Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2025-12694 (GCVE-0-2025-12694)

Vulnerability from nvd – Published: 2026-06-04 12:04 – Updated: 2026-06-04 13:21

Title

Local Privilege Escalation in VPN Client

Summary

A local privilege escalation vulnerability exists in Forcepoint VPN Client that allows a local non-administrative user to escalate privileges to SYSTEM. This issue affects VPN Client for Windows: versions 6.11.3 and prior.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-250 - Execution with unnecessary privileges

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/Security…

Impacted products

1 product

Vendor	Product	Version
Forcepoint	VPN Client	Affected: 0 , ≤ 6.11.3 (semver)

Credits

Francisco Jose Carot Ripolles (KPMG Spain)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-12694",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-04T13:21:03.892648Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-04T13:21:13.818Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "VPN Client",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThanOrEqual": "6.11.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Francisco Jose Carot Ripolles (KPMG Spain)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003ccode\u003eA local privilege escalation vulnerability exists in Forcepoint VPN Client that allows a local non-administrative user to escalate privileges to SYSTEM. This issue affects VPN Client for Windows: versions 6.11.3 and prior.\u003c/code\u003e\u003c/p\u003e"
            }
          ],
          "value": "A local privilege escalation vulnerability exists in Forcepoint VPN Client that allows a local non-administrative user to escalate privileges to SYSTEM. This issue affects VPN Client for Windows: versions 6.11.3 and prior."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250 Execution with unnecessary privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-04T12:04:33.952Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/Security-Advisory-Local-Privilege-Escalation-in-VPN-Client-for-Windows"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Fixed in 6.12.0"
            }
          ],
          "value": "Fixed in 6.12.0"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Local Privilege Escalation in VPN Client",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2025-12694",
    "datePublished": "2026-06-04T12:04:33.952Z",
    "dateReserved": "2025-11-04T12:33:50.696Z",
    "dateUpdated": "2026-06-04T13:21:13.818Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-2274 (GCVE-0-2025-2274)

Vulnerability from nvd – Published: 2026-03-16 14:46 – Updated: 2026-03-16 18:36

Title

Stored Cross Site Scripting in Forcepoint Web Security

Summary

Improper Neutralization of Input During Web Page Generation in Forcepoint Web Security (On-Prem) on Windows allows Stored XSS.This issue affects Web Security through 8.5.6.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/Security…

Impacted products

1 product

Vendor	Product	Version
Forcepoint	Web Security (On-Prem)	Affected: 0 , ≤ 8.5.6 (semver)

Credits

Majchrowicz, Zdunek and Marcin Wyczechowski from AFINE Team.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-2274",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-16T18:36:41.987362Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-16T18:36:51.535Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Web Security (On-Prem)",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThanOrEqual": "8.5.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Majchrowicz, Zdunek and Marcin Wyczechowski from AFINE Team."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation in Forcepoint Web Security (On-Prem) on Windows allows Stored XSS.\u003cp\u003eThis issue affects Web Security through 8.5.6.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation in Forcepoint Web Security (On-Prem) on Windows allows Stored XSS.This issue affects Web Security through 8.5.6."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-16T14:46:50.015Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/Security-Advisory-Stored-Cross-Site-Scripting-in-Forcepoint-Web-Security"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Fixed in 8.5.7"
            }
          ],
          "value": "Fixed in 8.5.7"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Stored Cross Site Scripting in Forcepoint Web Security",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2025-2274",
    "datePublished": "2026-03-16T14:46:50.015Z",
    "dateReserved": "2025-03-13T07:59:18.904Z",
    "dateUpdated": "2026-03-16T18:36:51.535Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-12690 (GCVE-0-2025-12690)

Vulnerability from nvd – Published: 2026-03-11 15:36 – Updated: 2026-03-11 16:10

Title

Local Privilege Escalation in NGFW Engine

Summary

Execution with unnecessary privileges in Forcepoint NGFW Engine allows local privilege escalation.This issue affects NGFW Engine through 6.10.19, through 7.3.0, through 7.2.4, through 7.1.10.

Severity

7.3 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-250 - Execution with unnecessary privileges

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/Security…

Impacted products

1 product

Vendor	Product	Version
Forcepoint	NGFW Engine	Affected: 0 , ≤ 6.10.19 (semver) Affected: 0 , ≤ 7.3.0 (semver) Affected: 0 , ≤ 7.2.4 (semver) Affected: 0 , ≤ 7.1.10 (semver)

Credits

Francesco Caserta, Andrea Lomuscio and Alessandro Ruggieri of the Italian National Cybersecurity Agency

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-12690",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-11T16:10:07.438779Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-11T16:10:28.588Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "NGFW Engine",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThanOrEqual": "6.10.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Francesco Caserta, Andrea Lomuscio and Alessandro Ruggieri of the Italian National Cybersecurity Agency"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Execution with unnecessary privileges in Forcepoint NGFW Engine allows local privilege escalation.\u003cp\u003eThis issue affects NGFW Engine through 6.10.19,\u0026nbsp;through 7.3.0, through 7.2.4, through 7.1.10.\u003c/p\u003e"
            }
          ],
          "value": "Execution with unnecessary privileges in Forcepoint NGFW Engine allows local privilege escalation.This issue affects NGFW Engine through 6.10.19,\u00a0through 7.3.0, through 7.2.4, through 7.1.10."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        },
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122 Privilege Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250 Execution with unnecessary privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-11T15:36:32.755Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/Security-Advisory-Local-Privilege-Escalation-in-NGFW-Engine"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan\u003eUpgrade to versions 6.10.20, 7.1.11, 7.2.5 and 7.3.1.\u003c/span\u003e"
            }
          ],
          "value": "Upgrade to versions 6.10.20, 7.1.11, 7.2.5 and 7.3.1."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local Privilege Escalation in NGFW Engine",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2025-12690",
    "datePublished": "2026-03-11T15:36:32.755Z",
    "dateReserved": "2025-11-04T10:07:46.152Z",
    "dateUpdated": "2026-03-11T16:10:28.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14026 (GCVE-0-2025-14026)

Vulnerability from nvd – Published: 2026-01-06 14:45 – Updated: 2026-01-06 16:04

Title

Vulnerable Python version used in Forcepoint One DLP Client

Summary

Forcepoint One DLP Client, version 23.04.5642 (and possibly newer versions), includes a restricted version of Python 2.5.4 that prevents use of the ctypes library. ctypes is a foreign function interface (FFI) for Python, enabling calls to DLLs/shared libraries, memory allocation, and direct code execution. It was demonstrated that these restrictions could be bypassed.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

Assigner

certcc

References

3 references

URL	Tags
https://support.forcepoint.com/s/article/000042256
https://kb.cert.org/vuls/id/420440
https://www.kb.cert.org/vuls/id/420440

Impacted products

1 product

Vendor	Product	Version
Forcepoint	Forcepoint One Endpoint (F1E)	Affected: 23.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14026",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-06T15:19:38.095565Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-06T15:49:19.033Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-06T16:04:41.042Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.kb.cert.org/vuls/id/420440"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Forcepoint One Endpoint (F1E)",
          "vendor": "Forcepoint",
          "versions": [
            {
              "status": "affected",
              "version": "23.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Forcepoint One DLP Client, version 23.04.5642 (and possibly newer versions), includes a restricted version of Python 2.5.4 that prevents use of the ctypes library. ctypes is a foreign function interface (FFI) for Python, enabling calls to DLLs/shared libraries, memory allocation, and direct code execution. It was demonstrated that these restrictions could be bypassed."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1104 Use of Unmaintained Third-Party Components",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-1395 Dependency on a Vulnerable Third-Party Component",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-676 Use of Potentially Dangerous Function",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-06T14:46:30.519Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/000042256"
        },
        {
          "url": "https://kb.cert.org/vuls/id/420440"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Vulnerable Python version used in Forcepoint One DLP Client",
      "x_generator": {
        "engine": "VINCE 3.0.31",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2025-14026"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2025-14026",
    "datePublished": "2026-01-06T14:45:29.207Z",
    "dateReserved": "2025-12-04T13:44:38.515Z",
    "dateUpdated": "2026-01-06T16:04:41.042Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-2272 (GCVE-0-2025-2272)

Vulnerability from nvd – Published: 2025-05-22 12:23 – Updated: 2025-05-22 15:34

Title

Privilege Escalation and Arbitrary code execution in F1E Endpoint

Summary

Uncontrolled Search Path Element vulnerability in Forcepoint FIE Endpoint allows Privilege Escalation, Code Injection, Hijacking a privileged process.This issue affects FIE Endpoint: before 25.05.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

7.3 (High)


                        
                          CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-427 - Uncontrolled Search Path Element

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/Security…

Impacted products

1 product

Vendor	Product	Version
Forcepoint	FIE Endpoint	Affected: 0 , < 25.05 (semver)

Credits

Brecht Snijders, Triskele Labs

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-2272",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T15:21:11.131007Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T15:34:12.408Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "FIE Endpoint",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThan": "25.05",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Brecht Snijders, Triskele Labs"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Uncontrolled Search Path Element vulnerability in Forcepoint FIE Endpoint allows Privilege Escalation, Code Injection, Hijacking a privileged process.\u003cp\u003eThis issue affects FIE Endpoint: before 25.05.\u003c/p\u003e"
            }
          ],
          "value": "Uncontrolled Search Path Element vulnerability in Forcepoint FIE Endpoint allows Privilege Escalation, Code Injection, Hijacking a privileged process.This issue affects FIE Endpoint: before 25.05."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        },
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242 Code Injection"
            }
          ]
        },
        {
          "capecId": "CAPEC-234",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-234 Hijacking a privileged process"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427 Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:23:08.609Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/Security-Advisory-Privilege-Escalation-and-Arbitrary-code-execution-in-F1E-Endpoint"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to F1E\u0026nbsp;\n\n25.05"
            }
          ],
          "value": "Update to F1E\u00a0\n\n25.05"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Privilege Escalation and Arbitrary code execution in F1E Endpoint",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2025-2272",
    "datePublished": "2025-05-22T12:23:05.287Z",
    "dateReserved": "2025-03-13T07:52:24.499Z",
    "dateUpdated": "2025-05-22T15:34:12.408Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-9103 (GCVE-0-2024-9103)

