Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2024-48884 (GCVE-0-2024-48884)
Vulnerability from cvelistv5
Published
2025-01-14 14:09
Modified
2025-01-16 16:15
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Escalation of privilege
Summary
A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiOS versions 7.6.0, 7.4.0 through 7.4.4, 7.2.5 through 7.2.9, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, 7.2.0 through 7.2.11, 7.0.0 through 7.0.18, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiManager Cloud versions 7.4.1 through 7.4.3 allows attacker to trigger an escalation of privilege via specially crafted packets.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@fortinet.com | https://fortiguard.fortinet.com/psirt/FG-IR-24-259 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Fortinet | FortiManager |
Version: 7.6.0 ≤ 7.6.1 Version: 7.4.1 ≤ 7.4.3 cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:* cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:* |
|||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-48884",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-14T15:17:58.698254Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-14T20:55:28.999Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiManager",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "7.6.1",
"status": "affected",
"version": "7.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.4.3",
"status": "affected",
"version": "7.4.1",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiOS",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "7.6.0"
},
{
"lessThanOrEqual": "7.4.4",
"status": "affected",
"version": "7.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.9",
"status": "affected",
"version": "7.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.15",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.15",
"status": "affected",
"version": "6.4.0",
"versionType": "semver"
}
]
},
{
"cpes": [],
"defaultStatus": "unaffected",
"product": "FortiProxy",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "7.4.5",
"status": "affected",
"version": "7.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.11",
"status": "affected",
"version": "7.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.18",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.0.14",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.2.13",
"status": "affected",
"version": "1.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.1.6",
"status": "affected",
"version": "1.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "1.0.7",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A improper limitation of a pathname to a restricted directory (\u0027path traversal\u0027) in Fortinet FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiOS versions 7.6.0, 7.4.0 through 7.4.4, 7.2.5 through 7.2.9, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, 7.2.0 through 7.2.11, 7.0.0 through 7.0.18, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiManager Cloud versions 7.4.1 through 7.4.3 allows attacker to trigger an escalation of privilege via specially crafted packets."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Escalation of privilege",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-16T16:15:35.420Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-259",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-259"
}
],
"solutions": [
{
"lang": "en",
"value": "Please upgrade to FortiRecorder version 7.2.2 or above \nPlease upgrade to FortiRecorder version 7.0.5 or above \nPlease upgrade to FortiProxy version 7.4.6 or above \nPlease upgrade to FortiProxy version 7.2.12 or above \nPlease upgrade to FortiProxy version 7.0.19 or above \nPlease upgrade to FortiAuthenticator version 7.0.0 or above \nPlease upgrade to FortiWeb version 7.6.1 or above \nPlease upgrade to FortiWeb version 7.4.5 or above \nPlease upgrade to FortiOS version 7.6.1 or above \nPlease upgrade to FortiOS version 7.4.5 or above \nPlease upgrade to FortiOS version 7.2.10 or above \nPlease upgrade to FortiOS version 7.0.16 or above \nPlease upgrade to FortiManager version 7.6.2 or above \nPlease upgrade to FortiManager version 7.4.4 or above \nPlease upgrade to FortiVoice version 7.2.0 or above \nPlease upgrade to FortiVoice version 7.0.5 or above \nPlease upgrade to FortiVoice version 6.4.10 or above \nPlease upgrade to FortiManager Cloud version 7.4.4 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-48884",
"datePublished": "2025-01-14T14:09:26.476Z",
"dateReserved": "2024-10-09T09:03:09.960Z",
"dateUpdated": "2025-01-16T16:15:35.420Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-48884\",\"sourceIdentifier\":\"psirt@fortinet.com\",\"published\":\"2025-01-14T14:15:32.873\",\"lastModified\":\"2025-02-03T22:18:16.507\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A improper limitation of a pathname to a restricted directory (\u0027path traversal\u0027) in Fortinet FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiOS versions 7.6.0, 7.4.0 through 7.4.4, 7.2.5 through 7.2.9, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, 7.2.0 through 7.2.11, 7.0.0 through 7.0.18, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiManager Cloud versions 7.4.1 through 7.4.3 allows attacker to trigger an escalation of privilege via specially crafted packets.\"},{\"lang\":\"es\",\"value\":\"Una limitaci\u00f3n incorrecta de una ruta de acceso a un directorio restringido (\u0027Path Traversal\u0027) en Fortinet FortiManager versiones 7.6.0 a 7.6.1, 7.4.1 a 7.4.3, FortiOS versiones 7.6.0, 7.4.0 a 7.4.4, 7.2.5 a 7.2.9, 7.0.0 a 7.0.15, 6.4.0 a 6.4.15, FortiProxy 7.4.0 a 7.4.5, 7.2.0 a 7.2.11, 7.0.0 a 7.0.18, 2.0.0 a 2.0.14, 1.2.0 a 1.2.13, 1.1.0 a 1.1.6, 1.0.0 a 1.0.7, FortiManager Cloud versiones 7.4.1 hasta 7.4.3, FortiRecorder versiones 7.2.0 hasta 7.2.1, 7.0.0 hasta 7.0.4, FortiVoice versiones 7.0.0 hasta 7.0.4, 6.4.0 hasta 6.4.9, 6.0.0 hasta 6.0.12, FortiWeb 7.6.0, 7.4.0 hasta 7.4.4, 7.2.0 hasta 7.2.10, 7.0.0 hasta 7.0.10, 6.4.0 hasta 6.4.3 permite al atacante activar una escalada de privilegios a trav\u00e9s de paquetes especialmente manipulados.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@fortinet.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"psirt@fortinet.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.4.1\",\"versionEndExcluding\":\"7.4.4\",\"matchCriteriaId\":\"7269FDB6-A1D4-4912-8751-87BA52614FDA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.6.0\",\"versionEndExcluding\":\"7.6.2\",\"matchCriteriaId\":\"241A8930-4ADA-4380-AA42-F10B28487595\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortimanager_cloud:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.4.1\",\"versionEndExcluding\":\"7.4.4\",\"matchCriteriaId\":\"164DEDC3-B1C0-42AC-9ADB-CE03CF6A71CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.0.0\",\"versionEndExcluding\":\"7.0.19\",\"matchCriteriaId\":\"32CFAF1E-358A-4F6D-96CB-D7229F0D9D74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.2.0\",\"versionEndExcluding\":\"7.2.12\",\"matchCriteriaId\":\"C8B93C73-1E94-4854-8405-C3689860A74C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.4.0\",\"versionEndExcluding\":\"7.4.6\",\"matchCriteriaId\":\"5B276403-CE85-445A-9E5D-BBFBD7AB7A68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortirecorder:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0.0\",\"versionEndExcluding\":\"7.0.5\",\"matchCriteriaId\":\"CD60BA50-3F98-46BF-97E8-28AB207DE12A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortirecorder:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.2.0\",\"versionEndExcluding\":\"7.2.2\",\"matchCriteriaId\":\"C0B0D078-2F52-46B4-B9C0-162447828E1B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndIncluding\":\"6.4.10\",\"matchCriteriaId\":\"BBF1E214-4BC5-47E8-BF02-072D6D830BAF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0.0\",\"versionEndIncluding\":\"7.0.5\",\"matchCriteriaId\":\"5EEE0DFA-DE31-4D26-AC98-6BCED8F008DC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4.0\",\"versionEndExcluding\":\"7.4.5\",\"matchCriteriaId\":\"CDB9CE13-AAF4-418C-BA26-1A0D53C5C1C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"28B43375-DA74-4C5F-BAEE-39F312EEF51F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.4.0\",\"versionEndExcluding\":\"7.0.16\",\"matchCriteriaId\":\"FA0532A5-31F2-4A92-BF31-6003E28AC948\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.2.0\",\"versionEndExcluding\":\"7.2.10\",\"matchCriteriaId\":\"4D7D031B-221B-4738-AC83-4FB92A106528\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.4.0\",\"versionEndExcluding\":\"7.4.5\",\"matchCriteriaId\":\"A71AD879-997D-4787-A1E9-E4132AC521E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"44CE8EE3-D64A-49C8-87D7-C18B302F864A\"}]}]}],\"references\":[{\"url\":\"https://fortiguard.fortinet.com/psirt/FG-IR-24-259\",\"source\":\"psirt@fortinet.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-48884\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-14T15:17:58.698254Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-14T15:18:00.337Z\"}}], \"cna\": {\"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*\"], \"vendor\": \"Fortinet\", \"product\": \"FortiManager\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.6.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.6.1\"}, {\"status\": \"affected\", \"version\": \"7.4.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.4.3\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:6.4.15:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:6.4.14:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:6.4.13:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:6.4.12:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:6.4.11:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:6.4.10:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:6.4.9:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:6.4.8:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:6.4.7:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:6.4.6:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:6.4.5:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:6.4.4:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:6.4.3:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:6.4.2:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:6.4.1:*:*:*:*:*:*:*\", \"cpe:2.3:o:fortinet:fortios:6.4.0:*:*:*:*:*:*:*\"], \"vendor\": \"Fortinet\", \"product\": \"FortiOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.6.0\"}, {\"status\": \"affected\", \"version\": \"7.4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.4.4\"}, {\"status\": \"affected\", \"version\": \"7.2.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.2.9\"}, {\"status\": \"affected\", \"version\": \"7.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.0.15\"}, {\"status\": \"affected\", \"version\": \"6.4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.4.15\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [], \"vendor\": \"Fortinet\", \"product\": \"FortiProxy\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.4.5\"}, {\"status\": \"affected\", \"version\": \"7.2.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.2.11\"}, {\"status\": \"affected\", \"version\": \"7.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.0.18\"}, {\"status\": \"affected\", \"version\": \"2.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.0.14\"}, {\"status\": \"affected\", \"version\": \"1.2.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.2.13\"}, {\"status\": \"affected\", \"version\": \"1.1.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.1.6\"}, {\"status\": \"affected\", \"version\": \"1.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.0.7\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Please upgrade to FortiRecorder version 7.2.2 or above \\nPlease upgrade to FortiRecorder version 7.0.5 or above \\nPlease upgrade to FortiProxy version 7.4.6 or above \\nPlease upgrade to FortiProxy version 7.2.12 or above \\nPlease upgrade to FortiProxy version 7.0.19 or above \\nPlease upgrade to FortiAuthenticator version 7.0.0 or above \\nPlease upgrade to FortiWeb version 7.6.1 or above \\nPlease upgrade to FortiWeb version 7.4.5 or above \\nPlease upgrade to FortiOS version 7.6.1 or above \\nPlease upgrade to FortiOS version 7.4.5 or above \\nPlease upgrade to FortiOS version 7.2.10 or above \\nPlease upgrade to FortiOS version 7.0.16 or above \\nPlease upgrade to FortiManager version 7.6.2 or above \\nPlease upgrade to FortiManager version 7.4.4 or above \\nPlease upgrade to FortiVoice version 7.2.0 or above \\nPlease upgrade to FortiVoice version 7.0.5 or above \\nPlease upgrade to FortiVoice version 6.4.10 or above \\nPlease upgrade to FortiManager Cloud version 7.4.4 or above\"}], \"references\": [{\"url\": \"https://fortiguard.fortinet.com/psirt/FG-IR-24-259\", \"name\": \"https://fortiguard.fortinet.com/psirt/FG-IR-24-259\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A improper limitation of a pathname to a restricted directory (\u0027path traversal\u0027) in Fortinet FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiOS versions 7.6.0, 7.4.0 through 7.4.4, 7.2.5 through 7.2.9, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, 7.2.0 through 7.2.11, 7.0.0 through 7.0.18, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiManager Cloud versions 7.4.1 through 7.4.3 allows attacker to trigger an escalation of privilege via specially crafted packets.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"Escalation of privilege\"}]}], \"providerMetadata\": {\"orgId\": \"6abe59d8-c742-4dff-8ce8-9b0ca1073da8\", \"shortName\": \"fortinet\", \"dateUpdated\": \"2025-01-16T16:15:35.420Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-48884\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-16T16:15:35.420Z\", \"dateReserved\": \"2024-10-09T09:03:09.960Z\", \"assignerOrgId\": \"6abe59d8-c742-4dff-8ce8-9b0ca1073da8\", \"datePublished\": \"2025-01-14T14:09:26.476Z\", \"assignerShortName\": \"fortinet\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
