Published: 2025-03-17T13:40:57.520Z
CVE-2019-6698 
Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated attacker with knowledge of the aforementioned credentials and network access to FortiCameras to take control of those, provided they are managed by a FortiRecorder device.
Problem types: description: Authentication Controls Bypass
Affected products: vendor: n/a
product: Fortinet FortiRecorder
Published: 2019-08-23T19:58:39.000Z
CVE-2019-6699 
An improper neutralization of input vulnerability in Fortinet FortiADC 5.3.3 and earlier may allow an attacker to execute a stored Cross Site Scripting (XSS) via a field in the traffic group interface.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiADC
Published: 2020-03-13T15:06:42.000Z
CVE-2019-6700 
An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated attacker to retrieve the external authentication password via the HTML source code.
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Fortinet FortiSIEM
Published: 2020-01-07T18:19:04.000Z
CVE-2019-6702 
The MasterCard Qkr! app before 5.0.8 for iOS has Missing SSL Certificate Validation. NOTE: this CVE only applies to obsolete versions from 2016 or earlier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-03-17T17:13:13.000Z
CVE-2019-6703 
Incorrect access control in migla_ajax_functions.php in the Calmar Webmedia Total Donations plugin through 2.0.5 for WordPress allows unauthenticated attackers to update arbitrary WordPress option values, leading to site takeover. These attackers can send requests to wp-admin/admin-ajax.php to call the miglaA_update_me action to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-01-27T02:00:00.000Z