Vulnerability from nvd – Published: 2025-03-24 16:06 – Updated: 2025-03-24 18:43

Title

Persistent XSS in blocked messages

Summary

Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security (Blocked Messages module) allows Stored XSS. This issue affects Email Security through 8.5.5.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-83 - Improper Neutralization of Script in Attributes in a Web Page

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/Security…

Impacted products

1 product

Vendor	Product	Version
Forcepoint	Email Security	Affected: 0 , ≤ 8.5.5 (semver)

Credits

Anis Messaoudi and CPA Bank

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9103",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-24T16:24:28.407549Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-24T18:43:09.484Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Blocked Messages"
          ],
          "product": "Email Security",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThanOrEqual": "8.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Anis Messaoudi and CPA Bank"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security (Blocked Messages module) allows Stored XSS.\u003cbr\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eThis issue affects Email Security through 8.5.5.\u003c/span\u003e"
            }
          ],
          "value": "Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security (Blocked Messages module) allows Stored XSS.\nThis issue affects Email Security through 8.5.5."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-83",
              "description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-24T16:06:39.980Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/Security-Advisory-Email-Security-Gateway-Persistent-XSS-in-Blocked-Messages"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Customers should install ESG 8.5.5 HF005"
            }
          ],
          "value": "Customers should install ESG 8.5.5 HF005"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Persistent XSS in blocked messages",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2024-9103",
    "datePublished": "2025-03-24T16:06:39.980Z",
    "dateReserved": "2024-09-23T14:33:13.196Z",
    "dateUpdated": "2025-03-24T18:43:09.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-2166 (GCVE-0-2024-2166)

Vulnerability from nvd – Published: 2024-09-04 21:37 – Updated: 2024-09-05 14:23

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Email Security (Real Time Monitor modules) allows Reflected XSS.This issue affects Email Security: before 8.5.5 HF003.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/000042397

Impacted products

2 products

Vendor	Product	Version
Forcepoint	Email Security	Affected: 0 , < 8.5.5 HF003 (custom)
forcepoint	email_security	Affected: 0 , < 8.5.5 HF003 (custom) cpe:2.3:a:forcepoint:email_security::::::::

Date Public

2024-09-04 19:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:forcepoint:email_security:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "email_security",
            "vendor": "forcepoint",
            "versions": [
              {
                "lessThan": "8.5.5 HF003",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-2166",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-05T14:21:40.434840Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-05T14:23:10.788Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "modules": [
            "Real Time Monitor"
          ],
          "product": "Email Security",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThan": "8.5.5 HF003",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-09-04T19:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Email Security (Real Time Monitor modules) allows Reflected XSS.\u003cp\u003eThis issue affects Email Security: before 8.5.5 HF003.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Email Security (Real Time Monitor modules) allows Reflected XSS.This issue affects Email Security: before 8.5.5 HF003."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-04T21:37:17.923Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/000042397"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2024-2166",
    "datePublished": "2024-09-04T21:37:17.923Z",
    "dateReserved": "2024-03-04T15:39:26.796Z",
    "dateUpdated": "2024-09-05T14:23:10.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-6452 (GCVE-0-2023-6452)

Vulnerability from nvd – Published: 2024-08-22 15:21 – Updated: 2024-08-22 19:50

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS. The Forcepoint Web Security portal allows administrators to generate detailed reports on user requests made through the Web proxy. It has been determined that the "user agent" field in the Transaction Viewer is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability, which can be exploited by any user who can route traffic through the Forcepoint Web proxy. This vulnerability enables unauthorized attackers to execute JavaScript within the browser context of a Forcepoint administrator, thereby allowing them to perform actions on the administrator's behalf. Such a breach could lead to unauthorized access or modifications, posing a significant security risk. This issue affects Web Security: before 8.5.6.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/000042212

Impacted products

2 products

Vendor	Product	Version
Forcepoint	Web Security	Affected: 0 , < 8.5.6 (semver)
forcepoint	web_security	Affected: 0 , < 8.5.6 (custom) cpe:2.3:a:forcepoint:web_security::::::::

Date Public

2024-08-21 19:00

Credits

Jasper Westerman Yanick de Pater Harm Blankers from REQON

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:forcepoint:web_security:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "web_security",
            "vendor": "forcepoint",
            "versions": [
              {
                "lessThan": "8.5.6",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6452",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-22T19:48:57.338566Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-22T19:50:08.561Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "modules": [
            "Transaction Viewer"
          ],
          "product": "Web Security",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThan": "8.5.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The\n User Agent field must be displayed in the Transaction Viewer, it is not by default. Users \nshould avoid adding the User Agent field to the Transaction Viewer until the workaround is implemented or Web Security is upgraded to version 8.5.6 or later."
            }
          ],
          "value": "The\n User Agent field must be displayed in the Transaction Viewer, it is not by default. Users \nshould avoid adding the User Agent field to the Transaction Viewer until the workaround is implemented or Web Security is upgraded to version 8.5.6 or later."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jasper Westerman"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Yanick de Pater"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Harm Blankers from REQON"
        }
      ],
      "datePublic": "2024-08-21T19:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eImproper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\nThe\n Forcepoint Web Security portal allows administrators to generate \ndetailed reports on user requests made through the Web proxy. It has \nbeen determined that the \"user agent\" field in the Transaction Viewer is\n vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability, \nwhich can be exploited by any user who can route traffic through the \nForcepoint Web proxy.\u003cbr\u003e\u003cbr\u003eThis \nvulnerability enables unauthorized attackers to execute JavaScript \nwithin the browser context of a Forcepoint administrator, thereby \nallowing them to perform actions on the administrator\u0027s behalf. Such a \nbreach could lead to unauthorized access or modifications, posing a \nsignificant security risk.\n\n\n\n\u003cbr\u003e\u003c/div\u003e\u003cp\u003eThis issue affects Web Security: before 8.5.6.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS.\n\n\n\n\n\nThe\n Forcepoint Web Security portal allows administrators to generate \ndetailed reports on user requests made through the Web proxy. It has \nbeen determined that the \"user agent\" field in the Transaction Viewer is\n vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability, \nwhich can be exploited by any user who can route traffic through the \nForcepoint Web proxy.\n\nThis \nvulnerability enables unauthorized attackers to execute JavaScript \nwithin the browser context of a Forcepoint administrator, thereby \nallowing them to perform actions on the administrator\u0027s behalf. Such a \nbreach could lead to unauthorized access or modifications, posing a \nsignificant security risk.\n\n\n\n\n\n\nThis issue affects Web Security: before 8.5.6."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-22T15:21:32.329Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/000042212"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCustomers should update to version 8.5.6 or follow the steps outlined in\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.forcepoint.com/s/article/000042212\"\u003ehttps://support.forcepoint.com/s/article/000042212\u003c/a\u003e\u0026nbsp;for version 8.5.5.\u003c/p\u003e"
            }
          ],
          "value": "Customers should update to version 8.5.6 or follow the steps outlined in\u00a0 https://support.forcepoint.com/s/article/000042212 \u00a0for version 8.5.5."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\nUsers \nshould avoid adding the User Agent field to the Transaction Viewer until the workaround is implemented or Web Security is upgraded to version 8.5.6 or later.\n\n\n\n\u003c/p\u003e"
            }
          ],
          "value": "Users \nshould avoid adding the User Agent field to the Transaction Viewer until the workaround is implemented or Web Security is upgraded to version 8.5.6 or later."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2023-6452",
    "datePublished": "2024-08-22T15:21:32.329Z",
    "dateReserved": "2023-11-30T22:10:02.333Z",
    "dateUpdated": "2024-08-22T19:50:08.561Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-5451 (GCVE-0-2023-5451)

Vulnerability from nvd – Published: 2024-03-04 15:54 – Updated: 2024-08-02 07:59

Summary

Forcepoint NGFW Security Management Center Management Server has SMC Downloads optional feature to offer standalone Management Client downloads and ECA configuration downloads. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Next Generation Firewall Security Management Center (SMC Downloads feature) allows Reflected XSS. This issue affects Next Generation Firewall Security Management Center : before 6.10.13, from 6.11.0 before 7.1.2.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/000042395

Impacted products

1 product

Vendor	Product	Version
Forcepoint	Next Generation Firewall Security Management Center	Affected: 0 , < 6.10.13 (semver) Affected: 6.11.0 , < 7.1.2 (semver)