ghsa-qhwf-jg9m-cq9f
Vulnerability from github
Published
2025-01-14 15:30
Modified
2025-01-14 15:30
Severity ?
VLAI Severity ?
Details
A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiOS versions 7.6.0, 7.4.0 through 7.4.4, 7.2.5 through 7.2.9, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, 7.2.0 through 7.2.11, 7.0.0 through 7.0.18, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiManager Cloud versions 7.4.1 through 7.4.3, FortiRecorder versions 7.2.0 through 7.2.1, 7.0.0 through 7.0.4, FortiVoice versions 7.0.0 through 7.0.4, 6.4.0 through 6.4.9, 6.0.0 through 6.0.12, FortiWeb 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.10, 6.4.0 through 6.4.3 allows attacker to trigger an escalation of privilege via specially crafted packets.
{
"affected": [],
"aliases": [
"CVE-2024-48884"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-14T14:15:32Z",
"severity": "HIGH"
},
"details": "A improper limitation of a pathname to a restricted directory (\u0027path traversal\u0027) in Fortinet FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiOS versions 7.6.0, 7.4.0 through 7.4.4, 7.2.5 through 7.2.9, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, 7.2.0 through 7.2.11, 7.0.0 through 7.0.18, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiManager Cloud versions 7.4.1 through 7.4.3, FortiRecorder versions 7.2.0 through 7.2.1, 7.0.0 through 7.0.4, FortiVoice versions 7.0.0 through 7.0.4, 6.4.0 through 6.4.9, 6.0.0 through 6.0.12, FortiWeb 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.10, 6.4.0 through 6.4.3 allows attacker to trigger an escalation of privilege via specially crafted packets.",
"id": "GHSA-qhwf-jg9m-cq9f",
"modified": "2025-01-14T15:30:54Z",
"published": "2025-01-14T15:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48884"
},
{
"type": "WEB",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-259"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
ncsc-2025-0061
Vulnerability from csaf_ncscnl
Published
2025-02-14 08:46
Modified
2025-02-14 08:46
Summary
Kwetsbaarheden verholpen in Siemens producten
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten
Siemens heeft kwetsbaarheden verholpen in diverse producten als APOGEE, Opcenter, RUGGEDCOM, SCALANCE, SIMATIC, SIPROTEC en Teamcenter.
Interpretaties
De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
- Denial-of-Service (DoS)
- Cross-Site-Scripting (XSS)
- Cross-Site Request Forgery (CSRF)
- Manipulatie van gegevens
- Omzeilen van een beveiligingsmaatregel
- Omzeilen van authenticatie
- (Remote) code execution (root/admin rechten)
- (Remote) code execution (Gebruikersrechten)
- Toegang tot systeemgegevens
- Toegang tot gevoelige gegevens
De kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.
Oplossingen
Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico's zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.
Kans
medium
Schade
high
CWE-1240
Use of a Cryptographic Primitive with a Risky Implementation
CWE-1325
Improperly Controlled Sequential Memory Allocation
CWE-468
Incorrect Pointer Scaling
CWE-606
Unchecked Input for Loop Condition
CWE-183
Permissive List of Allowed Inputs
CWE-385
Covert Timing Channel
CWE-1395
Dependency on Vulnerable Third-Party Component
CWE-170
Improper Null Termination
CWE-489
Active Debug Code
CWE-1392
Use of Default Credentials
CWE-222
Truncation of Security-relevant Information
CWE-310
CWE-310
CWE-328
Use of Weak Hash
CWE-304
Missing Critical Step in Authentication
CWE-684
Incorrect Provision of Specified Functionality
CWE-208
Observable Timing Discrepancy
CWE-326
Inadequate Encryption Strength
CWE-923
Improper Restriction of Communication Channel to Intended Endpoints
CWE-201
Insertion of Sensitive Information Into Sent Data
CWE-347
Improper Verification of Cryptographic Signature
CWE-834
Excessive Iteration
CWE-732
Incorrect Permission Assignment for Critical Resource
CWE-425
Direct Request ('Forced Browsing')
CWE-440
Expected Behavior Violation
CWE-704
Incorrect Type Conversion or Cast
CWE-415
Double Free
CWE-1286
Improper Validation of Syntactic Correctness of Input
CWE-754
Improper Check for Unusual or Exceptional Conditions
CWE-427
Uncontrolled Search Path Element
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')
CWE-610
Externally Controlled Reference to a Resource in Another Sphere
CWE-613
Insufficient Session Expiration
CWE-843
Access of Resource Using Incompatible Type ('Type Confusion')
CWE-312
Cleartext Storage of Sensitive Information
CWE-369
Divide By Zero
CWE-252
Unchecked Return Value
CWE-203
Observable Discrepancy
CWE-354
Improper Validation of Integrity Check Value
CWE-325
Missing Cryptographic Step
CWE-190
Integer Overflow or Wraparound
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-125
Out-of-bounds Read
CWE-404
Improper Resource Shutdown or Release
CWE-284
Improper Access Control
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-1333
Inefficient Regular Expression Complexity
CWE-416
Use After Free
CWE-113
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
CWE-401
Missing Release of Memory after Effective Lifetime
CWE-476
NULL Pointer Dereference
CWE-295
Improper Certificate Validation
CWE-757
Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
CWE-327
Use of a Broken or Risky Cryptographic Algorithm
CWE-436
Interpretation Conflict
CWE-400
Uncontrolled Resource Consumption
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Siemens heeft kwetsbaarheden verholpen in diverse producten als APOGEE, Opcenter, RUGGEDCOM, SCALANCE, SIMATIC, SIPROTEC en Teamcenter.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorie\u00ebn schade:\n\n- Denial-of-Service (DoS)\n- Cross-Site-Scripting (XSS)\n- Cross-Site Request Forgery (CSRF)\n- Manipulatie van gegevens\n- Omzeilen van een beveiligingsmaatregel\n- Omzeilen van authenticatie\n- (Remote) code execution (root/admin rechten)\n- (Remote) code execution (Gebruikersrechten)\n- Toegang tot systeemgegevens\n- Toegang tot gevoelige gegevens\n\nDe kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico\u0027s zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Use of a Cryptographic Primitive with a Risky Implementation",
"title": "CWE-1240"
},
{
"category": "general",
"text": "Improperly Controlled Sequential Memory Allocation",
"title": "CWE-1325"
},
{
"category": "general",
"text": "Incorrect Pointer Scaling",
"title": "CWE-468"
},
{
"category": "general",
"text": "Unchecked Input for Loop Condition",
"title": "CWE-606"
},
{
"category": "general",
"text": "Permissive List of Allowed Inputs",
"title": "CWE-183"
},
{
"category": "general",
"text": "Covert Timing Channel",
"title": "CWE-385"
},
{
"category": "general",
"text": "Dependency on Vulnerable Third-Party Component",
"title": "CWE-1395"
},
{
"category": "general",
"text": "Improper Null Termination",
"title": "CWE-170"
},
{
"category": "general",
"text": "Active Debug Code",
"title": "CWE-489"
},
{
"category": "general",
"text": "Use of Default Credentials",
"title": "CWE-1392"
},
{
"category": "general",
"text": "Truncation of Security-relevant Information",
"title": "CWE-222"
},
{
"category": "general",
"text": "CWE-310",
"title": "CWE-310"
},
{
"category": "general",
"text": "Use of Weak Hash",
"title": "CWE-328"
},
{
"category": "general",
"text": "Missing Critical Step in Authentication",
"title": "CWE-304"
},
{
"category": "general",
"text": "Incorrect Provision of Specified Functionality",
"title": "CWE-684"
},
{
"category": "general",
"text": "Observable Timing Discrepancy",
"title": "CWE-208"
},
{
"category": "general",
"text": "Inadequate Encryption Strength",
"title": "CWE-326"
},
{
"category": "general",
"text": "Improper Restriction of Communication Channel to Intended Endpoints",
"title": "CWE-923"
},
{
"category": "general",
"text": "Insertion of Sensitive Information Into Sent Data",
"title": "CWE-201"
},
{
"category": "general",
"text": "Improper Verification of Cryptographic Signature",
"title": "CWE-347"
},
{
"category": "general",
"text": "Excessive Iteration",
"title": "CWE-834"
},
{
"category": "general",
"text": "Incorrect Permission Assignment for Critical Resource",
"title": "CWE-732"
},
{
"category": "general",
"text": "Direct Request (\u0027Forced Browsing\u0027)",
"title": "CWE-425"
},
{
"category": "general",
"text": "Expected Behavior Violation",
"title": "CWE-440"
},
{
"category": "general",
"text": "Incorrect Type Conversion or Cast",
"title": "CWE-704"
},
{
"category": "general",
"text": "Double Free",
"title": "CWE-415"
},
{
"category": "general",
"text": "Improper Validation of Syntactic Correctness of Input",
"title": "CWE-1286"
},
{
"category": "general",
"text": "Improper Check for Unusual or Exceptional Conditions",
"title": "CWE-754"
},
{
"category": "general",
"text": "Uncontrolled Search Path Element",
"title": "CWE-427"
},
{
"category": "general",
"text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"title": "CWE-601"
},
{
"category": "general",
"text": "Externally Controlled Reference to a Resource in Another Sphere",
"title": "CWE-610"
},
{
"category": "general",
"text": "Insufficient Session Expiration",
"title": "CWE-613"
},
{
"category": "general",
"text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"title": "CWE-843"
},
{
"category": "general",
"text": "Cleartext Storage of Sensitive Information",
"title": "CWE-312"
},
{
"category": "general",
"text": "Divide By Zero",
"title": "CWE-369"
},
{
"category": "general",
"text": "Unchecked Return Value",
"title": "CWE-252"
},
{
"category": "general",
"text": "Observable Discrepancy",
"title": "CWE-203"
},
{
"category": "general",
"text": "Improper Validation of Integrity Check Value",
"title": "CWE-354"
},
{
"category": "general",
"text": "Missing Cryptographic Step",
"title": "CWE-325"
},
{
"category": "general",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
},
{
"category": "general",
"text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"title": "CWE-362"
},
{
"category": "general",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "general",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "general",
"text": "Improper Access Control",
"title": "CWE-284"
},
{
"category": "general",
"text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
"title": "CWE-119"
},
{
"category": "general",
"text": "Inefficient Regular Expression Complexity",
"title": "CWE-1333"
},
{
"category": "general",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "general",
"text": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
"title": "CWE-113"
},
{
"category": "general",
"text": "Missing Release of Memory after Effective Lifetime",
"title": "CWE-401"
},
{
"category": "general",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "general",
"text": "Improper Certificate Validation",
"title": "CWE-295"
},
{
"category": "general",
"text": "Selection of Less-Secure Algorithm During Negotiation (\u0027Algorithm Downgrade\u0027)",
"title": "CWE-757"
},
{
"category": "general",
"text": "Use of a Broken or Risky Cryptographic Algorithm",
"title": "CWE-327"
},
{
"category": "general",
"text": "Interpretation Conflict",
"title": "CWE-436"
},
{
