Total
258583 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-27785 | 2024-07-09 | N/A | 5.4 MEDIUM | ||
| An improper neutralization of formula elements in a CSV File vulnerability [CWE-1236] in FortiAIOps version 2.0.0 may allow a remote authenticated attacker to execute arbitrary commands on a client's workstation via poisoned CSV reports. | |||||
| CVE-2024-37324 | 2024-07-09 | N/A | 8.8 HIGH | ||
| SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | |||||
| CVE-2024-27782 | 2024-07-09 | N/A | 8.1 HIGH | ||
| Multiple insufficient session expiration vulnerabilities [CWE-613] in FortiAIOps version 2.0.0 may allow an attacker to re-use stolen old session tokens to perform unauthorized operations via crafted requests. | |||||
| CVE-2024-37326 | 2024-07-09 | N/A | 8.8 HIGH | ||
| SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | |||||
| CVE-2023-40702 | 2024-07-09 | N/A | N/A | ||
| PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able to exploit this vulnerability to authenticate as a target user if they have existing knowledge of the target user’s first-factor credentials. | |||||
| CVE-2024-21308 | 2024-07-09 | N/A | 8.8 HIGH | ||
| SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | |||||
| CVE-2024-21425 | 2024-07-09 | N/A | 8.8 HIGH | ||
| SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | |||||
| CVE-2024-37334 | 2024-07-09 | N/A | 8.8 HIGH | ||
| Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability | |||||
| CVE-2024-27784 | 2024-07-09 | N/A | 8.8 HIGH | ||
| Multiple Exposure of sensitive information to an unauthorized actor vulnerabilities [CWE-200] in FortiAIOps version 2.0.0 may allow an authenticated, remote attacker to retrieve sensitive information from the API endpoint or log files. | |||||
| CVE-2024-33509 | 2024-07-09 | N/A | 4.8 MEDIUM | ||
| An improper certificate validation vulnerability [CWE-295] in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all versions may allow a remote and unauthenticated attacker in a Man-in-the-Middle position to decipher and/or tamper with the communication channel between the device and different endpoints used to fetch data for Web Application Firewall (WAF). | |||||
| CVE-2023-50178 | 2024-07-09 | N/A | 7.4 HIGH | ||
| An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2.0 through 7.2.3, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and various remote servers such as private SDN connectors and FortiToken Cloud. | |||||
| CVE-2024-37319 | 2024-07-09 | N/A | 8.8 HIGH | ||
| SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | |||||
| CVE-2024-21730 | 2024-07-09 | N/A | N/A | ||
| The fancyselect list field layout does not correctly escape inputs, leading to a self-XSS vector. | |||||
| CVE-2024-21731 | 2024-07-09 | N/A | N/A | ||
| Improper handling of input could lead to an XSS vector in the StringHelper::truncate method. | |||||
| CVE-2024-27783 | 2024-07-09 | N/A | 7.6 HIGH | ||
| Multiple cross-site request forgery (CSRF) vulnerabilities [CWE-352] in FortiAIOps version 2.0.0 may allow an unauthenticated remote attacker to perform arbitrary actions on behalf of an authenticated user via tricking the victim to execute malicious GET requests. | |||||
| CVE-2024-35256 | 2024-07-09 | N/A | 8.8 HIGH | ||
| SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | |||||
| CVE-2024-37336 | 2024-07-09 | N/A | 8.8 HIGH | ||
| SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | |||||
| CVE-2024-20701 | 2024-07-09 | N/A | 8.8 HIGH | ||
| SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | |||||
| CVE-2024-21335 | 2024-07-09 | N/A | 8.8 HIGH | ||
| SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability | |||||
| CVE-2023-40356 | 2024-07-09 | N/A | N/A | ||
| PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration could allow for a new MFA device to be paired with a target user account without requiring second-factor authentication from the target’s existing registered devices. A threat actor might be able to exploit this vulnerability to register their own MFA device with a target user’s account if they have existing knowledge of the target user’s first factor credential. | |||||