Credits

Hazem Osama

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-5451",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-04T18:45:01.138819Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:22:06.923Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:59:44.679Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.forcepoint.com/s/article/000042395"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "SMC Downloads"
          ],
          "product": "Next Generation Firewall Security Management Center ",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThan": "6.10.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.1.2",
              "status": "affected",
              "version": "6.11.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Hazem Osama"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\nForcepoint\n NGFW Security Management Center Management Server has SMC Downloads \noptional feature to offer standalone Management Client downloads and ECA\n configuration downloads.\u003c/div\u003e\u003cdiv\u003eImproper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Next Generation Firewall Security Management Center (SMC Downloads feature) allows Reflected XSS.\u003c/div\u003e\u003cp\u003eThis issue affects Next Generation Firewall Security Management Center : before 6.10.13, from 6.11.0 before 7.1.2.\u003c/p\u003e"
            }
          ],
          "value": "Forcepoint\n NGFW Security Management Center Management Server has SMC Downloads \noptional feature to offer standalone Management Client downloads and ECA\n configuration downloads.\n\nImproper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Next Generation Firewall Security Management Center (SMC Downloads feature) allows Reflected XSS.\n\nThis issue affects Next Generation Firewall Security Management Center : before 6.10.13, from 6.11.0 before 7.1.2.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-04T15:54:48.825Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/000042395"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\nThe vulnerability has been fixed in the SMC releases 6.10.13 and 7.1.2.\n\n\u003cbr\u003e"
            }
          ],
          "value": "The vulnerability has been fixed in the SMC releases 6.10.13 and 7.1.2.\n\n\n"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\nTo\n limit the access to the SMC, Forcepoint recommends that the SMC \ndeployment is placed in a dedicated, secure network segment without \nthird-party servers and limited network access. \nAlternatively, Forcepoint recommends disabling Management Server SMC Downloads feature.\n\n\n\n\u003cbr\u003e"
            }
          ],
          "value": "To\n limit the access to the SMC, Forcepoint recommends that the SMC \ndeployment is placed in a dedicated, secure network segment without \nthird-party servers and limited network access. \nAlternatively, Forcepoint recommends disabling Management Server SMC Downloads feature.\n\n\n\n\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2023-5451",
    "datePublished": "2024-03-04T15:54:43.711Z",
    "dateReserved": "2023-10-06T16:47:41.779Z",
    "dateUpdated": "2024-08-02T07:59:44.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-1705 (GCVE-0-2023-1705)

Vulnerability from nvd – Published: 2024-01-29 16:29 – Updated: 2025-05-29 15:09

Summary

Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege Escalation, Functionality Bypass.This issue affects F|One SmartEdge Agent: before 1.7.0.230330-554.

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/000042333

Impacted products

1 product

Vendor	Product	Version
Forcepoint	F\|One SmartEdge Agent	Affected: 0 , < 1.7.0.230330-554 (custom)

Credits

Odyssey CyberSecurity IthacaLabs

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:57:24.815Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.forcepoint.com/s/article/000042333"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-1705",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T15:50:44.442396Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-29T15:09:02.909Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "modules": [
            "bgAutoinstaller service"
          ],
          "platforms": [
            "Windows"
          ],
          "product": "F|One SmartEdge Agent",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThan": "1.7.0.230330-554",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Odyssey CyberSecurity IthacaLabs"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege Escalation, Functionality Bypass.\u003cp\u003eThis issue affects F|One SmartEdge Agent: before 1.7.0.230330-554.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege Escalation, Functionality Bypass.This issue affects F|One SmartEdge Agent: before 1.7.0.230330-554.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        },
        {
          "capecId": "CAPEC-554",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-554 Functionality Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-29T16:29:42.485Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/000042333"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2023-1705",
    "datePublished": "2024-01-29T16:29:18.716Z",
    "dateReserved": "2023-03-29T15:00:18.124Z",
    "dateUpdated": "2025-05-29T15:09:02.909Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-2080 (GCVE-0-2023-2080)

Vulnerability from nvd – Published: 2023-06-15 22:18 – Updated: 2024-12-11 20:33

Summary

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud allows Blind SQL Injection.

Severity

8.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/000041871

Impacted products

1 product

Vendor	Product	Version
Forcepoint	Cloud Security Gateway (CSG)	Unaffected: TBD

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:12:19.936Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.forcepoint.com/s/article/000041871"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-2080",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T20:33:24.376436Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T20:33:35.315Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "Portal",
          "platforms": [
            "Web Cloud Security Gateway",
            "Email Security Cloud"
          ],
          "product": "Cloud Security Gateway (CSG) ",
          "vendor": "Forcepoint",
          "versions": [
            {
              "status": "unaffected",
              "version": "TBD"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud allows Blind SQL Injection."
            }
          ],
          "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud allows Blind SQL Injection."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-7",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-7 Blind SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-15T22:18:58.058Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/000041871"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2023-2080",
    "datePublished": "2023-06-15T22:18:58.058Z",
    "dateReserved": "2023-04-14T19:12:38.266Z",
    "dateUpdated": "2024-12-11T20:33:35.315Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26292 (GCVE-0-2023-26292)

Vulnerability from nvd – Published: 2023-03-29 16:29 – Updated: 2025-02-12 16:16

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud (login_submit.mhtml modules), Forcepoint Web Security Portal on Hybrid (login_submit.mhtml modules) allows Reflected XSS.This issue affects Cloud Security Gateway (CSG): before 03/29/2023; Web Security: before 03/29/2023.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/000041617

Impacted products

2 products

Vendor	Product	Version
Forcepoint	Cloud Security Gateway (CSG)	Affected: 0 , < 03/29/2023 (date)
Forcepoint	Web Security	Affected: 0 , < 03/29/2023 (date)

Credits

Pratik Kumar Singh (@4rch_54m431)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:46:24.204Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.forcepoint.com/s/article/000041617"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-26292",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-12T16:15:59.415758Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T16:16:21.065Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "login_submit.mhtml"
          ],
          "packageName": "Portal",
          "platforms": [
            "Web Cloud Security Gateway",
            "Email Security Cloud"
          ],
          "product": "Cloud Security Gateway (CSG)",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThan": "03/29/2023",
              "status": "affected",
              "version": "0",
              "versionType": "date"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "login_submit.mhtml"
          ],
          "packageName": "Portal",
          "platforms": [
            "Hybrid"
          ],
          "product": "Web Security",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThan": "03/29/2023",
              "status": "affected",
              "version": "0",
              "versionType": "date"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Pratik Kumar Singh (@4rch_54m431)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud (login_submit.mhtml modules), Forcepoint Web Security Portal on Hybrid (login_submit.mhtml modules) allows Reflected XSS.\u003cp\u003eThis issue affects Cloud Security Gateway (CSG): before 03/29/2023; Web Security: before 03/29/2023.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud (login_submit.mhtml modules), Forcepoint Web Security Portal on Hybrid (login_submit.mhtml modules) allows Reflected XSS.This issue affects Cloud Security Gateway (CSG): before 03/29/2023; Web Security: before 03/29/2023.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-29T20:45:29.616Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/000041617"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2023-26292",
    "datePublished": "2023-03-29T16:29:49.674Z",
    "dateReserved": "2023-02-21T15:40:43.662Z",
    "dateUpdated": "2025-02-12T16:16:21.065Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-26291 (GCVE-0-2023-26291)

Vulnerability from nvd – Published: 2023-03-29 16:29 – Updated: 2025-02-12 16:53

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud (login_form.mhtml modules), Forcepoint Web Security Portal on Hybrid (login_form.mhtml modules) allows Reflected XSS.This issue affects Cloud Security Gateway (CSG): before 03/29/2023; Web Security: before 03/29/2023.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/000041617

Impacted products

2 products

Vendor	Product	Version
Forcepoint	Cloud Security Gateway (CSG)	Affected: 0 , < 03/29/2023 (date)
Forcepoint	Web Security	Affected: 0 , < 03/29/2023 (date)

Credits

Pratik Kumar Singh (@4rch_54m431)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T11:46:24.340Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.forcepoint.com/s/article/000041617"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-26291",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-12T16:53:23.303250Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T16:53:28.747Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "login_form.mhtml"
          ],
          "packageName": "Portal",
          "platforms": [
            "Web Cloud Security Gateway",
            "Email Security Cloud"
          ],
          "product": "Cloud Security Gateway (CSG)",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThan": "03/29/2023",
              "status": "affected",
              "version": "0",
              "versionType": "date"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "login_form.mhtml"
          ],
          "packageName": "Portal",
          "platforms": [
            "Hybrid"
          ],
          "product": "Web Security",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThan": "03/29/2023",
              "status": "affected",
              "version": "0",
              "versionType": "date"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Pratik Kumar Singh (@4rch_54m431)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud (login_form.mhtml modules), Forcepoint Web Security Portal on Hybrid (login_form.mhtml modules) allows Reflected XSS.\u003cp\u003eThis issue affects Cloud Security Gateway (CSG): before 03/29/2023; Web Security: before 03/29/2023.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud (login_form.mhtml modules), Forcepoint Web Security Portal on Hybrid (login_form.mhtml modules) allows Reflected XSS.This issue affects Cloud Security Gateway (CSG): before 03/29/2023; Web Security: before 03/29/2023.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-29T20:45:19.046Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/000041617"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2023-26291",
    "datePublished": "2023-03-29T16:29:41.294Z",
    "dateReserved": "2023-02-21T15:40:43.662Z",
    "dateUpdated": "2025-02-12T16:53:28.747Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-12694 (GCVE-0-2025-12694)

Vulnerability from cvelistv5 – Published: 2026-06-04 12:04 – Updated: 2026-06-04 13:21

Title

Local Privilege Escalation in VPN Client

Summary

A local privilege escalation vulnerability exists in Forcepoint VPN Client that allows a local non-administrative user to escalate privileges to SYSTEM. This issue affects VPN Client for Windows: versions 6.11.3 and prior.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-250 - Execution with unnecessary privileges