"category": "general",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference - ncscclear",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-111547.pdf"
},
{
"category": "external",
"summary": "Reference - ncscclear",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-195895.pdf"
},
{
"category": "external",
"summary": "Reference - ncscclear",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-224824.pdf"
},
{
"category": "external",
"summary": "Reference - ncscclear",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-246355.pdf"
},
{
"category": "external",
"summary": "Reference - ncscclear",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-342348.pdf"
},
{
"category": "external",
"summary": "Reference - ncscclear",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-369369.pdf"
},
{
"category": "external",
"summary": "Reference - ncscclear",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-615116.pdf"
},
{
"category": "external",
"summary": "Reference - ncscclear",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-637914.pdf"
},
{
"category": "external",
"summary": "Reference - ncscclear",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-647005.pdf"
},
{
"category": "external",
"summary": "Reference - ncscclear",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-656895.pdf"
},
{
"category": "external",
"summary": "Reference - ncscclear",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-687955.pdf"
},
{
"category": "external",
"summary": "Reference - ncscclear",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-767615.pdf"
},
{
"category": "external",
"summary": "Reference - ncscclear",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-769027.pdf"
},
{
"category": "external",
"summary": "Reference - ncscclear",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-770770.pdf"
}
],
"title": "Kwetsbaarheden verholpen in Siemens producten",
"tracking": {
"current_release_date": "2025-02-14T08:46:28.240775Z",
"id": "NCSC-2025-0061",
"initial_release_date": "2025-02-14T08:46:28.240775Z",
"revision_history": [
{
"date": "2025-02-14T08:46:28.240775Z",
"number": "0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "apogee_pxc_series__bacnet_",
"product": {
"name": "apogee_pxc_series__bacnet_",
"product_id": "CSAFPID-1702551",
"product_identification_helper": {
"cpe": "cpe:2.3:a:siemens:apogee_pxc_series__bacnet_:*:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "apogee_pxc_series__p2_ethernet_",
"product": {
"name": "apogee_pxc_series__p2_ethernet_",
"product_id": "CSAFPID-1702739",
"product_identification_helper": {
"cpe": "cpe:2.3:a:siemens:apogee_pxc_series__p2_ethernet_:*:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "opcenter_intelligence",
"product": {
"name": "opcenter_intelligence",
"product_id": "CSAFPID-1702007",
"product_identification_helper": {
"cpe": "cpe:2.3:a:siemens:opcenter_intelligence:*:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "opcenter_intelligence",
"product": {
"name": "opcenter_intelligence",
"product_id": "CSAFPID-1767245",
"product_identification_helper": {
"cpe": "cpe:2.3:a:siemens:opcenter_intelligence:2501:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "ruggedcom",
"product": {
"name": "ruggedcom",
"product_id": "CSAFPID-342615",
"product_identification_helper": {
"cpe": "cpe:2.3:a:siemens:ruggedcom:*:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "scalance",
"product": {
"name": "scalance",
"product_id": "CSAFPID-1769354",
"product_identification_helper": {
"cpe": "cpe:2.3:a:siemens:scalance:*:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "_simatic_s7",
"product": {
"name": "_simatic_s7",
"product_id": "CSAFPID-1769355",
"product_identification_helper": {
"cpe": "cpe:2.3:a:siemens:_simatic_s7:*:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "_simatic",
"product": {
"name": "_simatic",
"product_id": "CSAFPID-1769356",
"product_identification_helper": {
"cpe": "cpe:2.3:a:siemens:_simatic:*:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "simatic_s7",
"product": {
"name": "simatic_s7",
"product_id": "CSAFPID-1751507",
"product_identification_helper": {
"cpe": "cpe:2.3:a:siemens:simatic_s7:*:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "simatic",
"product": {
"name": "simatic",
"product_id": "CSAFPID-166121",
"product_identification_helper": {
"cpe": "cpe:2.3:a:siemens:simatic:*:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "siprotec",
"product": {
"name": "siprotec",
"product_id": "CSAFPID-1750039",
"product_identification_helper": {
"cpe": "cpe:2.3:a:siemens:siprotec:*:*:*:*:*:*:*:*"
}
}
},
{
"category": "product_name",
"name": "teamcenter",
"product": {
"name": "teamcenter",
"product_id": "CSAFPID-538462",
"product_identification_helper": {
"cpe": "cpe:2.3:a:siemens:teamcenter:*:*:*:*:*:*:*:*"
}
}
}
],
"category": "vendor",
"name": "siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-46665",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"notes": [
{
"category": "other",
"text": "Insertion of Sensitive Information Into Sent Data",
"title": "CWE-201"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-46665",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-46665.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-46665"
},
{
"cve": "CVE-2024-46666",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-46666",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-46666.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-46666"
},
{
"cve": "CVE-2024-46668",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-46668",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-46668.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-46668"
},
{
"cve": "CVE-2024-46669",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "other",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-46669",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-46669.json"
}
],
"title": "CVE-2024-46669"
},
{
"cve": "CVE-2024-46670",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Read",
"title": "CWE-125"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-46670",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-46670.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:X/RL:X/RC:X",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-46670"
},
{
"cve": "CVE-2024-48884",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-48884",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-48884.json"
}
],
"title": "CVE-2024-48884"
},
{
"cve": "CVE-2024-48885",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-48885",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-48885.json"
}
],
"title": "CVE-2024-48885"
},
{
"cve": "CVE-2024-50560",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-50560",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-50560.json"
}
],
"title": "CVE-2024-50560"
},
{
"cve": "CVE-2024-50561",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-50561",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-50561.json"
}
],
"title": "CVE-2024-50561"
},
{
"cve": "CVE-2024-50572",
"cwe": {
"id": "CWE-74",
"name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"title": "CWE-74"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-50572",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-50572.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-50572"
},
{
"cve": "CVE-2024-52963",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-52963",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-52963.json"
}
],
"title": "CVE-2024-52963"
},
{
"cve": "CVE-2024-53648",
"cwe": {
"id": "CWE-489",
"name": "Active Debug Code"
},
"notes": [
{
"category": "other",
"text": "Active Debug Code",
"title": "CWE-489"
},
{
"category": "general",
"text": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-53648",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-53648.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-53648"
},
{
"cve": "CVE-2024-53651",
"cwe": {
"id": "CWE-312",
"name": "Cleartext Storage of Sensitive Information"
},
"notes": [
{
"category": "other",
"text": "Cleartext Storage of Sensitive Information",
"title": "CWE-312"
},
{
"category": "general",
"text": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-53651",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-53651.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-53651"
},
{
"cve": "CVE-2024-53977",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"notes": [
{
"category": "other",
"text": "Uncontrolled Search Path Element",
"title": "CWE-427"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-53977",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-53977.json"
}
],
"title": "CVE-2024-53977"
},
{
"cve": "CVE-2024-54015",
"cwe": {
"id": "CWE-1392",
"name": "Use of Default Credentials"
},
"notes": [
{
"category": "other",
"text": "Use of Default Credentials",
"title": "CWE-1392"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-54015",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54015.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-54015"
},
{
"cve": "CVE-2024-54021",
"cwe": {
"id": "CWE-113",
"name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
"title": "CWE-113"
},
{
"category": "other",
"text": "Interpretation Conflict",
"title": "CWE-436"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-54021",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54021.json"
}
],
"title": "CVE-2024-54021"
},
{
"cve": "CVE-2024-54089",
"cwe": {
"id": "CWE-326",
"name": "Inadequate Encryption Strength"
},
"notes": [
{
"category": "other",
"text": "Inadequate Encryption Strength",
"title": "CWE-326"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-54089",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54089.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-54089"
},
{
"cve": "CVE-2024-54090",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-54090",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-54090.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-54090"
},
{
"cve": "CVE-2025-23363",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"notes": [
{
"category": "other",
"text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"title": "CWE-601"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-23363",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-23363.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2025-23363"
},
{
"cve": "CVE-2025-23403",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"notes": [
{
"category": "other",
"text": "Incorrect Permission Assignment for Critical Resource",
"title": "CWE-732"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-23403",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-23403.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2025-23403"
},
{
"cve": "CVE-2025-24499",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24499",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24499.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2025-24499"
},
{
"cve": "CVE-2025-24532",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "other",
"text": "Improper Access Control",
"title": "CWE-284"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24532",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24532.json"
}
],
"title": "CVE-2025-24532"
},
{
"cve": "CVE-2025-24811",
"cwe": {
"id": "CWE-404",
"name": "Improper Resource Shutdown or Release"
},
"notes": [
{
"category": "other",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24811",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24811.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2025-24811"
},
{
"cve": "CVE-2025-24812",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Syntactic Correctness of Input",
"title": "CWE-1286"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24812",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24812.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2025-24812"
},
{
"cve": "CVE-2025-24956",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "other",
"text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"title": "CWE-120"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-24956",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2025/CVE-2025-24956.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2025-24956"
},
{
"cve": "CVE-2022-2588",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2022-2588",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-2588.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2022-2588"
},
{
"cve": "CVE-2022-2663",
"cwe": {
"id": "CWE-923",
"name": "Improper Restriction of Communication Channel to Intended Endpoints"
},
"notes": [
{
"category": "other",
