rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-37922 
Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the arbitrary write when triggered via the vcd2lxt2 conversion utility.
Problem types: cwe_id: CWE-118
description: CWE-118: Incorrect Access of Indexable Resource ('Range Error')
Affected products: vendor: GTKWave
product: GTKWave
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Claudio Bozzato of Cisco Talos.
Published: 2024-01-08T14:47:50.523Z
CVE-2023-37923 
Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. A specially crafted .vcd file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns the arbitrary write when triggered via the vcd2lxt conversion utility.
Problem types: cwe_id: CWE-118
description: CWE-118: Incorrect Access of Indexable Resource ('Range Error')
Affected products: vendor: GTKWave
product: GTKWave
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Credits: lang: en
value: Discovered by Claudio Bozzato of Cisco Talos.
Published: 2024-01-08T14:47:50.618Z
CVE-2023-37924 Apache Submarine: SQL injection from unauthorized login
Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login.
Now we have fixed this issue and now user must have the correct login to access workbench.
This issue affects Apache Submarine: from 0.7.0 before 0.8.0. We recommend that all submarine users with 0.7.0 upgrade to 0.8.0, which not only fixes the issue, supports the oidc authentication mode, but also removes the case of unauthenticated logins.
If using the version lower than 0.8.0 and not want to upgrade, you can try cherry-pick PR  https://github.com/apache/submarine/pull/1037 https://github.com/apache/submarine/pull/1054  and rebuild the submarine-server image to fix this.


Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Apache Software Foundation
product: Apache Submarine
default_status: unaffected
Credits: lang: en
value: lengjingqicai(棱镜七彩开源安全研究院)
Published: 2023-11-22T09:19:23.372Z
CVE-2023-37925 
An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, VPN series firmware versions 4.30 through 5.37, NWA50AX firmware version 6.29(ABYW.2), WAC500 firmware version 6.65(ABVS.1), WAX300H firmware version 6.60(ACHF.1), and WBE660S firmware version 6.65(ACGG.1), could allow an authenticated local attacker to access system files on an affected device.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Zyxel
product: ATP series firmware
default_status: unaffected
vendor: Zyxel
product: USG FLEX series firmware
default_status: unaffected
vendor: Zyxel
product: USG FLEX 50(W) series firmware
default_status: unaffected
vendor: Zyxel
product: USG20(W)-VPN series firmware
default_status: unaffected
vendor: Zyxel
product: VPN series firmware
default_status: unaffected
vendor: Zyxel
product: NWA50AX firmware
default_status: unaffected
vendor: Zyxel
product: WAC500 firmware
default_status: unaffected
vendor: Zyxel
product: WAX300H firmware
default_status: unaffected
vendor: Zyxel
product: WBE660S firmware
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-11-28T01:30:55.186Z
CVE-2023-37926 
A buffer overflow vulnerability in the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50(W) series firmware versions 4.16 through 5.37, USG20(W)-VPN series firmware versions 4.16 through 5.37, and VPN series firmware versions 4.30 through 5.37, could allow an authenticated local attacker to cause denial-of-service (DoS) conditions by executing the CLI command to dump system logs on an affected device.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Zyxel
product: ATP series firmware
default_status: unaffected
vendor: Zyxel
product: USG FLEX series firmware
default_status: unaffected
vendor: Zyxel
product: USG FLEX 50(W) series firmware
default_status: unaffected
vendor: Zyxel
product: USG20(W)-VPN series firmware
default_status: unaffected
vendor: Zyxel
product: VPN series firmware
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-11-28T01:37:19.483Z
CVE-2023-37927 
The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Zyxel
product: NAS326 firmware
default_status: unaffected
vendor: Zyxel
product: NAS542 firmware
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-11-30T01:34:28.528Z
CVE-2023-37928 
A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted URL to a vulnerable device.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Zyxel
product: NAS326 firmware
default_status: unaffected
vendor: Zyxel
product: NAS542 firmware
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-11-30T01:37:27.671Z
CVE-2023-37929 
The buffer overflow vulnerability in the CGI program of the VMG3625-T50B firmware version V5.50(ABPM.8)C0 could allow an authenticated remote attacker to cause denial of service (DoS) conditions by sending a crafted HTTP request to a vulnerable device.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Zyxel
product: V5.50(ABPM.8)C0 firmware
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-05-21T01:23:53.073Z
CVE-2023-37930 
Multiple issues including the use of uninitialized ressources [CWE-908] and excessive iteration [CWE-834] vulnerabilities vulnerability in Fortinet  allows a VPN user to corrupt memory potentially leading to code or commands execution via specifically crafted requests.