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/Security…

Impacted products

1 product

Vendor	Product	Version
Forcepoint	VPN Client	Affected: 0 , ≤ 6.11.3 (semver)

Credits

Francisco Jose Carot Ripolles (KPMG Spain)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-12694",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-04T13:21:03.892648Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-04T13:21:13.818Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "VPN Client",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThanOrEqual": "6.11.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Francisco Jose Carot Ripolles (KPMG Spain)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003ccode\u003eA local privilege escalation vulnerability exists in Forcepoint VPN Client that allows a local non-administrative user to escalate privileges to SYSTEM. This issue affects VPN Client for Windows: versions 6.11.3 and prior.\u003c/code\u003e\u003c/p\u003e"
            }
          ],
          "value": "A local privilege escalation vulnerability exists in Forcepoint VPN Client that allows a local non-administrative user to escalate privileges to SYSTEM. This issue affects VPN Client for Windows: versions 6.11.3 and prior."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250 Execution with unnecessary privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-04T12:04:33.952Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/Security-Advisory-Local-Privilege-Escalation-in-VPN-Client-for-Windows"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Fixed in 6.12.0"
            }
          ],
          "value": "Fixed in 6.12.0"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Local Privilege Escalation in VPN Client",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2025-12694",
    "datePublished": "2026-06-04T12:04:33.952Z",
    "dateReserved": "2025-11-04T12:33:50.696Z",
    "dateUpdated": "2026-06-04T13:21:13.818Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-2274 (GCVE-0-2025-2274)

Vulnerability from cvelistv5 – Published: 2026-03-16 14:46 – Updated: 2026-03-16 18:36

Title

Stored Cross Site Scripting in Forcepoint Web Security

Summary

Improper Neutralization of Input During Web Page Generation in Forcepoint Web Security (On-Prem) on Windows allows Stored XSS.This issue affects Web Security through 8.5.6.

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/Security…

Impacted products

1 product

Vendor	Product	Version
Forcepoint	Web Security (On-Prem)	Affected: 0 , ≤ 8.5.6 (semver)

Credits

Majchrowicz, Zdunek and Marcin Wyczechowski from AFINE Team.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-2274",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-16T18:36:41.987362Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-16T18:36:51.535Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Web Security (On-Prem)",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThanOrEqual": "8.5.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Majchrowicz, Zdunek and Marcin Wyczechowski from AFINE Team."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation in Forcepoint Web Security (On-Prem) on Windows allows Stored XSS.\u003cp\u003eThis issue affects Web Security through 8.5.6.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation in Forcepoint Web Security (On-Prem) on Windows allows Stored XSS.This issue affects Web Security through 8.5.6."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-16T14:46:50.015Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/Security-Advisory-Stored-Cross-Site-Scripting-in-Forcepoint-Web-Security"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Fixed in 8.5.7"
            }
          ],
          "value": "Fixed in 8.5.7"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Stored Cross Site Scripting in Forcepoint Web Security",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2025-2274",
    "datePublished": "2026-03-16T14:46:50.015Z",
    "dateReserved": "2025-03-13T07:59:18.904Z",
    "dateUpdated": "2026-03-16T18:36:51.535Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-12690 (GCVE-0-2025-12690)

Vulnerability from cvelistv5 – Published: 2026-03-11 15:36 – Updated: 2026-03-11 16:10

Title

Local Privilege Escalation in NGFW Engine

Summary

Execution with unnecessary privileges in Forcepoint NGFW Engine allows local privilege escalation.This issue affects NGFW Engine through 6.10.19, through 7.3.0, through 7.2.4, through 7.1.10.

Severity

7.3 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-250 - Execution with unnecessary privileges

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/Security…

Impacted products

1 product

Vendor	Product	Version
Forcepoint	NGFW Engine	Affected: 0 , ≤ 6.10.19 (semver) Affected: 0 , ≤ 7.3.0 (semver) Affected: 0 , ≤ 7.2.4 (semver) Affected: 0 , ≤ 7.1.10 (semver)

Credits

Francesco Caserta, Andrea Lomuscio and Alessandro Ruggieri of the Italian National Cybersecurity Agency

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-12690",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-11T16:10:07.438779Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-11T16:10:28.588Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "NGFW Engine",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThanOrEqual": "6.10.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Francesco Caserta, Andrea Lomuscio and Alessandro Ruggieri of the Italian National Cybersecurity Agency"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Execution with unnecessary privileges in Forcepoint NGFW Engine allows local privilege escalation.\u003cp\u003eThis issue affects NGFW Engine through 6.10.19,\u0026nbsp;through 7.3.0, through 7.2.4, through 7.1.10.\u003c/p\u003e"
            }
          ],
          "value": "Execution with unnecessary privileges in Forcepoint NGFW Engine allows local privilege escalation.This issue affects NGFW Engine through 6.10.19,\u00a0through 7.3.0, through 7.2.4, through 7.1.10."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        },
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122 Privilege Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250 Execution with unnecessary privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-11T15:36:32.755Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/Security-Advisory-Local-Privilege-Escalation-in-NGFW-Engine"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan\u003eUpgrade to versions 6.10.20, 7.1.11, 7.2.5 and 7.3.1.\u003c/span\u003e"
            }
          ],
          "value": "Upgrade to versions 6.10.20, 7.1.11, 7.2.5 and 7.3.1."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Local Privilege Escalation in NGFW Engine",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2025-12690",
    "datePublished": "2026-03-11T15:36:32.755Z",
    "dateReserved": "2025-11-04T10:07:46.152Z",
    "dateUpdated": "2026-03-11T16:10:28.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-14026 (GCVE-0-2025-14026)

Vulnerability from cvelistv5 – Published: 2026-01-06 14:45 – Updated: 2026-01-06 16:04

Title

Vulnerable Python version used in Forcepoint One DLP Client

Summary

Forcepoint One DLP Client, version 23.04.5642 (and possibly newer versions), includes a restricted version of Python 2.5.4 that prevents use of the ctypes library. ctypes is a foreign function interface (FFI) for Python, enabling calls to DLLs/shared libraries, memory allocation, and direct code execution. It was demonstrated that these restrictions could be bypassed.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

Assigner

certcc

References

3 references

URL	Tags
https://support.forcepoint.com/s/article/000042256
https://kb.cert.org/vuls/id/420440
https://www.kb.cert.org/vuls/id/420440

Impacted products

1 product

Vendor	Product	Version
Forcepoint	Forcepoint One Endpoint (F1E)	Affected: 23.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-14026",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-06T15:19:38.095565Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-06T15:49:19.033Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-06T16:04:41.042Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.kb.cert.org/vuls/id/420440"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Forcepoint One Endpoint (F1E)",
          "vendor": "Forcepoint",
          "versions": [
            {
              "status": "affected",
              "version": "23.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Forcepoint One DLP Client, version 23.04.5642 (and possibly newer versions), includes a restricted version of Python 2.5.4 that prevents use of the ctypes library. ctypes is a foreign function interface (FFI) for Python, enabling calls to DLLs/shared libraries, memory allocation, and direct code execution. It was demonstrated that these restrictions could be bypassed."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1104 Use of Unmaintained Third-Party Components",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-1395 Dependency on a Vulnerable Third-Party Component",
              "lang": "en"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "CWE-676 Use of Potentially Dangerous Function",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-06T14:46:30.519Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/000042256"
        },
        {
          "url": "https://kb.cert.org/vuls/id/420440"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Vulnerable Python version used in Forcepoint One DLP Client",
      "x_generator": {
        "engine": "VINCE 3.0.31",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2025-14026"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2025-14026",
    "datePublished": "2026-01-06T14:45:29.207Z",
    "dateReserved": "2025-12-04T13:44:38.515Z",
    "dateUpdated": "2026-01-06T16:04:41.042Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-2272 (GCVE-0-2025-2272)

Vulnerability from cvelistv5 – Published: 2025-05-22 12:23 – Updated: 2025-05-22 15:34

Title

Privilege Escalation and Arbitrary code execution in F1E Endpoint

Summary

Uncontrolled Search Path Element vulnerability in Forcepoint FIE Endpoint allows Privilege Escalation, Code Injection, Hijacking a privileged process.This issue affects FIE Endpoint: before 25.05.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

7.3 (High)


                        
                          CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-427 - Uncontrolled Search Path Element

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/Security…

Impacted products

1 product

Vendor	Product	Version
Forcepoint	FIE Endpoint	Affected: 0 , < 25.05 (semver)

Credits

Brecht Snijders, Triskele Labs

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-2272",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T15:21:11.131007Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T15:34:12.408Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "FIE Endpoint",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThan": "25.05",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Brecht Snijders, Triskele Labs"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Uncontrolled Search Path Element vulnerability in Forcepoint FIE Endpoint allows Privilege Escalation, Code Injection, Hijacking a privileged process.\u003cp\u003eThis issue affects FIE Endpoint: before 25.05.\u003c/p\u003e"
            }
          ],
          "value": "Uncontrolled Search Path Element vulnerability in Forcepoint FIE Endpoint allows Privilege Escalation, Code Injection, Hijacking a privileged process.This issue affects FIE Endpoint: before 25.05."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        },
        {
          "capecId": "CAPEC-242",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-242 Code Injection"
            }
          ]
        },
        {
          "capecId": "CAPEC-234",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-234 Hijacking a privileged process"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427 Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-22T12:23:08.609Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/Security-Advisory-Privilege-Escalation-and-Arbitrary-code-execution-in-F1E-Endpoint"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to F1E\u0026nbsp;\n\n25.05"
            }
          ],
          "value": "Update to F1E\u00a0\n\n25.05"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Privilege Escalation and Arbitrary code execution in F1E Endpoint",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2025-2272",
    "datePublished": "2025-05-22T12:23:05.287Z",
    "dateReserved": "2025-03-13T07:52:24.499Z",
    "dateUpdated": "2025-05-22T15:34:12.408Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-9103 (GCVE-0-2024-9103)