"text": "Improper Restriction of Communication Channel to Intended Endpoints",
"title": "CWE-923"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2022-2663",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-2663.json"
}
],
"title": "CVE-2022-2663"
},
{
"cve": "CVE-2022-3524",
"cwe": {
"id": "CWE-404",
"name": "Improper Resource Shutdown or Release"
},
"notes": [
{
"category": "other",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "other",
"text": "Missing Release of Memory after Effective Lifetime",
"title": "CWE-401"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2022-3524",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-3524.json"
}
],
"title": "CVE-2022-3524"
},
{
"cve": "CVE-2022-4304",
"cwe": {
"id": "CWE-326",
"name": "Inadequate Encryption Strength"
},
"notes": [
{
"category": "other",
"text": "Inadequate Encryption Strength",
"title": "CWE-326"
},
{
"category": "other",
"text": "Observable Timing Discrepancy",
"title": "CWE-208"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2022-4304",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-4304.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2022-4304"
},
{
"cve": "CVE-2022-4450",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "other",
"text": "Double Free",
"title": "CWE-415"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2022-4450",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-4450.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2022-4450"
},
{
"cve": "CVE-2022-22127",
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2022-22127",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-22127.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2022-22127"
},
{
"cve": "CVE-2022-22128",
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2022-22128",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-22128.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2022-22128"
},
{
"cve": "CVE-2022-39188",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "other",
"text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"title": "CWE-362"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2022-39188",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-39188.json"
}
],
"title": "CVE-2022-39188"
},
{
"cve": "CVE-2022-39842",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "other",
"text": "Heap-based Buffer Overflow",
"title": "CWE-122"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2022-39842",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-39842.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2022-39842"
},
{
"cve": "CVE-2022-40303",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "other",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2022-40303",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-40303.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2022-40303"
},
{
"cve": "CVE-2022-40304",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "other",
"text": "Double Free",
"title": "CWE-415"
},
{
"category": "other",
"text": "Improper Restriction of XML External Entity Reference",
"title": "CWE-611"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2022-40304",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-40304.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2022-40304"
},
{
"cve": "CVE-2022-43750",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2022-43750",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-43750.json"
}
],
"title": "CVE-2022-43750"
},
{
"cve": "CVE-2022-47069",
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2022-47069",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-47069.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2022-47069"
},
{
"cve": "CVE-2022-47929",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "other",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2022-47929",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-47929.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2022-47929"
},
{
"cve": "CVE-2023-0045",
"cwe": {
"id": "CWE-610",
"name": "Externally Controlled Reference to a Resource in Another Sphere"
},
"notes": [
{
"category": "other",
"text": "Externally Controlled Reference to a Resource in Another Sphere",
"title": "CWE-610"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-0045",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-0045.json"
}
],
"title": "CVE-2023-0045"
},
{
"cve": "CVE-2023-0215",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-0215",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-0215.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-0215"
},
{
"cve": "CVE-2023-0286",
"cwe": {
"id": "CWE-704",
"name": "Incorrect Type Conversion or Cast"
},
"notes": [
{
"category": "other",
"text": "Incorrect Type Conversion or Cast",
"title": "CWE-704"
},
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
},
{
"category": "other",
"text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"title": "CWE-843"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-0286",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-0286.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-0286"
},
{
"cve": "CVE-2023-0464",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Certificate Validation",
"title": "CWE-295"
},
{
"category": "other",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "other",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "other",
"text": "Improper Verification of Cryptographic Signature",
"title": "CWE-347"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-0464",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-0464.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-0464"
},
{
"cve": "CVE-2023-0465",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Certificate Validation",
"title": "CWE-295"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-0465",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-0465.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-0465"
},
{
"cve": "CVE-2023-0466",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Certificate Validation",
"title": "CWE-295"
},
{
"category": "other",
"text": "Improper Verification of Cryptographic Signature",
"title": "CWE-347"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-0466",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-0466.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-0466"
},
{
"cve": "CVE-2023-0590",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-0590",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-0590.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-0590"
},
{
"cve": "CVE-2023-1073",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "other",
"text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
"title": "CWE-119"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-1073",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-1073.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-1073"
},
{
"cve": "CVE-2023-1074",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"notes": [
{
"category": "other",
"text": "Missing Release of Memory after Effective Lifetime",
"title": "CWE-401"
},
{
"category": "other",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-1074",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-1074.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-1074"
},
{
"cve": "CVE-2023-1118",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-1118",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-1118.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-1118"
},
{
"cve": "CVE-2023-1206",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "other",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-1206",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-1206.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-1206"
},
{
"cve": "CVE-2023-1380",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Read",
"title": "CWE-125"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-1380",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-1380.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-1380"
},
{
"cve": "CVE-2023-1670",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-1670",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-1670.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-1670"
},
{
"cve": "CVE-2023-2194",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-2194",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-2194.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-2194"
},
{
"cve": "CVE-2023-3446",
"cwe": {
"id": "CWE-404",
"name": "Improper Resource Shutdown or Release"
},
"notes": [
{
"category": "other",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "other",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "other",
"text": "Inefficient Regular Expression Complexity",
"title": "CWE-1333"
},
{
"category": "other",
"text": "Unchecked Input for Loop Condition",
"title": "CWE-606"
},
{
"category": "other",
"text": "Use of a Cryptographic Primitive with a Risky Implementation",
"title": "CWE-1240"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-3446",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-3446.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-3446"
},
{
"cve": "CVE-2023-3611",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-3611",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-3611.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-3611"
},
{
"cve": "CVE-2023-4623",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-4623",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-4623.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-4623"
},
{
"cve": "CVE-2023-4921",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-4921",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-4921.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-4921"
},
{
"cve": "CVE-2023-5363",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"notes": [
{
"category": "other",
"text": "Missing Cryptographic Step",
"title": "CWE-325"
},
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
},
{
"category": "other",
"text": "Incorrect Provision of Specified Functionality",
"title": "CWE-684"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-5363",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5363.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-5363"
},
{
"cve": "CVE-2023-5678",
"cwe": {
"id": "CWE-754",
"name": "Improper Check for Unusual or Exceptional Conditions"
},
"notes": [
{
"category": "other",
"text": "Improper Check for Unusual or Exceptional Conditions",
"title": "CWE-754"
},
{
"category": "other",
"text": "Missing Cryptographic Step",
"title": "CWE-325"
},
{
"category": "other",
"text": "Unchecked Input for Loop Condition",
"title": "CWE-606"
},
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-5678",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5678.json"
}
],
"title": "CVE-2023-5678"
},
{
"cve": "CVE-2023-5717",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-5717",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-5717.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-5717"
},
{
"cve": "CVE-2023-6129",
"cwe": {
"id": "CWE-328",
"name": "Use of Weak Hash"
},
"notes": [
{
"category": "other",
"text": "Use of Weak Hash",
"title": "CWE-328"
},
{
"category": "other",
"text": "Expected Behavior Violation",
"title": "CWE-440"
},
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "other",
"text": "Use of a Broken or Risky Cryptographic Algorithm",
"title": "CWE-327"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-6129",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-6129.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-6129"
},
{
"cve": "CVE-2023-6237",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "other",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "other",
"text": "Unchecked Input for Loop Condition",
"title": "CWE-606"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-6237",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-6237.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-6237"
},
{
"cve": "CVE-2023-7250",
"cwe": {
"id": "CWE-183",
"name": "Permissive List of Allowed Inputs"
},
"notes": [
{
"category": "other",
"text": "Permissive List of Allowed Inputs",
"title": "CWE-183"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-7250",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-7250.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-7250"
},
{
"cve": "CVE-2023-23454",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
},
"notes": [
{
"category": "other",
"text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"title": "CWE-843"
