rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-45832 WordPress Attorney theme <= 3 - Unauth. Arbitrary Content Deletion vulnerability
Missing Authorization vulnerability in Hennessey Digital Attorney.This issue affects Attorney: from n/a through 3.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Hennessey Digital
product: Attorney
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Dave Jong (Patchstack)
Published: 2024-06-19T14:32:28.362Z
CVE-2022-45833 WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Directory Traversal
Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: WPecommerce, Alexanderfoxc
product: Easy WP SMTP
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Tomasz Staszyszyn (Patchstack Alliance)
Published: 2022-12-06T21:44:04.790Z
CVE-2022-45835 WordPress PhonePe Payment Solutions Plugin <= 1.0.15 is vulnerable to Server Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) vulnerability in PhonePe PhonePe Payment Solutions.This issue affects PhonePe Payment Solutions: from n/a through 1.0.15.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: PhonePe
product: PhonePe Payment Solutions
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Aman Rawat (Patchstack Alliance)
Published: 2023-11-13T03:06:01.113Z
CVE-2022-45836 WordPress Download Manager Plugin <= 3.2.59 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in W3 Eden, Inc. Download Manager plugin <= 3.2.59 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: W3 Eden, Inc.
product: Download Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Rafie Muhammad (Patchstack)
Published: 2023-04-18T13:58:06.312Z
CVE-2022-45837 WordPress 微信机器人高级版 Plugin <= 6.0.1 is vulnerable to Cross Site Scripting (XSS)
Reflected Cross-Site Scripting (XSS) vulnerability in Denis 微信机器人高级版 plugin <= 6.0.1 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Denis
product: 微信机器人高级版
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: minhtuanact (Patchstack Alliance)
Published: 2023-04-25T11:27:00.720Z
CVE-2022-45838 WordPress ARForms Form Builder Plugin <= 1.5.5 is vulnerable to Cross Site Scripting (XSS)
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARForms Form Builder plugin <= 1.5.5 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Repute InfoSystems
product: ARForms Form Builder
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: thiennv (Patchstack Alliance)
Published: 2023-04-18T12:11:08.609Z
CVE-2022-45839 WordPress WHA Puzzle Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WHA WHA Puzzle plugin <= 1.0.9 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: WHA
product: WHA Puzzle
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: thiennv (Patchstack Alliance)
Published: 2023-04-18T12:33:16.697Z
CVE-2022-45840 WordPress Auto Affiliate Links plugin <= 6.2.1.5 - Unauth. Broken Access Control vulnerability
Missing Authorization vulnerability in Lucian Apostol Auto Affiliate Links allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Affiliate Links: from n/a through 6.2.1.5.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Lucian Apostol
product: Auto Affiliate Links
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Nguyen Anh Tien (Patchstack Alliance)
Published: 2024-12-13T14:22:04.745Z
CVE-2022-45841 WordPress Robo Gallery plugin <= 3.2.9 - Auth. Broken Access Control vulnerability
Missing Authorization vulnerability in RoboSoft Robo Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Robo Gallery: from n/a through 3.2.9.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: RoboSoft
product: Robo Gallery
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Nguyen Anh Tien (Patchstack Alliance)
Published: 2024-12-13T14:22:05.446Z
CVE-2022-45842 WordPress WP ULike Plugin <= 4.6.4 is vulnerable to Race Condition vulnerability
Unauth. Race Condition vulnerability in WP ULike Plugin <= 4.6.4 on WordPress allows attackers to increase/decrease rating scores.
Problem types: cwe_id: CWE-367
description: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: TechnoWich
product: WP ULike (WordPress plugin)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: minhtuanact (Patchstack Alliance)
Published: 2022-11-30T12:40:05.000Z
CVE-2022-45843 WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Nextend Smart Slider 3 plugin <= 3.5.1.9 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Nextend
product: Smart Slider 3
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: FearZzZz (Patchstack Alliance)
Published: 2023-03-23T11:28:31.187Z
CVE-2022-45845 WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to PHP Object Injection
Deserialization of Untrusted Data vulnerability in Nextend Smart Slider 3.This issue affects Smart Slider 3: from n/a through 3.5.1.9.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Nextend
product: Smart Slider 3
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Dave Jong (Patchstack)
Published: 2024-01-19T14:42:11.441Z
CVE-2022-45846 WordPress Image Map Pro Plugin < 5.6.9 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro for WordPress - Interactive SVG Image Map Builder plugin < 5.6.9 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Nickys
product: Image Map Pro for WordPress - Interactive SVG Image Map Builder
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Dave Jong (Patchstack)
Published: 2023-05-10T11:08:50.564Z
CVE-2022-45847 WordPress Countdown Widget plugin <= 3.1.9.1 - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS)
Cross-Site Request Forgery (CSRF) vulnerability in WPAssist.Me WordPress Countdown Widget allows Cross-Site Scripting (XSS).This issue affects WordPress Countdown Widget: from n/a through 3.1.9.1.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: WPAssist.me
product: WordPress Countdown Widget
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Rasi Afeef (Patchstack Alliance)
Published: 2024-03-27T13:48:22.956Z
CVE-2022-45848 WordPress Contest Gallery Plugin <= 13.1.0.9 is vulnerable to Cross Site Scripting (XSS)
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 13.1.0.9 on WordPress.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Contest Gallery
product: Contest Gallery
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: thiennv (Patchstack Alliance)
Published: 2022-12-06T20:59:46.290Z
CVE-2022-45849 WordPress Activello Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)
Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Silkalns Activello theme <= 1.4.4 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Silkalns