Vulnerability from cvelistv5 – Published: 2025-03-24 16:06 – Updated: 2025-03-24 18:43

Title

Persistent XSS in blocked messages

Summary

Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security (Blocked Messages module) allows Stored XSS. This issue affects Email Security through 8.5.5.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-83 - Improper Neutralization of Script in Attributes in a Web Page

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/Security…

Impacted products

1 product

Vendor	Product	Version
Forcepoint	Email Security	Affected: 0 , ≤ 8.5.5 (semver)

Credits

Anis Messaoudi and CPA Bank

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9103",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-24T16:24:28.407549Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-24T18:43:09.484Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "Blocked Messages"
          ],
          "product": "Email Security",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThanOrEqual": "8.5.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Anis Messaoudi and CPA Bank"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security (Blocked Messages module) allows Stored XSS.\u003cbr\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eThis issue affects Email Security through 8.5.5.\u003c/span\u003e"
            }
          ],
          "value": "Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security (Blocked Messages module) allows Stored XSS.\nThis issue affects Email Security through 8.5.5."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-83",
              "description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-24T16:06:39.980Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/Security-Advisory-Email-Security-Gateway-Persistent-XSS-in-Blocked-Messages"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Customers should install ESG 8.5.5 HF005"
            }
          ],
          "value": "Customers should install ESG 8.5.5 HF005"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Persistent XSS in blocked messages",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2024-9103",
    "datePublished": "2025-03-24T16:06:39.980Z",
    "dateReserved": "2024-09-23T14:33:13.196Z",
    "dateUpdated": "2025-03-24T18:43:09.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-2166 (GCVE-0-2024-2166)

Vulnerability from cvelistv5 – Published: 2024-09-04 21:37 – Updated: 2024-09-05 14:23

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Email Security (Real Time Monitor modules) allows Reflected XSS.This issue affects Email Security: before 8.5.5 HF003.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/000042397

Impacted products

2 products

Vendor	Product	Version
Forcepoint	Email Security	Affected: 0 , < 8.5.5 HF003 (custom)
forcepoint	email_security	Affected: 0 , < 8.5.5 HF003 (custom) cpe:2.3:a:forcepoint:email_security::::::::

Date Public

2024-09-04 19:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:forcepoint:email_security:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "email_security",
            "vendor": "forcepoint",
            "versions": [
              {
                "lessThan": "8.5.5 HF003",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-2166",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-05T14:21:40.434840Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-05T14:23:10.788Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "modules": [
            "Real Time Monitor"
          ],
          "product": "Email Security",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThan": "8.5.5 HF003",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-09-04T19:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Email Security (Real Time Monitor modules) allows Reflected XSS.\u003cp\u003eThis issue affects Email Security: before 8.5.5 HF003.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Email Security (Real Time Monitor modules) allows Reflected XSS.This issue affects Email Security: before 8.5.5 HF003."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-04T21:37:17.923Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/000042397"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2024-2166",
    "datePublished": "2024-09-04T21:37:17.923Z",
    "dateReserved": "2024-03-04T15:39:26.796Z",
    "dateUpdated": "2024-09-05T14:23:10.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-6452 (GCVE-0-2023-6452)

Vulnerability from cvelistv5 – Published: 2024-08-22 15:21 – Updated: 2024-08-22 19:50

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS. The Forcepoint Web Security portal allows administrators to generate detailed reports on user requests made through the Web proxy. It has been determined that the "user agent" field in the Transaction Viewer is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability, which can be exploited by any user who can route traffic through the Forcepoint Web proxy. This vulnerability enables unauthorized attackers to execute JavaScript within the browser context of a Forcepoint administrator, thereby allowing them to perform actions on the administrator's behalf. Such a breach could lead to unauthorized access or modifications, posing a significant security risk. This issue affects Web Security: before 8.5.6.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/000042212

Impacted products

2 products

Vendor	Product	Version
Forcepoint	Web Security	Affected: 0 , < 8.5.6 (semver)
forcepoint	web_security	Affected: 0 , < 8.5.6 (custom) cpe:2.3:a:forcepoint:web_security::::::::

Date Public

2024-08-21 19:00

Credits

Jasper Westerman Yanick de Pater Harm Blankers from REQON

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:forcepoint:web_security:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "web_security",
            "vendor": "forcepoint",
            "versions": [
              {
                "lessThan": "8.5.6",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6452",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-22T19:48:57.338566Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-22T19:50:08.561Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "modules": [
            "Transaction Viewer"
          ],
          "product": "Web Security",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThan": "8.5.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The\n User Agent field must be displayed in the Transaction Viewer, it is not by default. Users \nshould avoid adding the User Agent field to the Transaction Viewer until the workaround is implemented or Web Security is upgraded to version 8.5.6 or later."
            }
          ],
          "value": "The\n User Agent field must be displayed in the Transaction Viewer, it is not by default. Users \nshould avoid adding the User Agent field to the Transaction Viewer until the workaround is implemented or Web Security is upgraded to version 8.5.6 or later."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jasper Westerman"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Yanick de Pater"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Harm Blankers from REQON"
        }
      ],
      "datePublic": "2024-08-21T19:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eImproper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\nThe\n Forcepoint Web Security portal allows administrators to generate \ndetailed reports on user requests made through the Web proxy. It has \nbeen determined that the \"user agent\" field in the Transaction Viewer is\n vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability, \nwhich can be exploited by any user who can route traffic through the \nForcepoint Web proxy.\u003cbr\u003e\u003cbr\u003eThis \nvulnerability enables unauthorized attackers to execute JavaScript \nwithin the browser context of a Forcepoint administrator, thereby \nallowing them to perform actions on the administrator\u0027s behalf. Such a \nbreach could lead to unauthorized access or modifications, posing a \nsignificant security risk.\n\n\n\n\u003cbr\u003e\u003c/div\u003e\u003cp\u003eThis issue affects Web Security: before 8.5.6.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Web Security (Transaction Viewer) allows Stored XSS.\n\n\n\n\n\nThe\n Forcepoint Web Security portal allows administrators to generate \ndetailed reports on user requests made through the Web proxy. It has \nbeen determined that the \"user agent\" field in the Transaction Viewer is\n vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability, \nwhich can be exploited by any user who can route traffic through the \nForcepoint Web proxy.\n\nThis \nvulnerability enables unauthorized attackers to execute JavaScript \nwithin the browser context of a Forcepoint administrator, thereby \nallowing them to perform actions on the administrator\u0027s behalf. Such a \nbreach could lead to unauthorized access or modifications, posing a \nsignificant security risk.\n\n\n\n\n\n\nThis issue affects Web Security: before 8.5.6."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-22T15:21:32.329Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/000042212"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCustomers should update to version 8.5.6 or follow the steps outlined in\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.forcepoint.com/s/article/000042212\"\u003ehttps://support.forcepoint.com/s/article/000042212\u003c/a\u003e\u0026nbsp;for version 8.5.5.\u003c/p\u003e"
            }
          ],
          "value": "Customers should update to version 8.5.6 or follow the steps outlined in\u00a0 https://support.forcepoint.com/s/article/000042212 \u00a0for version 8.5.5."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\nUsers \nshould avoid adding the User Agent field to the Transaction Viewer until the workaround is implemented or Web Security is upgraded to version 8.5.6 or later.\n\n\n\n\u003c/p\u003e"
            }
          ],
          "value": "Users \nshould avoid adding the User Agent field to the Transaction Viewer until the workaround is implemented or Web Security is upgraded to version 8.5.6 or later."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2023-6452",
    "datePublished": "2024-08-22T15:21:32.329Z",
    "dateReserved": "2023-11-30T22:10:02.333Z",
    "dateUpdated": "2024-08-22T19:50:08.561Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-5451 (GCVE-0-2023-5451)

Vulnerability from cvelistv5 – Published: 2024-03-04 15:54 – Updated: 2024-08-02 07:59

Summary

Forcepoint NGFW Security Management Center Management Server has SMC Downloads optional feature to offer standalone Management Client downloads and ECA configuration downloads. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Next Generation Firewall Security Management Center (SMC Downloads feature) allows Reflected XSS. This issue affects Next Generation Firewall Security Management Center : before 6.10.13, from 6.11.0 before 7.1.2.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/000042395

Impacted products

1 product

Vendor	Product	Version
Forcepoint	Next Generation Firewall Security Management Center	Affected: 0 , < 6.10.13 (semver) Affected: 6.11.0 , < 7.1.2 (semver)