},
{
"category": "other",
"text": "Out-of-bounds Read",
"title": "CWE-125"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-23454",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-23454.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-23454"
},
{
"cve": "CVE-2023-23455",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
},
"notes": [
{
"category": "other",
"text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"title": "CWE-843"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-23455",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-23455.json"
}
],
"title": "CVE-2023-23455"
},
{
"cve": "CVE-2023-23559",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "other",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-23559",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-23559.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-23559"
},
{
"cve": "CVE-2023-26545",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"notes": [
{
"category": "other",
"text": "Double Free",
"title": "CWE-415"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-26545",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-26545.json"
}
],
"title": "CVE-2023-26545"
},
{
"cve": "CVE-2023-28484",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
},
{
"category": "other",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-28484",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-28484.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-28484"
},
{
"cve": "CVE-2023-28578",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "other",
"text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
"title": "CWE-119"
},
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
},
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-28578",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-28578.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-28578"
},
{
"cve": "CVE-2023-29469",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
},
{
"category": "other",
"text": "Double Free",
"title": "CWE-415"
},
{
"category": "other",
"text": "Improper Null Termination",
"title": "CWE-170"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-29469",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-29469.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-29469"
},
{
"cve": "CVE-2023-31085",
"cwe": {
"id": "CWE-369",
"name": "Divide By Zero"
},
"notes": [
{
"category": "other",
"text": "Divide By Zero",
"title": "CWE-369"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-31085",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-31085.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-31085"
},
{
"cve": "CVE-2023-31315",
"notes": [
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-31315",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-31315.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-31315"
},
{
"cve": "CVE-2023-35001",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "other",
"text": "Incorrect Pointer Scaling",
"title": "CWE-468"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-35001",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-35001.json"
}
],
"title": "CVE-2023-35001"
},
{
"cve": "CVE-2023-37482",
"cwe": {
"id": "CWE-203",
"name": "Observable Discrepancy"
},
"notes": [
{
"category": "other",
"text": "Observable Discrepancy",
"title": "CWE-203"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-37482",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-37482.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-37482"
},
{
"cve": "CVE-2023-39192",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Read",
"title": "CWE-125"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-39192",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-39192.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-39192"
},
{
"cve": "CVE-2023-39193",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Read",
"title": "CWE-125"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-39193",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-39193.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-39193"
},
{
"cve": "CVE-2023-42754",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "other",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-42754",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-42754.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-42754"
},
{
"cve": "CVE-2023-43522",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "other",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-43522",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-43522.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-43522"
},
{
"cve": "CVE-2023-44320",
"cwe": {
"id": "CWE-425",
"name": "Direct Request (\u0027Forced Browsing\u0027)"
},
"notes": [
{
"category": "other",
"text": "Direct Request (\u0027Forced Browsing\u0027)",
"title": "CWE-425"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-44320",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-44320.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-44320"
},
{
"cve": "CVE-2023-44322",
"cwe": {
"id": "CWE-252",
"name": "Unchecked Return Value"
},
"notes": [
{
"category": "other",
"text": "Unchecked Return Value",
"title": "CWE-252"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-44322",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-44322.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-44322"
},
{
"cve": "CVE-2023-45853",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "other",
"text": "Heap-based Buffer Overflow",
"title": "CWE-122"
},
{
"category": "other",
"text": "Integer Overflow or Wraparound",
"title": "CWE-190"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-45853",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-45853.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-45853"
},
{
"cve": "CVE-2023-45863",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-45863",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-45863.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-45863"
},
{
"cve": "CVE-2023-46604",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "other",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-46604",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-46604.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-46604"
},
{
"cve": "CVE-2023-48795",
"cwe": {
"id": "CWE-222",
"name": "Truncation of Security-relevant Information"
},
"notes": [
{
"category": "other",
"text": "Truncation of Security-relevant Information",
"title": "CWE-222"
},
{
"category": "other",
"text": "Selection of Less-Secure Algorithm During Negotiation (\u0027Algorithm Downgrade\u0027)",
"title": "CWE-757"
},
{
"category": "other",
"text": "Improper Validation of Integrity Check Value",
"title": "CWE-354"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-48795",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-48795.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-48795"
},
{
"cve": "CVE-2023-51384",
"cwe": {
"id": "CWE-304",
"name": "Missing Critical Step in Authentication"
},
"notes": [
{
"category": "other",
"text": "Missing Critical Step in Authentication",
"title": "CWE-304"
},
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-51384",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-51384.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-51384"
},
{
"cve": "CVE-2023-51385",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"title": "CWE-78"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-51385",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-51385.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2023-51385"
},
{
"cve": "CVE-2024-0727",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "other",
"text": "NULL Pointer Dereference",
"title": "CWE-476"
},
{
"category": "other",
"text": "Improper Input Validation",
"title": "CWE-20"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-0727",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-0727.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-0727"
},
{
"cve": "CVE-2024-2511",
"cwe": {
"id": "CWE-404",
"name": "Improper Resource Shutdown or Release"
},
"notes": [
{
"category": "other",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "other",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "other",
"text": "Improperly Controlled Sequential Memory Allocation",
"title": "CWE-1325"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-2511",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-2511.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-2511"
},
{
"cve": "CVE-2024-4603",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"notes": [
{
"category": "other",
"text": "Unchecked Input for Loop Condition",
"title": "CWE-606"
},
{
"category": "other",
"text": "Excessive Iteration",
"title": "CWE-834"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-4603",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-4603.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-4603"
},
{
"cve": "CVE-2024-4741",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-4741",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-4741.json"
}
],
"title": "CVE-2024-4741"
},
{
"cve": "CVE-2024-5535",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "other",
"text": "Exposure of Sensitive Information to an Unauthorized Actor",
"title": "CWE-200"
},
{
"category": "other",
"text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
"title": "CWE-119"
},
{
"category": "other",
"text": "Dependency on Vulnerable Third-Party Component",
"title": "CWE-1395"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-5535",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-5535.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-5535"
},
{
"cve": "CVE-2024-6119",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
},
"notes": [
{
"category": "other",
"text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"title": "CWE-843"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-6119",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-6119.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-6119"
},
{
"cve": "CVE-2024-9143",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-9143",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-9143.json"
}
],
"title": "CVE-2024-9143"
},
{
"cve": "CVE-2024-23814",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "other",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-23814",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-23814.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-23814"
},
{
"cve": "CVE-2024-26306",
"cwe": {
"id": "CWE-310",
"name": "-"
},
"notes": [
{
"category": "other",
"text": "CWE-310",
"title": "CWE-310"
},
{
"category": "other",
"text": "Observable Discrepancy",
"title": "CWE-203"
},
{
"category": "other",
"text": "Covert Timing Channel",
"title": "CWE-385"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-26306",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-26306.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-26306"
},
{
"cve": "CVE-2024-33016",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "other",
"text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
"title": "CWE-119"
},
{
"category": "general",
"text": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-33016",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-33016.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-33016"
},
{
"cve": "CVE-2024-36504",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Read",
"title": "CWE-125"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-36504",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-36504.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-36504"
},
{
"cve": "CVE-2024-45386",
"cwe": {
"id": "CWE-613",
"name": "Insufficient Session Expiration"
},
"notes": [
{
"category": "other",
"text": "Insufficient Session Expiration",
"title": "CWE-613"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2024-45386",
"url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-45386.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1702551",
"CSAFPID-1702739",
"CSAFPID-1702007",
"CSAFPID-1767245",
"CSAFPID-342615",
"CSAFPID-1769354",
"CSAFPID-1769355",
"CSAFPID-1769356",
"CSAFPID-1751507",
"CSAFPID-166121",
"CSAFPID-1750039",
"CSAFPID-538462"
]
}
],
"title": "CVE-2024-45386"
}
]
}
wid-sec-w-2025-0095
Vulnerability from csaf_certbund
Published
2025-01-14 23:00
Modified
2025-01-14 23:00
Summary
Fortinet Produkte: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
FortiOS ist ein gehärtetes Betriebssystem für FortiGate Plattformen.
