rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-43043 
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files such as /etc/shadow by abusing an insecure Sudo rule.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-06T00:00:00.000Z
CVE-2021-43044 
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The SNMP daemon was configured with a weak default community.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-06T00:00:00.000Z
CVE-2021-43045 Possible DOS vulnerabilities in C# Avro SDK
A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue.
Problem types: cwe_id: CWE-770
description: CWE-770
Affected products: vendor: Apache Software Foundation
product: Apache Avro
Credits: lang: en
value: Apache Avro would like to thank Philip Sanetra for reporting this issue.
Published: 2022-01-06T18:00:12.000Z
CVE-2021-43046 TIBCO PartnerExpress Session Token in URL
The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain an easily exploitable vulnerability that allows an unauthenticated attacker with network access to obtain session tokens for the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO PartnerExpress: versions 6.2.1 and below.
Problem types: description: In the worst case, if the victim is a privileged administrator, successful execution of this vulnerability can result in an attacker gaining full administrative access to the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO PartnerExpress
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-11-16T17:50:10.945Z
CVE-2021-43047 TIBCO PartnerExpress Cross Site Scripting vulnerabilities
The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain easily exploitable Stored and Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim's local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO PartnerExpress: versions 6.2.1 and below.
Problem types: description: In the worst case, if the victim is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the affected system or the victim's local system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO PartnerExpress
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2021-11-16T17:50:12.472Z
CVE-2021-43048 TIBCO PartnerExpress Click-Jacking vulnerability
The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain a vulnerability that theoretically allows an unauthenticated attacker with network access to execute a clickjacking attack on the affected system. A successful attack using this vulnerability does not require human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO PartnerExpress: versions 6.2.1 and below.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that an attacker gains full administrative access to the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO PartnerExpress
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-11-16T17:50:14.025Z
CVE-2021-43049 TIBCO BusinessConnect Container Edition username and password leakage
The Database component of TIBCO Software Inc.'s TIBCO BusinessConnect Container Edition contains an easily exploitable vulnerability that allows an unauthenticated attacker with network access to obtain the usernames and passwords of users of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect Container Edition: versions 1.1.0 and below.
Problem types: description: In the worst case, if the victim is a privileged administrator, successful execution of this vulnerability can result in an attacker gaining full administrative access to the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO BusinessConnect Container Edition
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-02-15T17:55:11.326Z
CVE-2021-43050 TIBCO BusinessConnect Container Edition administrative username and passwords leakage
The Auth Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Container Edition contains an easily exploitable vulnerability that allows an unauthenticated attacker with local access to obtain administrative usernames and passwords for the affected system. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect Container Edition: versions 1.1.0 and below.
Problem types: description: Successful execution of this vulnerability can result in an attacker gaining full administrative access to the components of the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO BusinessConnect Container Edition
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-02-15T17:55:12.755Z
CVE-2021-43051 TIBCO Spotfire Server API Authorization Vulnerability
The Spotfire Server component of TIBCO Software Inc.'s TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows malicious custom API clients with network access to execute internal API operations outside of the scope of those granted to it. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Server: versions 10.10.6 and below, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.4.0, and 11.4.1, and TIBCO Spotfire Server: versions 11.5.0 and 11.6.0.
Problem types: description: In the worst case, if the user is a privileged administrator, successful execution of these vulnerabilities can result in an attacker gaining full administrative access to the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Spotfire Server
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Server
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Server
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2021-12-14T19:20:10.307Z
CVE-2021-43052 TIBCO FTL Secret Generation Vulnerability
The Realm Server component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains an easily exploitable vulnerability that allows authentication bypass due to a hard coded secret used in the default realm server of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.7.2 and below, TIBCO FTL - Developer Edition: versions 6.7.2 and below, and TIBCO FTL - Enterprise Edition: versions 6.7.2 and below.
Problem types: description: Successful execution of this vulnerability can result in an attacker gaining full access to communication on an existing eFTL channel on the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO FTL - Community Edition
vendor: TIBCO Software Inc.
product: TIBCO FTL - Developer Edition
vendor: TIBCO Software Inc.
product: TIBCO FTL - Enterprise Edition
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
version: 3.1
Published: 2022-01-11T18:25:24.808Z
CVE-2021-43053 TIBCO FTL Secret Exposure Vulnerability
The Realm Server component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains a difficult to exploit vulnerability that allows an unauthenticated attacker with network access to obtain the cluster secret of another application connected to the realm server. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.7.2 and below, TIBCO FTL - Developer Edition: versions 6.7.2 and below, and TIBCO FTL - Enterprise Edition: versions 6.7.2 and below.
Problem types: description: Successful execution of this vulnerability can result in an attacker gaining full access to communication on an existing eFTL channel on the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO FTL - Community Edition
vendor: TIBCO Software Inc.
product: TIBCO FTL - Developer Edition
vendor: TIBCO Software Inc.
product: TIBCO FTL - Enterprise Edition
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
version: 3.1
Published: 2022-01-11T18:25:26.263Z
CVE-2021-43054 TIBCO eFTL Token Generation Vulnerability
The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to generate API tokens that can access any other channel with arbitrary permissions. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below.
Problem types: description: Successful execution of this vulnerability can result in an attacker gaining full access to communication on an existing channel on the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO eFTL - Community Edition
vendor: TIBCO Software Inc.
product: TIBCO eFTL - Developer Edition
vendor: TIBCO Software Inc.
product: TIBCO eFTL - Enterprise Edition
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2022-01-11T18:25:27.550Z
CVE-2021-43055 TIBCO eFTL Token Caching Vulnerability
The eFTL Server component of TIBCO Software Inc.'s TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, and TIBCO eFTL - Enterprise Edition contains an easily exploitable vulnerability that allows clients to inherit the permissions of the client that initially connected on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO eFTL - Community Edition: versions 6.7.2 and below, TIBCO eFTL - Developer Edition: versions 6.7.2 and below, and TIBCO eFTL - Enterprise Edition: versions 6.7.2 and below.