Credits

Hazem Osama

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-5451",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-04T18:45:01.138819Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:22:06.923Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:59:44.679Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.forcepoint.com/s/article/000042395"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "SMC Downloads"
          ],
          "product": "Next Generation Firewall Security Management Center ",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThan": "6.10.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.1.2",
              "status": "affected",
              "version": "6.11.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Hazem Osama"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\nForcepoint\n NGFW Security Management Center Management Server has SMC Downloads \noptional feature to offer standalone Management Client downloads and ECA\n configuration downloads.\u003c/div\u003e\u003cdiv\u003eImproper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Next Generation Firewall Security Management Center (SMC Downloads feature) allows Reflected XSS.\u003c/div\u003e\u003cp\u003eThis issue affects Next Generation Firewall Security Management Center : before 6.10.13, from 6.11.0 before 7.1.2.\u003c/p\u003e"
            }
          ],
          "value": "Forcepoint\n NGFW Security Management Center Management Server has SMC Downloads \noptional feature to offer standalone Management Client downloads and ECA\n configuration downloads.\n\nImproper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Forcepoint Next Generation Firewall Security Management Center (SMC Downloads feature) allows Reflected XSS.\n\nThis issue affects Next Generation Firewall Security Management Center : before 6.10.13, from 6.11.0 before 7.1.2.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-04T15:54:48.825Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/000042395"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\nThe vulnerability has been fixed in the SMC releases 6.10.13 and 7.1.2.\n\n\u003cbr\u003e"
            }
          ],
          "value": "The vulnerability has been fixed in the SMC releases 6.10.13 and 7.1.2.\n\n\n"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\nTo\n limit the access to the SMC, Forcepoint recommends that the SMC \ndeployment is placed in a dedicated, secure network segment without \nthird-party servers and limited network access. \nAlternatively, Forcepoint recommends disabling Management Server SMC Downloads feature.\n\n\n\n\u003cbr\u003e"
            }
          ],
          "value": "To\n limit the access to the SMC, Forcepoint recommends that the SMC \ndeployment is placed in a dedicated, secure network segment without \nthird-party servers and limited network access. \nAlternatively, Forcepoint recommends disabling Management Server SMC Downloads feature.\n\n\n\n\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2023-5451",
    "datePublished": "2024-03-04T15:54:43.711Z",
    "dateReserved": "2023-10-06T16:47:41.779Z",
    "dateUpdated": "2024-08-02T07:59:44.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-1705 (GCVE-0-2023-1705)

Vulnerability from cvelistv5 – Published: 2024-01-29 16:29 – Updated: 2025-05-29 15:09

Summary

Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege Escalation, Functionality Bypass.This issue affects F|One SmartEdge Agent: before 1.7.0.230330-554.

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/000042333

Impacted products

1 product

Vendor	Product	Version
Forcepoint	F\|One SmartEdge Agent	Affected: 0 , < 1.7.0.230330-554 (custom)

Credits

Odyssey CyberSecurity IthacaLabs

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:57:24.815Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.forcepoint.com/s/article/000042333"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-1705",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T15:50:44.442396Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-29T15:09:02.909Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "modules": [
            "bgAutoinstaller service"
          ],
          "platforms": [
            "Windows"
          ],
          "product": "F|One SmartEdge Agent",
          "vendor": "Forcepoint",
          "versions": [
            {
              "lessThan": "1.7.0.230330-554",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Odyssey CyberSecurity IthacaLabs"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege Escalation, Functionality Bypass.\u003cp\u003eThis issue affects F|One SmartEdge Agent: before 1.7.0.230330-554.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege Escalation, Functionality Bypass.This issue affects F|One SmartEdge Agent: before 1.7.0.230330-554.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-233",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-233 Privilege Escalation"
            }
          ]
        },
        {
          "capecId": "CAPEC-554",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-554 Functionality Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-29T16:29:42.485Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/000042333"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2023-1705",
    "datePublished": "2024-01-29T16:29:18.716Z",
    "dateReserved": "2023-03-29T15:00:18.124Z",
    "dateUpdated": "2025-05-29T15:09:02.909Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-2080 (GCVE-0-2023-2080)

Vulnerability from cvelistv5 – Published: 2023-06-15 22:18 – Updated: 2024-12-11 20:33

Summary

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud allows Blind SQL Injection.

Severity

8.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

forcepoint

References

1 reference

URL	Tags
https://support.forcepoint.com/s/article/000041871

Impacted products

1 product

Vendor	Product	Version
Forcepoint	Cloud Security Gateway (CSG)	Unaffected: TBD

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:12:19.936Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.forcepoint.com/s/article/000041871"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-2080",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T20:33:24.376436Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T20:33:35.315Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "Portal",
          "platforms": [
            "Web Cloud Security Gateway",
            "Email Security Cloud"
          ],
          "product": "Cloud Security Gateway (CSG) ",
          "vendor": "Forcepoint",
          "versions": [
            {
              "status": "unaffected",
              "version": "TBD"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud allows Blind SQL Injection."
            }
          ],
          "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in Forcepoint Cloud Security Gateway (CSG) Portal on Web Cloud Security Gateway, Email Security Cloud allows Blind SQL Injection."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-7",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-7 Blind SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-15T22:18:58.058Z",
        "orgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
        "shortName": "forcepoint"
      },
      "references": [
        {
          "url": "https://support.forcepoint.com/s/article/000041871"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e23ea22c-8c39-4eff-8980-2881e5ae54e2",
    "assignerShortName": "forcepoint",
    "cveId": "CVE-2023-2080",
    "datePublished": "2023-06-15T22:18:58.058Z",
    "dateReserved": "2023-04-14T19:12:38.266Z",
    "dateUpdated": "2024-12-11T20:33:35.315Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

VAR-200411-0171

Vulnerability from variot - Updated: 2024-03-18 21:58

The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read. OpenSSL for, Kerberos using a cipher suite SSL/TLS When communicating, there is a flaw in not properly checking the communication data during the key exchange during handshake, and it is intentionally created. Please note that this vulnerability OpenSSL Applications and systems using the library may also be affected. For more detailed information about other systems, NISCC-224012 (JVN) , NISCC Advisory 224012 (CPNI Advisory 00389) Please also check.OpenSSL Applications that use this crash and cause a denial of service. (DoS) may become a state. OpenSSL is an open source SSL implementation used to implement high-strength encryption of network communications. It is now widely used in various network applications.

When using Kerberos ciphersuites, there is a flaw in the SSL / TLS handshake code. A remote attacker can construct a special SSL / TLS handshake and send it to a server configured with Kerberos ciphersuites. Most applications do not use Kerberos ciphersuites. It is therefore not affected by this vulnerability. For the first issue, a NULL-pointer assignment can be triggered by attackers during SSL/TLS handshake exchanges. Versions 0.9.6c to 0.9.6k (inclusive) and from 0.9.7a to 0.9.7c (inclusive) are vulnerable. The vendor has reported that this vulnerability may not be a threat to many, because it occurs only when Kerberos ciphersuites are in use, an uncommon configuration. This entry will be retired when individual BID records are created for each issue. *Note: A third denial-of-service vulnerability included in the announcement was discovered affecting 0.9.6 and fixed in 0.9.6d. Multiple security vulnerabilities are reported to affect Apple Mac OS X; updates are available. Apache is prone to five vulnerabilities ranging from buffer overflows to access validation vulnerabilities. The CVE Mitre candidate IDs CAN-2005-1344, CAN-2004-0942, CAN-2004-0885, CAN-2004-1083, and CAN-2004-1084 are assigned to these issues. Appkit is prone to three vulnerabilities. Two of these could result in arbitrary code execution, the third could permit the creation of local accounts. The CVE Mitre candidate IDs CAN-2005-2501, CAN-2005-2502, and CAN-2005-2503 are assigned to these issues. Bluetooth is prone to a vulnerability regarding authentication bypass. The CVE Mitre candidate ID CAN-2005-2504 is assigned to this issue. CoreFoundation is prone to two vulnerabilities, one resulting in a buffer overflow, the other a denial-of-service vulnerability. The CVE Mitre candidate IDs CAN-2005-2505 and CAN-2005-2506 are assigned to these issues. CUPS is prone to two vulnerabilities resulting in a denial of service until the service can be restarted. The CVE Mitre candidate IDs CAN-2005-2525 and CAN-2005-2526 are assigned to these issues. Directory Services is prone to three vulnerabilities. These issues vary from buffer overflow, unauthorized account creation and deletion, and privilege escalation. The CVE Mitre candidate IDs CAN-2005-2507, CAN-2005-2508 and CAN-2005-2519 are assigned to these issues. HItoolbox is prone to a vulnerability that could result in information disclosure. The CVE Mitre candidate ID CAN-2005-2513 is assigned to this issue. Kerberos is prone to five vulnerabilities that may result in a buffer overflow, execution of arbitrary code, and root compromise. The CVE Mitre candidate IDs CAN-2004-1189, CAN-2005-1174, CAN-2005-1175, CAN-2005-1689, and CAN-2005-2511 are assigned to these issues. loginwindow is prone to a vulnerability that could permit a user to gain access to other logged-in accounts. The CVE Mitre candidate ID CAN-2005-2509 is assigned to this issue. Mail is prone to a vulnerability regarding the loss of privacy when remote images are loaded into HTML email. The CVE Mitre candidate ID CAN-2005-2512 is assigned to this issue. MySQL is prone to three vulnerabilities that include arbitrary code execution by remote authenticated users. The CVE Mitre candidate IDs CAN-2005-0709, CAN-2005-0710, and CAN-2005-0711 are assigned to these issues. OpenSSL is prone to two vulnerabilities resulting in denial of service. The CVE Mitre candidate IDs CAN-2004-0079 and CAN-2004-0112 are assigned to these issues. ping is prone to a vulnerability that could allow local privilege escalation and arbitrary code execution. The CVE Mitre candidate ID CAN-2005-2514 is assigned to this issue. QuartzComposerScreenSaver is prone to a vulnerability that could allow users to open pages while the RSS Visualizer screen is locked. The CVE Mitre candidate ID CAN-2005-2515 is assigned to this issue. Safari is prone to two vulnerabilities that could result in arbitrary command execution or have information submitted to an incorrect site. The CVE Mitre candidate IDs CAN-2005-2516 and CAN-2005-2517 are assigned to these issues. SecurityInterface is prone to a vulnerability that could expose recently used passwords. The CVE Mitre candidate ID CAN-2005-2520 is assigned to this issue. servermgrd is prone to a buffer-overflow vulnerability that could ultimately lead to the execution of arbitrary code. The CVE Mitre candidate ID CAN-2005-2518 is assigned to this issue. servermgr_ipfilter is prone to a vulnerability regarding firewall settings not always being written to the Active Rules. The CVE Mitre candidate ID CAN-2005-2510 is assigned to this issue. SquirrelMail is prone to two vulnerabilities including a cross-site scripting issue. The CVE Mitre candidate IDs CAN-2005-1769 and CAN-2005-2095 are assigned to these issues. traceroute is prone to a vulnerability that could result in arbitrary code execution and privilege escalation. The CVE Mitre candidate ID CAN-2005-2521 is assigned to this issue. WebKit is affected by a vulnerability that could result in code execution regarding a malformed PDF file. The CVE Mitre candidate ID CAN-2005-2522 is assigned to this issue. Weblog Server is prone to multiple cross-site scripting vulnerabilities. The CVE Mitre candidate ID CAN-2005-2523 is assigned to this issue. X11 is prone to a vulnerability that could result in arbitrary code execution. The CVE Mitre candidate ID CAN-2005-0605 is assigned to this issue. zlib is prone to two denial-of-service vulnerabilities that may ultimately lead to arbitrary code execution. The CVE Mitre candidate IDs CAN-2005-2096 and CAN-2005-1849 are assigned to these issues. These vulnerabilities will be separated into individual BIDs upon further analysis of the issues. It supports a variety of encryption algorithms, including symmetric ciphers, hash algorithms, security hashing algorithm, etc.