FortiProxy ist eine Web-Proxy Lösung.
FortiMail ist eine Aplliance zum Schutz gegen die von E-Mails übertragenen Bedrohungen.
FortiRecorder ist eine Netzwerk-Videorecorder (NVR) für Videoüberwachungsanlagen.
FortiVoice Enterprise ist eine Unified Communications-Lösung.
FortiWeb ist eine Web Application Firewall von Fortinet.
Angriff
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiMail, Fortinet FortiRecorder, Fortinet FortiVoice und Fortinet FortiWeb ausnutzen, um Daten zu manipulieren und die Authentifizierung zu umgehen.
Betroffene Betriebssysteme
- Sonstiges
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "FortiOS ist ein geh\u00e4rtetes Betriebssystem f\u00fcr FortiGate Plattformen.\r\nFortiProxy ist eine Web-Proxy L\u00f6sung.\r\nFortiMail ist eine Aplliance zum Schutz gegen die von E-Mails \u00fcbertragenen Bedrohungen.\r\nFortiRecorder ist eine Netzwerk-Videorecorder (NVR) f\u00fcr Video\u00fcberwachungsanlagen.\r\nFortiVoice Enterprise ist eine Unified Communications-L\u00f6sung.\r\nFortiWeb ist eine Web Application Firewall von Fortinet.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiMail, Fortinet FortiRecorder, Fortinet FortiVoice und Fortinet FortiWeb ausnutzen, um Daten zu manipulieren und die Authentifizierung zu umgehen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Sonstiges",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2025-0095 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0095.json"
},
{
"category": "self",
"summary": "WID-SEC-2025-0095 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-0095"
},
{
"category": "external",
"summary": "FortiGuard PSIRT Advisory FG-IR-23-494 vom 2025-01-14",
"url": "https://www.fortiguard.com/psirt/FG-IR-23-494"
},
{
"category": "external",
"summary": "FortiGuard PSIRT Advisory FG-IR-24-259 vom 2025-01-14",
"url": "https://www.fortiguard.com/psirt/FG-IR-24-259"
},
{
"category": "external",
"summary": "FortiGuard PSIRT Advisory FG-IR-24-221 vom 2025-01-14",
"url": "https://www.fortiguard.com/psirt/FG-IR-24-221"
}
],
"source_lang": "en-US",
"title": "Fortinet Produkte: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2025-01-14T23:00:00.000+00:00",
"generator": {
"date": "2025-01-15T12:18:23.630+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.10"
}
},
"id": "WID-SEC-W-2025-0095",
"initial_release_date": "2025-01-14T23:00:00.000+00:00",
"revision_history": [
{
"date": "2025-01-14T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Fortinet FortiMail",
"product": {
"name": "Fortinet FortiMail",
"product_id": "T040182",
"product_identification_helper": {
"cpe": "cpe:/a:fortinet:fortimail:-"
}
}
},
{
"category": "product_name",
"name": "Fortinet FortiOS",
"product": {
"name": "Fortinet FortiOS",
"product_id": "T040180",
"product_identification_helper": {
"cpe": "cpe:/o:fortinet:fortios:-"
}
}
},
{
"category": "product_name",
"name": "Fortinet FortiProxy",
"product": {
"name": "Fortinet FortiProxy",
"product_id": "T040181",
"product_identification_helper": {
"cpe": "cpe:/a:fortinet:fortiproxy:-"
}
}
},
{
"category": "product_name",
"name": "Fortinet FortiRecorder",
"product": {
"name": "Fortinet FortiRecorder",
"product_id": "T040183",
"product_identification_helper": {
"cpe": "cpe:/o:fortinet:fortirecorder_firmware:-"
}
}
},
{
"category": "product_name",
"name": "Fortinet FortiVoice",
"product": {
"name": "Fortinet FortiVoice",
"product_id": "T040184",
"product_identification_helper": {
"cpe": "cpe:/a:fortinet:fortivoice:-"
}
}
},
{
"category": "product_name",
"name": "Fortinet FortiWeb",
"product": {
"name": "Fortinet FortiWeb",
"product_id": "T040185",
"product_identification_helper": {
"cpe": "cpe:/a:fortinet:fortiweb:-"
}
}
}
],
"category": "vendor",
"name": "Fortinet"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-23439",
"notes": [
{
"category": "description",
"text": "Es besteht eine Schwachstelle in Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiMail, Fortinet FortiRecorder, Fortinet FortiVoice und Fortinet FortiWeb. Diese Schwachstelle besteht aufgrund eines extern kontrollierten Verweises auf eine Ressource, der Cache Poisoning erm\u00f6glicht. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um Daten zu manipulieren. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T040185",
"T040184",
"T040183",
"T040182",
"T040181",
"T040180"
]
},
"release_date": "2025-01-14T23:00:00.000+00:00",
"title": "CVE-2022-23439"
},
{
"cve": "CVE-2024-48884",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiMail, Fortinet FortiRecorder, Fortinet FortiVoice und Fortinet FortiWeb. Dieser Fehler ist auf eine unsachgem\u00e4\u00dfe Behandlung von Verzeichnispfaden zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebige Ordner zu l\u00f6schen und ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um beliebige Dateien zu schreiben."
}
],
"product_status": {
"known_affected": [
"T040185",
"T040184",
"T040183",
"T040182",
"T040181",
"T040180"
]
},
"release_date": "2025-01-14T23:00:00.000+00:00",
"title": "CVE-2024-48884"
},
{
"cve": "CVE-2024-48885",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiMail, Fortinet FortiRecorder, Fortinet FortiVoice und Fortinet FortiWeb. Dieser Fehler ist auf eine unsachgem\u00e4\u00dfe Behandlung von Verzeichnispfaden zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebige Ordner zu l\u00f6schen und ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um beliebige Dateien zu schreiben."
}
],
"product_status": {
"known_affected": [
"T040185",
"T040184",
"T040183",
"T040182",
"T040181",
"T040180"
]
},
"release_date": "2025-01-14T23:00:00.000+00:00",
"title": "CVE-2024-48885"
},
{
"cve": "CVE-2024-48886",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiMail, Fortinet FortiRecorder, Fortinet FortiVoice und Fortinet FortiWeb. Diese Schwachstellen sind auf eine schwache Authentifizierung im csfd-Daemon zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um die Authentifizierung zu umgehen und Ger\u00e4te in der Security Fabric zu kontrollieren oder eingeschr\u00e4nkten Funktionszugang zu erhalten."
}
],
"product_status": {
"known_affected": [
"T040185",
"T040184",
"T040183",
"T040182",
"T040181",
"T040180"
]
},
"release_date": "2025-01-14T23:00:00.000+00:00",
"title": "CVE-2024-48886"
},
{
"cve": "CVE-2024-50563",
"notes": [
{
"category": "description",
"text": "Es bestehen mehrere Schwachstellen in Fortinet FortiOS, Fortinet FortiProxy, Fortinet FortiMail, Fortinet FortiRecorder, Fortinet FortiVoice und Fortinet FortiWeb. Diese Schwachstellen sind auf eine schwache Authentifizierung im csfd-Daemon zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um die Authentifizierung zu umgehen und Ger\u00e4te in der Security Fabric zu kontrollieren oder eingeschr\u00e4nkten Funktionszugang zu erhalten."