Problem types: cwe_id: CWE-908
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiProxy
cpes: cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*
default_status: unaffected
vendor: Fortinet
product: FortiOS
cpes: cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*
cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Published: 2025-04-08T14:03:38.016Z
CVE-2023-37931 
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-88] in FortiVoice Entreprise version 7.0.0 through 7.0.1 and before 6.4.8 allows an authenticated attacker to perform a blind sql injection attack via sending crafted HTTP or HTTPS requests
Problem types: cwe_id: CWE-89
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiVoice
cpes: cpe:2.3:a:fortinet:fortivoice:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.4.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.4.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortivoice:6.0.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C
Published: 2025-01-14T14:10:00.867Z
CVE-2023-37932 
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in FortiVoiceEntreprise version 7.0.0 and before 6.4.7 allows an authenticated attacker to read arbitrary files from the system via sending crafted HTTP or HTTPS requests
Problem types: cwe_id: CWE-22
description: Information disclosure
Affected products: vendor: Fortinet
product: FortiVoice
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:C
Published: 2024-01-10T17:48:00.502Z
CVE-2023-37933 
An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiADC GUI version 7.4.0, 7.2.0 through 7.2.1	and before 7.1.3 allows an authenticated attacker to perform an XSS attack via crafted HTTP or HTTPs requests.
Problem types: cwe_id: CWE-79
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiADC
cpes: cpe:2.3:h:fortinet:fortiadc:7.4.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.2.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.1.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.1.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.1.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.1.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.0.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.0.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.0.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.0.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.0.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:7.0.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.6:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.2.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.6:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.1.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:6.0.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.4.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.4.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.4.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.4.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.4.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.4.0:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.7:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.6:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.5:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.4:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.3:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.2:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.1:*:*:*:*:*:*:*
cpe:2.3:h:fortinet:fortiadc:5.3.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C
Published: 2025-03-11T14:54:35.895Z
CVE-2023-37934 
An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiPAM 1.0 all versions allows an authenticated attacker to perform a denial of service attack via sending crafted HTTP or HTTPS requests in a high frequency.
Problem types: cwe_id: CWE-770
description: Denial of service
Affected products: vendor: Fortinet
product: FortiPAM
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:F/RL:X/RC:C
Published: 2024-01-10T17:51:36.939Z
CVE-2023-37935 
A use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12, 7.2.0 - 7.2.5 and 7.4.0 allows an attacker to view plaintext passwords of remote services such as RDP or VNC, if the attacker is able to read the GET requests to those services.
Problem types: cwe_id: CWE-598
description: Information disclosure
Affected products: vendor: Fortinet
product: FortiOS
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:X/RC:X
Published: 2023-10-10T16:51:21.801Z
CVE-2023-37936 
A use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and 6.4.0 through 6.4.13 and 6.2.0 through 6.2.7 and 6.0.0 through 6.0.7 allows attacker to execute unauthorized code or commands via crafted requests.
Problem types: cwe_id: CWE-321
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiSwitch
cpes: cpe:2.3:a:fortinet:fortiswitch:7.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.13:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.11:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.10:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.9:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.8:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.2.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortiswitch:6.0.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C
Published: 2025-01-14T14:09:30.417Z