Problem types: description: Successful execution of this vulnerability can result in an attacker gaining full access to communication on an existing channel on the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO eFTL - Community Edition
vendor: TIBCO Software Inc.
product: TIBCO eFTL - Developer Edition
vendor: TIBCO Software Inc.
product: TIBCO eFTL - Enterprise Edition
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
version: 3.1
Published: 2022-01-11T18:25:28.892Z
CVE-2021-43056 
An issue was discovered in the Linux kernel for powerpc before 5.14.15. It allows a malicious KVM guest to crash the host, when the host is running on Power8, due to an arch/powerpc/kvm/book3s_hv_rmhandlers.S implementation bug in the handling of the SRR1 register values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-28T03:13:44.000Z
CVE-2021-43057 
An issue was discovered in the Linux kernel before 5.14.8. A use-after-free in selinux_ptrace_traceme (aka the SELinux handler for PTRACE_TRACEME) could be used by local attackers to cause memory corruption and escalate privileges, aka CID-a3727a8bac0a. This occurs because of an attempt to access the subjective credentials of another task.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-28T03:36:24.000Z
CVE-2021-43058 
An open redirect vulnerability exists in Replicated Classic versions prior to 2.53.1 that could lead to spoofing. To exploit this vulnerability, an attacker could send a link that has a specially crafted URL and convince the user to click the link, redirecting the user to an untrusted site.
Problem types: description: URL redirection to untrusted site (“Open Redirect”).
Affected products: vendor: n/a
product: REPLICATED CLASSIC
Published: 2021-11-01T21:03:18.000Z
CVE-2021-43062 
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the FortiGuard URI protection service.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiMail
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: CONFIRMED
scope: CHANGED
temporalScore: 5.8
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:X/RC:C
version: 3.1
Published: 2022-02-02T11:08:07.000Z
CVE-2021-43063 
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the login webpage.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiWeb
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: NONE
remediationLevel: NOT_DEFINED
reportConfidence: CONFIRMED
scope: CHANGED
temporalScore: 5.8
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:X/RC:C
version: 3.1
Published: 2021-12-08T13:16:29.000Z
CVE-2021-43064 
A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to use the device as a proxy and reach external or protected hosts via redirection handlers.
Problem types: description: Improper access control
Affected products: vendor: Fortinet
product: Fortinet FortiWeb
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 4.1
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C
version: 3.1
Published: 2021-12-08T12:33:18.000Z
CVE-2021-43065 
A incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version 9.1.3 and below, version 8.8.9 and below allows attacker to gain higher privileges via the access to sensitive system data.
Problem types: description: Escalation of privilege
Affected products: vendor: Fortinet
product: Fortinet FortiNAC
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: FUNCTIONAL
integrityImpact: HIGH
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 7.6
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C
version: 3.1
Published: 2021-12-09T09:15:04.000Z
CVE-2021-43066 
A external control of file name or path in Fortinet FortiClientWindows version 7.0.2 and below, version 6.4.6 and below, version 6.2.9 and below, version 6.0.10 and below allows attacker to escalate privilege via the MSI installer.
Problem types: description: Escalation of privilege
Affected products: vendor: Fortinet
product: Fortinet FortiClientWindows
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: NONE
exploitCodeMaturity: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: CHANGED
temporalScore: 8.4
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H/E:H/RL:U/RC:C
version: 3.1
Published: 2022-05-11T15:40:10.000Z
CVE-2021-43067 
A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.2 and below, version 6.2.1 and below, version 6.1.2 and below, version 6.0.7 to 6.0.1 allows attacker to duplicate a target LDAP user 2 factors authentication token via crafted HTTP requests.
Problem types: description: Improper access control
Affected products: vendor: Fortinet
product: Fortinet FortiAuthenticator
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: HIGH
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: CHANGED
temporalScore: 7.9
temporalSeverity: HIGH
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L/E:P/RL:X/RC:X
version: 3.1
Published: 2021-12-08T11:22:39.000Z
CVE-2021-43068 
A improper authentication in Fortinet FortiAuthenticator version 6.4.0 allows user to bypass the second factor of authentication via a RADIUS login portal.
Problem types: description: Improper access control
Affected products: vendor: Fortinet
product: Fortinet FortiAuthenticator
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: UNCHANGED
temporalScore: 5.1
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:X/RC:X
version: 3.1
Published: 2021-12-09T09:38:37.000Z
CVE-2021-43070 
Multiple relative path traversal vulnerabilities [CWE-23] in FortiWLM management interface 8.6.2 and below, 8.5.2 and below, 8.4.2 and below, 8.3.3 and below, 8.2.2 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests.
Problem types: description: Information disclosure
Affected products: vendor: Fortinet
product: Fortinet FortiWLM
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
exploitCodeMaturity: FUNCTIONAL
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 5.3
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:F/RL:U/RC:C
version: 3.1
Published: 2022-03-02T16:35:22.000Z
CVE-2021-43071 
A heap-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the LogReport API controller.
Problem types: description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: Fortinet FortiWeb
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.3
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C
version: 3.1
Published: 2021-12-09T09:18:03.000Z
CVE-2021-43073 
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
exploitCodeMaturity: PROOF_OF_CONCEPT
integrityImpact: HIGH
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 8.3
temporalSeverity: HIGH
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C
version: 3.1
Published: 2022-02-02T11:01:34.000Z