}
],
"product_status": {
"known_affected": [
"T040185",
"T040184",
"T040183",
"T040182",
"T040181",
"T040180"
]
},
"release_date": "2025-01-14T23:00:00.000+00:00",
"title": "CVE-2024-50563"
}
]
}
fkie_cve-2024-48884
Vulnerability from fkie_nvd
Published
2025-01-14 14:15
Modified
2025-02-03 22:18
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Summary
A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiOS versions 7.6.0, 7.4.0 through 7.4.4, 7.2.5 through 7.2.9, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, 7.2.0 through 7.2.11, 7.0.0 through 7.0.18, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiManager Cloud versions 7.4.1 through 7.4.3 allows attacker to trigger an escalation of privilege via specially crafted packets.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@fortinet.com | https://fortiguard.fortinet.com/psirt/FG-IR-24-259 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| fortinet | fortimanager | * | |
| fortinet | fortimanager | * | |
| fortinet | fortimanager_cloud | * | |
| fortinet | fortiproxy | * | |
| fortinet | fortiproxy | * | |
| fortinet | fortiproxy | * | |
| fortinet | fortirecorder | * | |
| fortinet | fortirecorder | * | |
| fortinet | fortivoice | * | |
| fortinet | fortivoice | * | |
| fortinet | fortiweb | * | |
| fortinet | fortiweb | 7.6.0 | |
| fortinet | fortios | * | |
| fortinet | fortios | * | |
| fortinet | fortios | * | |
| fortinet | fortios | 7.6.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7269FDB6-A1D4-4912-8751-87BA52614FDA",
"versionEndExcluding": "7.4.4",
"versionStartIncluding": "7.4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "241A8930-4ADA-4380-AA42-F10B28487595",
"versionEndExcluding": "7.6.2",
"versionStartIncluding": "7.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fortinet:fortimanager_cloud:*:*:*:*:*:*:*:*",
"matchCriteriaId": "164DEDC3-B1C0-42AC-9ADB-CE03CF6A71CC",
"versionEndExcluding": "7.4.4",
"versionStartIncluding": "7.4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
"matchCriteriaId": "32CFAF1E-358A-4F6D-96CB-D7229F0D9D74",
"versionEndExcluding": "7.0.19",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C8B93C73-1E94-4854-8405-C3689860A74C",
"versionEndExcluding": "7.2.12",
"versionStartIncluding": "7.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5B276403-CE85-445A-9E5D-BBFBD7AB7A68",
"versionEndExcluding": "7.4.6",
"versionStartIncluding": "7.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fortinet:fortirecorder:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CD60BA50-3F98-46BF-97E8-28AB207DE12A",
"versionEndExcluding": "7.0.5",
"versionStartIncluding": "7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fortinet:fortirecorder:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C0B0D078-2F52-46B4-B9C0-162447828E1B",
"versionEndExcluding": "7.2.2",
"versionStartIncluding": "7.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BBF1E214-4BC5-47E8-BF02-072D6D830BAF",
"versionEndIncluding": "6.4.10",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fortinet:fortivoice:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5EEE0DFA-DE31-4D26-AC98-6BCED8F008DC",
"versionEndIncluding": "7.0.5",
"versionStartIncluding": "7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CDB9CE13-AAF4-418C-BA26-1A0D53C5C1C2",
"versionEndExcluding": "7.4.5",
"versionStartIncluding": "6.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "28B43375-DA74-4C5F-BAEE-39F312EEF51F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FA0532A5-31F2-4A92-BF31-6003E28AC948",
"versionEndExcluding": "7.0.16",
"versionStartIncluding": "6.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4D7D031B-221B-4738-AC83-4FB92A106528",
"versionEndExcluding": "7.2.10",
"versionStartIncluding": "7.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A71AD879-997D-4787-A1E9-E4132AC521E2",
"versionEndExcluding": "7.4.5",
"versionStartIncluding": "7.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "44CE8EE3-D64A-49C8-87D7-C18B302F864A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A improper limitation of a pathname to a restricted directory (\u0027path traversal\u0027) in Fortinet FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiOS versions 7.6.0, 7.4.0 through 7.4.4, 7.2.5 through 7.2.9, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, 7.2.0 through 7.2.11, 7.0.0 through 7.0.18, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiManager Cloud versions 7.4.1 through 7.4.3 allows attacker to trigger an escalation of privilege via specially crafted packets."
},
{
"lang": "es",
"value": "Una limitaci\u00f3n incorrecta de una ruta de acceso a un directorio restringido (\u0027Path Traversal\u0027) en Fortinet FortiManager versiones 7.6.0 a 7.6.1, 7.4.1 a 7.4.3, FortiOS versiones 7.6.0, 7.4.0 a 7.4.4, 7.2.5 a 7.2.9, 7.0.0 a 7.0.15, 6.4.0 a 6.4.15, FortiProxy 7.4.0 a 7.4.5, 7.2.0 a 7.2.11, 7.0.0 a 7.0.18, 2.0.0 a 2.0.14, 1.2.0 a 1.2.13, 1.1.0 a 1.1.6, 1.0.0 a 1.0.7, FortiManager Cloud versiones 7.4.1 hasta 7.4.3, FortiRecorder versiones 7.2.0 hasta 7.2.1, 7.0.0 hasta 7.0.4, FortiVoice versiones 7.0.0 hasta 7.0.4, 6.4.0 hasta 6.4.9, 6.0.0 hasta 6.0.12, FortiWeb 7.6.0, 7.4.0 hasta 7.4.4, 7.2.0 hasta 7.2.10, 7.0.0 hasta 7.0.10, 6.4.0 hasta 6.4.3 permite al atacante activar una escalada de privilegios a trav\u00e9s de paquetes especialmente manipulados."
}
],
"id": "CVE-2024-48884",
"lastModified": "2025-02-03T22:18:16.507",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "psirt@fortinet.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2025-01-14T14:15:32.873",
"references": [
{
"source": "psirt@fortinet.com",
"tags": [
"Vendor Advisory"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-259"
}
],
"sourceIdentifier": "psirt@fortinet.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "psirt@fortinet.com",
"type": "Primary"
}
]
}
ssa-770770
Vulnerability from csaf_siemens
Published
2025-02-11 00:00
Modified
2025-07-08 00:00
Summary
SSA-770770: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.7 on RUGGEDCOM APE1808 Devices
Notes
Summary
Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products.
Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version.
General Recommendations
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
"tlp": {
"label": "WHITE"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products.\nSiemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version.",
"title": "Summary"
},
{
"category": "general",
"text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
"title": "General Recommendations"
},
{
"category": "general",
"text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "productcert@siemens.com",
"name": "Siemens ProductCERT",
"namespace": "https://www.siemens.com"
},
"references": [
{
"category": "self",
"summary": "SSA-770770: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.7 on RUGGEDCOM APE1808 Devices - HTML Version",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-770770.html"
},
{
"category": "self",
"summary": "SSA-770770: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.7 on RUGGEDCOM APE1808 Devices - CSAF Version",
"url": "https://cert-portal.siemens.com/productcert/csaf/ssa-770770.json"
}
],
"title": "SSA-770770: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.7 on RUGGEDCOM APE1808 Devices",
"tracking": {
"current_release_date": "2025-07-08T00:00:00Z",
"generator": {
"engine": {
"name": "Siemens ProductCERT CSAF Generator",
"version": "1"
}
},
"id": "SSA-770770",
"initial_release_date": "2025-02-11T00:00:00Z",
"revision_history": [
{
"date": "2025-02-11T00:00:00Z",
"legacy_version": "1.0",
"number": "1",
"summary": "Publication Date"
},
{
"date": "2025-03-11T00:00:00Z",
"legacy_version": "1.1",
"number": "2",
"summary": "Added newly published upstream vulnerabilities CVE-2024-35279 and CVE-2024-40591"
},
{
"date": "2025-04-08T00:00:00Z",
"legacy_version": "1.2",
"number": "3",
"summary": "Added newly published upstream vulnerabilities CVE-2024-48886, CVE-2024-50563, CVE-2024-45324 and CVE-2024-3596"
},
{
"date": "2025-05-13T00:00:00Z",
"legacy_version": "1.3",
"number": "4",
"summary": "Added newly published upstream vulnerabilities CVE-2024-21762, CVE-2022-42475, CVE-2023-27997, CVE-2024-26013 and CVE-2024-50565. Moved CVE-2024-52963 to SSA-864900"
},
{
"date": "2025-06-10T00:00:00Z",
"legacy_version": "1.4",
"number": "5",
"summary": "Added newly published upstream vulnerability CVE-2025-22252"
},
{
"date": "2025-07-08T00:00:00Z",
"legacy_version": "1.5",
"number": "6",
"summary": "Added newly published upstream vulnerabilities CVE-2025-22254 and CVE-2025-22251"
}
],
"status": "final",
"version": "6"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "RUGGEDCOM APE1808",
"product_id": "1"
}
},
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "RUGGEDCOM APE1808",
"product_id": "2"
}
},
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "RUGGEDCOM APE1808",
"product_id": "3"
}
},
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "RUGGEDCOM APE1808",
"product_id": "4"
}
}
],
"category": "product_name",
"name": "RUGGEDCOM APE1808"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-42475",
"cwe": {
"id": "CWE-197",
"name": "Numeric Truncation Error"
},
"notes": [
{
"category": "summary",
"text": "A heap-based buffer overflow vulnerability [CWE-122]\u00a0in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"2"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Refer to Fortinet Blog for mitigation measures \nhttps://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity",
"product_ids": [
"2"
]
},
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"2"
]
}
],
"title": "CVE-2022-42475"
},
{
"cve": "CVE-2023-27997",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"2"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Refer to Fortinet Blog for mitigation measures \nhttps://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity",
"product_ids": [
"2"
]
},
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"2"
]
}
],
"title": "CVE-2023-27997"
},
{
"cve": "CVE-2024-3596",
"cwe": {
"id": "CWE-924",
"name": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel"
},
"notes": [
{
"category": "summary",
"text": "RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify responses Access-Reject or Access-Accept using a chosen-prefix collision attack against MD5 Response Authenticator signature.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"4"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"4"
]
}
],
"title": "CVE-2024-3596"
},
{
"cve": "CVE-2024-21762",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "summary",
"text": "A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"2"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Refer to Fortinet Blog for mitigation measures \nhttps://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity",
"product_ids": [
"2"
]
},
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"2"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"2"
]
}
],
"title": "CVE-2024-21762"
},
{
"cve": "CVE-2024-26013",
"cwe": {
"id": "CWE-923",
"name": "Improper Restriction of Communication Channel to Intended Endpoints"
},
"notes": [
{
"category": "summary",