TITLE: Fedora update for openssl096b

SECUNIA ADVISORY ID: SA17381

VERIFY ADVISORY: http://secunia.com/advisories/17381/

CRITICAL: Moderately critical

IMPACT: DoS

WHERE:

From remote

OPERATING SYSTEM: Fedora Core 3 http://secunia.com/product/4222/

DESCRIPTION: Fedora has issued an update for openssl096b.

For more information: SA10133 SA11139

SOLUTION: Apply updated packages.

Fedora Core 3: http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/

8d68e4b430aa7c5ca067c12866ae694e SRPMS/openssl096b-0.9.6b-21.42.src.rpm 54a9e78a2fdd625b9dc9121e09eb4398 x86_64/openssl096b-0.9.6b-21.42.x86_64.rpm c5c6174e23eba8d038889d08f49231b8 x86_64/debug/openssl096b-debuginfo-0.9.6b-21.42.x86_64.rpm 56b63fc150d0c099b2e4f0950e21005b x86_64/openssl096b-0.9.6b-21.42.i386.rpm 56b63fc150d0c099b2e4f0950e21005b i386/openssl096b-0.9.6b-21.42.i386.rpm 93195495585c7e9789041c75b1ed5380 i386/debug/openssl096b-debuginfo-0.9.6b-21.42.i386.rpm

OTHER REFERENCES: SA10133: http://secunia.com/advisories/10133/

SA11139: http://secunia.com/advisories/11139/

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

  Cisco Security Advisory: Cisco OpenSSL Implementation Vulnerability

Revision 1.0

For Public Release 2004 March 17 at 1300 UTC (GMT)

 ----------------------------------------------------------------------

Contents

 Summary
 Affected Products
 Details
 Impact
 Software Versions and Fixes
 Obtaining Fixed Software
 Workarounds
 Exploitation and Public Announcements
 Status of This Notice: INTERIM
 Distribution
 Revision History
 Cisco Security Procedures

 ----------------------------------------------------------------------

Summary

A new vulnerability in the OpenSSL implementation for SSL has been announced on March 17, 2004.

An affected network device running an SSL server based on an affected OpenSSL implementation may be vulnerable to a Denial of Service (DoS) attack. There are workarounds available to mitigate the effects of this vulnerability on Cisco products in the workaround section of this advisory. Cisco is providing fixed software, and recommends that customers upgrade to it when it is available.

This advisory will be posted at http://www.cisco.com/warp/public/707/cisco-sa-20040317-openssl.shtml.

 * Cisco IOS 12.1(11)E and later in the 12.1E release train. Only crypto
   images (56i and k2) are vulnerable for the Cisco 7100 and 7200 Series
   Routers. 
 * Cisco IOS 12.2SY release train. Only crypto images (k8, k9 and k91)
   are vulnerable for the Cisco Catalyst 6500 Series and Cisco 7600
   Series Routers. 
 * Cisco PIX Firewall
 * Cisco Firewall Services Module (FWSM) for the Cisco Catalyst 6500
   Series and Cisco 7600 Series routers
 * Cisco MDS 9000 Series Multilayer Switch
 * Cisco Content Service Switch (CSS) 11000 series
 * Cisco Global Site Selector (GSS) 4480
 * CiscoWorks Common Services (CWCS) version 2.2 and CiscoWorks Common
   Management Foundation (CMF) version 2.1
 * Cisco Access Registrar (CAR)

The following products have their SSL implementation based on the OpenSSL code and are not affected by this vulnerability.

 * Cisco Secure Intrusion Detection System (NetRanger) appliance. This
   includes the IDS-42xx appliances, NM-CIDS and WS-SVS-IDSM2. 
 * Cisco SN 5428 and SN 5428-2 Storage Router
 * Cisco CNS Configuration Engine
 * Cisco Network Analysis Modules (NAM) for the Cisco Catalyst 6000 and
   6500 Series switches and Cisco 7600 Series routers
 * Cisco SIP Proxy Server (SPS)
 * CiscoWorks 1105 Hosting Solution Engine (HSE)
 * CiscoWorks 1105 Wireless LAN Solution Engine (WLSE)
 * Cisco Ethernet Subscriber Solution Engine (ESSE)

The following products, which implement SSL, are not affected by this vulnerability.

 * Cisco VPN 3000 Series Concentrators

CatOS does not implement SSL and is not vulnerable. This vulnerability is still being actively investigated across Cisco products and status of some products has still not been determined.

Details

Secure Sockets Layer (SSL), is a protocol used to encrypt the data transferred over an TCP session. SSL in Cisco products is mainly used by the HyperText Transfer Protocol Secure (HTTPS) web service for which the default TCP port is 443. The affected products, listed above, are only vulnerable if they have the HTTPS service enabled and the access to the service is not limited to trusted hosts or network management workstations.

To check if the HTTPS service is enabled one can do the following:

1. Check the configuration on the device to verify the status of the
   HTTPS service. 
2. Try to connect to the device using a standard web browser that
   supports SSL using a URL similar to https://ip_address_of_device/. 
3. Try and connect to the default HTTPS port, TCP 443, using Telnet. 
   telnet ip_address_of_device 443. If the session connects the service
   is enabled and accessible.

Testing by the OpenSSL development team has uncovered a null-pointer assignment in the do_change_cipher_spec() function. This crash on many Cisco products would cause the device to reload.

A third vulnerability described in the NISCC advisory is a bug in older versions of OpenSSL, versions before 0.9.6d, that can also lead to a Denial of Service attack. None of the Cisco OpenSSL implementations are known to be affected by this older OpenSSL issue.

 * Cisco IOS - All 12.1(11)E and later IOS software crypto (56i and k2)
   image releases in the 12.1E release train for the Cisco 7100 and 7200
   Series Routers are affected by this vulnerability. All IOS software
   crypto (k8, k9, and k91) image releases in the 12.2SY release train
   for the Cisco Catalyst 6500 Series and Cisco 7600 Series Routers are
   affected by this vulnerability. The SSH implementation in IOS is not
   dependent on any OpenSSL code. SSH implementations in IOS do not
   handle certificates, yet, and therefore do not use any SSL code for
   SSH. OpenSSL in 12.1E and 12.2SY release trains is only used for
   providing the HTTPS and VPN Device Manager (VDM) services. This
   vulnerability is documented in the Cisco Bug Toolkit (registered
   customers only) as Bug ID CSCee00041. The HTTPS web service, that uses
   the OpenSSL code, on the device is disabled by default. The no ip http
   secure-server command may be used to disable the HTTPS web service on
   the device, if required. The SSH and IPSec services in IOS are not
   vulnerable to this vulnerability. 
 * Cisco PIX Firewall - PIX 6.x releases are affected by this
   vulnerability. PIX 5.x releases do not contain any SSL code and are
   not vulnerable. This vulnerability is documented in the Cisco Bug
   Toolkit (registered customers only) as Bug ID CSCed90672. 
 * Cisco Firewall Services Module (FWSM) for the Cisco Catalyst 6500
   Series and Cisco 7600 Series routers - This vulnerability is
   documented in the Cisco Bug Toolkit (registered customers only) as Bug
   ID CSCee02055. 
 * Cisco MDS 9000 Series Multilayer Switches - This vulnerability is
   documented in the Cisco Bug Toolkit (registered customers only) as Bug
   ID CSCed96246. 
 * Cisco Content Service Switch (CSS) 11000 series - WebNS version 6.x
   and 7.x are affected by this vulnerability. This vulnerability is
   documented in the Cisco Bug Toolkit (registered customers only) as Bug
   ID CSCee01234 for SCM and is documented in the Cisco Bug Toolkit
   (registered customers only) as Bug ID CSCee01240 for the SSL module. 
 * Cisco Global Site Selector (GSS) 4480 - This vulnerability is
   documented in the Cisco Bug Toolkit (registered customers only) as Bug
   ID CSCee01057. 
 * CiscoWorks Common Services (CWCS) version 2.2 and CiscoWorks Common
   Management Foundation (CMF) version 2.1 - This vulnerability is
   documented in the Cisco Bug Toolkit (registered customers only) as Bug
   ID CSCsa13748. 
 * Cisco Access Registrar (CAR) - This vulnerability is documented in the
   Cisco Bug Toolkit (registered customers only) as Bug ID CSCee01956.