product: Activello
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Brandon Roldan (Patchstack Alliance)
Published: 2023-04-16T08:42:05.389Z
CVE-2022-45850 WordPress Image Map Pro premium plugin < 5.6.9 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS)
Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro allows Stored XSS.This issue affects Image Map Pro: from n/a before 5.6.9.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Nickys
product: Image Map Pro
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Dave Jong (Patchstack)
Published: 2024-03-28T06:55:14.584Z
CVE-2022-45851 WordPress ShareThis Dashboard for Google Analytics plugin <= 3.1.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in ShareThis ShareThis Dashboard for Google Analytics.This issue affects ShareThis Dashboard for Google Analytics: from n/a through 3.1.4.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: ShareThis
product: ShareThis Dashboard for Google Analytics
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Dave Jong (Patchstack)
Published: 2024-03-25T11:30:01.903Z
CVE-2022-45852 WordPress WP-FormAssembly plugin <= 2.0.5 - Auth. Arbitrary File Read vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in FormAssembly / Drew Buschhorn WP-FormAssembly allows Path Traversal.This issue affects WP-FormAssembly: from n/a through 2.0.5.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: FormAssembly / Drew Buschhorn
product: WP-FormAssembly
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Tien Nguyen Anh (Patchstack Alliance)
Published: 2024-04-24T10:46:01.860Z
CVE-2022-45853 
The privilege escalation vulnerability in the Zyxel GS1900-8 firmware version 

V2.70(AAHH.3) and the GS1900-8HP firmware version V2.70(AAHI.3) could allow an authenticated, local attacker with administrator privileges to execute some system commands as 'root' on a vulnerable device via SSH.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Zyxel
product: GS1900-8HP firmware
default_status: unaffected
vendor: Zyxel
product: GS1900-8 firmware
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-05-30T10:02:46.637Z
CVE-2022-45854 
An improper check for unusual conditions in Zyxel NWA110AX firmware verisons prior to 6.50(ABTG.0)C0, which could allow a LAN attacker to cause a temporary denial-of-service (DoS) by sending crafted VLAN frames if the MAC address of the vulnerable AP were intercepted by the attacker.
Problem types: cwe_id: CWE-754
description: CWE-754: Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Zyxel
product: NWA110AX firmware
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2023-02-07T00:00:00.000Z
CVE-2022-45855 Apache Ambari: Allows authenticated metrics consumers to perform RCE
SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.

Problem types: cwe_id: CWE-917
description: CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Affected products: vendor: Apache Software Foundation
product: Apache Ambari
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: rg <18993610179@163.com>
Published: 2023-07-12T09:59:44.492Z
CVE-2022-45856 
An improper certificate validation vulnerability [CWE-295] in FortiClientWindows 6.4 all versions, 7.0.0 through 7.0.7, FortiClientMac 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.4, FortiClientLinux 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.4, FortiClientAndroid 6.4 all versions, 7.0 all versions, 7.2.0 and FortiClientiOS 5.6 all versions, 6.0.0 through 6.0.1, 7.0.0 through 7.0.6 SAML SSO feature may allow an unauthenticated attacker to man-in-the-middle the communication between the FortiClient and  both the service provider and the identity provider.
Problem types: cwe_id: CWE-295
description: Information disclosure
Affected products: vendor: Fortinet
product: FortiClientiOS
cpes: cpe:2.3:a:fortinet:forticlientios:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:5.6.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:5.6.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:5.6.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:5.6.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:5.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:5.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:5.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:5.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:5.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:5.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:5.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:5.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:5.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:5.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:4.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:forticlientios:2.0.0:*:*:*:*:*:*:*
default_status: unaffected
vendor: Fortinet
product: FortiClientAndroid
default_status: unaffected
vendor: Fortinet
product: FortiClientMac
default_status: unaffected
vendor: Fortinet
product: FortiClientLinux
default_status: unaffected
vendor: Fortinet
product: FortiClientWindows
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:U/RC:C
Published: 2024-09-10T14:37:48.663Z
CVE-2022-45857 
An incorrect user management vulnerability [CWE-286] in the FortiManager version 6.4.6 and below VDOM creation component may allow an attacker to access a FortiGate without a password via newly created VDOMs after the super_admin account is deleted.
Problem types: cwe_id: CWE-286
description: Improper access control
Affected products: vendor: Fortinet
product: FortiManager
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:H/E:F/RL:O/RC:C
Published: 2023-01-05T07:37:57.731Z
CVE-2022-45858 
A use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all versions, 8.7.0 all versions may increase the chances of an attacker to have access to sensitive information or to perform man-in-the-middle attacks.
Problem types: cwe_id: CWE-327
description: Improper access control
Affected products: vendor: Fortinet
product: FortiNAC
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.8
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:U/RC:R
Published: 2023-05-03T21:26:54.032Z
CVE-2022-45859 
An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions, 8.7.0 all versions may allow a local attacker with system access to retrieve users' passwords.
Problem types: cwe_id: CWE-522
description: Improper access control
Affected products: vendor: Fortinet
product: FortiNAC
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N/E:F/RL:X/RC:R
Published: 2023-05-03T21:26:47.577Z