"text": "A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15 and before 6.2.16, Fortinet FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9 and before 7.0.15, Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and before 6.2.13, Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and before 6.2.13, Fortinet FortiVoice version 7.0.0 through 7.0.2 before 6.4.8 and Fortinet FortiWeb before 7.4.2 may allow an unauthenticated attacker in a man-in-the-middle position to impersonate the management device (FortiCloud server or/and in certain conditions, FortiManager), via intercepting the FGFM authentication request between the management device and the managed device",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2024-26013"
},
{
"cve": "CVE-2024-35279",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "A stack-based buffer overflow vulnerability in Fortinet FortiOS version 7.2.4 through 7.2.8 and version 7.4.0 through 7.4.4 allows a remote unauthenticated attacker to execute arbitrary code or commands via crafted UDP packets through the CAPWAP control, provided the attacker were able to evade FortiOS stack protections and provided the fabric service is running on the exposed interface.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "mitigation",
"details": "For each interface, remove the fabric service or block CAPWAP-CONTROL access to port 5246 through a local-in policy (see \nhttps://fortiguard.fortinet.com/psirt/FG-IR-24-160)",
"product_ids": [
"1"
]
},
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2024-35279"
},
{
"cve": "CVE-2024-36504",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "An out-of-bounds read vulnerability [CWE-125] in FortiOS SSLVPN web portal versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, 7.0 all verisons, and 6.4 all versions may allow an authenticated attacker to perform a denial of service on the SSLVPN web portal via a specially crafted URL.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2024-36504"
},
{
"cve": "CVE-2024-40591",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"notes": [
{
"category": "summary",
"text": "An incorrect privilege assignment vulnerability in Fortinet FortiOS version 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.9 and before 7.0.15 allows an authenticated admin whose access profile has the Security Fabric permission to escalate their privileges to super-admin by connecting the targetted FortiGate to a malicious upstream FortiGate they control.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2024-40591"
},
{
"cve": "CVE-2024-45324",
"cwe": {
"id": "CWE-134",
"name": "Use of Externally-Controlled Format String"
},
"notes": [
{
"category": "summary",
"text": "A use of externally-controlled format string vulnerability in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, version 7.0.0 through 7.0.15 and before 6.4.15, FortiProxy version 7.4.0 through 7.4.6, version 7.2.0 through 7.2.12 and before 7.0.19, FortiPAM version 1.4.0 through 1.4.2 and before 1.3.1, FortiSRA version 1.4.0 through 1.4.2 and before 1.3.1 and FortiWeb version 7.4.0 through 7.4.5, version 7.2.0 through 7.2.10 and before 7.0.10 allows a privileged attacker to execute unauthorized code or commands via specially crafted HTTP or HTTPS commands.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2024-45324"
},
{
"cve": "CVE-2024-46665",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"notes": [
{
"category": "summary",
"text": "An insertion of sensitive information into sent data vulnerability [CWE-201] in FortiOS 7.6.0, 7.4.0 through 7.4.4 may allow an attacker in a man-in-the-middle position to retrieve the RADIUS accounting server shared secret via intercepting accounting-requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2024-46665"
},
{
"cve": "CVE-2024-46666",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "summary",
"text": "An allocation of resources without limits or throttling [CWE-770] vulnerability in FortiOS versions 7.6.0, versions 7.4.4 through 7.4.0, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow a remote unauthenticated attacker to prevent access to the GUI via specially crafted requests directed at specific endpoints.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2024-46666"
},
{
"cve": "CVE-2024-46668",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "summary",
"text": "An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiOS versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, versions 7.0.0 through 7.0.15, and versions 6.4.0 through 6.4.15 may allow an unauthenticated remote user to consume all system memory via multiple large file uploads.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2024-46668"
},
{
"cve": "CVE-2024-46669",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"notes": [
{
"category": "summary",
"text": "An\u00a0Integer Overflow or Wraparound vulnerability in version 7.4.4 and below, version 7.2.10 and below; FortiSASE version 23.4.b FortiOS tenant IPsec IKE service may allow an authenticated attacker to crash the IPsec tunnel via crafted requests, resulting in potential denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2024-46669"
},
{
"cve": "CVE-2024-46670",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "summary",
"text": "An\u00a0Out-of-bounds Read vulnerability in FortiOS version 7.6.0, version 7.4.4 and below, version 7.2.9 and below and FortiSASE FortiOS tenant version 24.3.b IPsec IKE service may allow an unauthenticated remote attacker to trigger memory consumption leading to Denial of Service via crafted requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2024-46670"
},
{
"cve": "CVE-2024-48884",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "summary",
"text": "A improper limitation of a pathname to a restricted directory (\u0027path traversal\u0027) in Fortinet FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiOS versions 7.6.0, 7.4.0 through 7.4.4, 7.2.5 through 7.2.9, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, 7.2.0 through 7.2.11, 7.0.0 through 7.0.18, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiManager Cloud versions 7.4.1 through 7.4.3 allows attacker to trigger an escalation of privilege via specially crafted packets.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2024-48884"
},
{
"cve": "CVE-2024-48885",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "summary",
"text": "A improper limitation of a pathname to a restricted directory (\u0027path traversal\u0027) in Fortinet FortiRecorder versions 7.2.0 through 7.2.1, 7.0.0 through 7.0.4, FortiWeb versions 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.10, 6.4.0 through 6.4.3, FortiVoice versions 7.0.0 through 7.0.4, 6.4.0 through 6.4.9, 6.0.0 through 6.0.12 allows attacker to escalate privilege via specially crafted packets.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2024-48885"
},
{
"cve": "CVE-2024-48886",
"cwe": {
"id": "CWE-1390",
"name": "Weak Authentication"
},
"notes": [
{
"category": "summary",
"text": "A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.17, 2.0.0 through 2.0.14, FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiManager Cloud versions 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3 allows attacker to execute unauthorized code or commands via a brute-force attack.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2024-48886"
},
{
"cve": "CVE-2024-50563",
"cwe": {
"id": "CWE-1390",
"name": "Weak Authentication"
},
"notes": [
{
"category": "summary",
"text": "A weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3, FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiManager Cloud versions 7.4.1 through 7.4.3 allows attacker to execute unauthorized code or commands via a brute-force attack.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2024-50563"
},
{
"cve": "CVE-2024-50565",
"cwe": {
"id": "CWE-300",
"name": "Channel Accessible by Non-Endpoint"
},
"notes": [
{
"category": "summary",
"text": "A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15 and 6.2.0 through 6.2.16, Fortinet FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0.0 through 7.0.15 and 2.0.0 through 2.0.14, Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and 6.2.0 through 6.2.13, Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and 6.2.0 through 6.2.13, Fortinet FortiVoice version 7.0.0 through 7.0.2, 6.4.0 through 6.4.8 and 6.0.0 through 6.0.12 and Fortinet FortiWeb version 7.4.0 through 7.4.2, 7.2.0 through 7.2.10, 7.0.0 through 7.0.10 allows an unauthenticated attacker in a man-in-the-middle position to impersonate the management device (FortiCloud server or/and in certain conditions, FortiManager), via intercepting the FGFM authentication request between the management device and the managed device",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2024-50565"
},
{
"cve": "CVE-2024-54021",
"cwe": {
"id": "CWE-113",
"name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)"
},
"notes": [
{
"category": "summary",
"text": "An improper neutralization of crlf sequences in http headers (\u0027http response splitting\u0027) in Fortinet FortiOS 7.2.0 through 7.6.0, FortiProxy 7.2.0 through 7.4.5 allows attacker to execute unauthorized code or commands via crafted HTTP header.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"1"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"1"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"1"
]
}
],
"title": "CVE-2024-54021"
},
{
"cve": "CVE-2025-22251",
"cwe": {
"id": "CWE-923",
"name": "Improper Restriction of Communication Channel to Intended Endpoints"
},
"notes": [
{
"category": "summary",
"text": "An improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to inject unauthorized sessions via crafted FGSP session synchronization packets.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"4"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RC:C",
"version": "3.1"
},
"products": [
"4"
]
}
],
"title": "CVE-2025-22251"
},
{
"cve": "CVE-2025-22252",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"notes": [
{
"category": "summary",
"text": "A missing authentication for critical function vulnerability in FortiOS, FortiProxy, and FortiSwitchManager TACACS+ configured to use a remote TACACS+ server for authentication, that has itself been configured to use ASCII authentication may allow an attacker with knowledge of an existing admin account to access the device as a valid admin via an authentication bypass.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"3"
]
},
"remediations": [
{
"category": "mitigation",
"details": "Use alternate authentication mechanism such as PAP, MSCHAP, and CHAP configurations other than ASCII authentication (see \nhttps://www.fortiguard.com/psirt/FG-IR-24-472)",
"product_ids": [
"3"
]
},
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"3"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"3"
]
}
],
"title": "CVE-2025-22252"
},
{
"cve": "CVE-2025-22254",
"cwe": {
"id": "CWE-269",
"name": "Improper Privilege Management"
},
"notes": [
{
"category": "summary",
"text": "An Improper Privilege Management vulnerability [CWE-269] affecting Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16 and before 6.4.15, FortiProxy version 7.6.0 through 7.6.1 and before 7.4.7 \u0026 FortiWeb version 7.6.0 through 7.6.1 and before 7.4.6 allows an authenticated attacker with at least read-only admin permissions to gain super-admin privileges via crafted requests to\u00a0Node.js websocket module.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"4"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Update Fortigate NGFW to V7.4.7. Contact customer support to receive patch and update information",
"product_ids": [
"4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H/RL:W/RC:C",
"version": "3.1"
},
"products": [
"4"
]
}
],
"title": "CVE-2025-22254"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…