The Internetworking Terms and Cisco Systems Acronyms online guides can be found at http://www.cisco.com/univercd/cc/td/doc/cisintwk/.

Impact

An affected network device running an SSL server based on the OpenSSL implementation may be vulnerable to a Denial of Service (DoS) attack.

Software Versions and Fixes

 * Cisco IOS -

   +----------------------------------------+
   |Release|  Fixed Releases  |Availability |
   | Train |                  |             |
   |-------+------------------+-------------|
   |12.2SY |12.2(14)SY4       |March 25     |
   |-------+------------------+-------------|
   |       |12.1(13)E14       |April 8      |
   |12.1E  |12.1.(19)E7       |April 8      |
   |       |12.1(20)E3        |April 26     |
   +----------------------------------------+

 * Cisco PIX Firewall - The vulnerability is fixed in software releases
   6.0(4)102, 6.1(5)102, 6.2(3)107, and 6.3(3)124. These engineering
   builds may be obtained by contacting the Cisco Technical Assistance
   Center (TAC). TAC Contact information is given in the Obtaining Fixed
   Software section below. 
 * Cisco Firewall Services Module (FWSM) for the Cisco Catalyst 6500
   Series and Cisco 7600 Series routers - The vulnerability is fixed in
   software release 1.1.3(14) which will be available by Monday, 22 of
   March, 2004. This engineering builds may be obtained by contacting the
   Cisco Technical Assistance Center (TAC). TAC Contact information is
   given in the Obtaining Fixed Software section below. 
 * Cisco MDS 9000 Series Multilayer Switches - No fixed software release
   or software availability date has been determined yet. 
 * Cisco Content Service Switch (CSS) 11000 series -No fixed software
   release or software availability date has been determined yet. 
 * Cisco Global Site Selector (GSS) 4480 - No fixed software release or
   software availability date has been determined yet. 
 * CiscoWorks Common Services (CWCS) version 2.2 and CiscoWorks Common
   Management Foundation (CMF) version 2.1 - No fixed software release or
   software availability date has been determined yet. 
 * Cisco Access Registrar (CAR) - The vulnerability is fixed in software
   release 3.5.0.12 which will be available by Friday, 26 of March, 2004.

Obtaining Fixed Software

Cisco is offering free software upgrades to address this vulnerability for all affected customers.

Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, Customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set forth at the Cisco Connection Online Software Center at http://www.cisco.com/public/sw-center/sw-usingswc.shtml.

Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com/tacpage/sw-center. To access the software download URL, you must be a registered user and you must be logged in.

Customers whose Cisco products are provided or maintained through a prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers, should contact that support organization for assistance with obtaining the software upgrade(s).

Customers who purchase direct from Cisco but who do not hold a Cisco service contract and customers who purchase through third-party vendors but are unsuccessful at obtaining fixed software through their point of sale should get their upgrades by contacting the Cisco Technical Assistance Center (TAC) using the contact information listed below. In these cases, customers are entitled to obtain a free upgrade to a later version of the same release or as indicated by the applicable corrected software version in the Software Versions and Fixes section (noted above).

Cisco TAC contacts are as follows:

 * +1 800 553 2447 (toll free from within North America)
 * +1 408 526 7209 (toll call from anywhere in the world)
 * e-mail: tac@cisco.com

See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including special localized telephone numbers and instructions and e-mail addresses for use in various languages.

Please have your product serial number available and give the URL of this notice as evidence of your entitlement to a upgrade. Upgrades for non-contract customers must be requested through the TAC.

Please do not contact either "psirt@cisco.com" or "security-alert@cisco.com" for software upgrades.

Workarounds

The Cisco PSIRT recommends that affected users upgrade to a fixed software version of code as soon as it is available.

 * Restrict access to the HTTPS server on the network device. Allow
   access to the network device only from trusted workstations by using
   access lists / MAC filters that are available on the affected
   platforms. 
 * Disable the SSL server / service on the network device. This
   workaround must be weighed against the need for secure communications
   with the vulnerable device.

Exploitation and Public Announcements

The Cisco PSIRT is not aware of any malicious use of the vulnerability described in this advisory.

Status of This Notice: INTERIM

This is an interim advisory. Although Cisco cannot guarantee the accuracy of all statements in this advisory, all of the facts have been checked to the best of our ability. Cisco does not anticipate issuing updated versions of this advisory unless there is some material change in the facts. Should there be a significant change in the facts, Cisco may update this advisory.

A stand-alone copy or paraphrase of the text of this security advisory that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.

Distribution

This advisory will be posted on Cisco's worldwide website at http://www.cisco.com/warp/public/707/cisco-sa-20040317-openssl.shtml .

In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key having the fingerprint 8C82 5207 0CA9 ED40 1DD2 EE2A 7B31 A8CF 32B6 B590 and is posted to the following e-mail and Usenet news recipients.

 * cust-security-announce@cisco.com
 * first-teams@first.org (includes CERT/CC)
 * bugtraq@securityfocus.com
 * vulnwatch@vulnwatch.org
 * cisco@spot.colorado.edu
 * cisco-nsp@puck.nether.net
 * full-disclosure@lists.netsys.com
 * comp.dcom.sys.cisco@newsgate.cisco.com

Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates.

Revision History

Cisco Security Procedures

Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/warp/public/707/sec_incident_response.shtml. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt.

This advisory is copyright 2004 by Cisco Systems, Inc. This advisory may be redistributed freely after the release date given at the top of the text, provided that redistributed copies are complete and unmodified, including all date and version information.

 ----------------------------------------------------------------------

-----BEGIN PGP SIGNATURE----- Comment: PGP Signed by Sharad Ahlawat, Cisco Systems PSIRT

iD8DBQFAWFvZezGozzK2tZARAqIwAKDXDMLAY6eDYyU8y1MhKZUto2SRxwCg+oid 7AhsNlLsNVSLwTRKTHSigu0= =gtba -----END PGP SIGNATURE----- .

OpenSSL 0.9.7d and OpenSSL 0.9.6m are available for download via HTTP and FTP from the following master locations (you can find the various FTP mirrors under http://www.openssl.org/source/mirror.html):

ftp://ftp.openssl.org/source/

The distribution file names are:

o openssl-0.9.7d.tar.gz
  MD5 checksum: 1b49e90fc8a75c3a507c0a624529aca5

o openssl-0.9.6m.tar.gz [normal]
  MD5 checksum: 1b63bfdca1c37837dddde9f1623498f9
o openssl-engine-0.9.6m.tar.gz [engine]
  MD5 checksum: 4c39d2524bd466180f9077f8efddac8c

The checksums were calculated using the following command:

openssl md5 openssl-0.9*.tar.gz

Credits

Patches for these issues were created by Dr Stephen Henson (steve@openssl.org) of the OpenSSL core team. The OpenSSL team would like to thank Codenomicon for supplying the TLS Test Tool which was used to discover these vulnerabilities, and Joe Orton of Red Hat for performing the majority of the testing.

References

http://www.codenomicon.com/testtools/tls/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0079 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0112

URL for this Security Advisory: http://www.openssl.org/news/secadv_20040317.txt

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200411-0171",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "freebsd",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "freebsd",
        "version": "4.9"
      },
      {
        "model": "freebsd",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "freebsd",
        "version": "4.8"
      },
      {
        "model": "gsx server",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "vmware",
        "version": "2.5.1"
      },
      {
        "model": "gsx server",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "vmware",
        "version": "2.0"
      },
      {
        "model": "stonebeat webcluster",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "stonesoft",
        "version": "2.5"
      },
      {
        "model": "stonebeat webcluster",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "stonesoft",
        "version": "2.0"
      },
      {
        "model": "stonebeat securitycluster",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "stonesoft",
        "version": "2.5"
      },
      {
        "model": "stonebeat securitycluster",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "stonesoft",
        "version": "2.0"
      },
      {
        "model": "servercluster",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "stonesoft",
        "version": "2.5.2"
      },
      {
        "model": "servercluster",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "stonesoft",
        "version": "2.5"
      },
      {
        "model": "propack",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "sgi",
        "version": "3.0"
      },
      {
        "model": "propack",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "sgi",
        "version": "2.4"
      },
      {
        "model": "propack",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "sgi",
        "version": "2.3"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "redhat",
        "version": "8.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "redhat",
        "version": "7.3"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "redhat",
        "version": "7.2"
      },
      {
        "model": "openbsd",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "openbsd",
        "version": "3.4"
      },
      {
        "model": "openbsd",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "openbsd",
        "version": "3.3"
      },
      {
        "model": "imanager",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "novell",
        "version": "2.0"
      },
      {
        "model": "imanager",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "novell",
        "version": "1.5"
      },
      {
        "model": "edirectory",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "novell",
        "version": "8.7.1"
      },
      {
        "model": "edirectory",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "novell",
        "version": "8.7"
      },
      {
        "model": "edirectory",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "novell",
        "version": "8.6.2"
      },
      {
        "model": "edirectory",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "novell",
        "version": "8.5.27"
      },
      {
        "model": "edirectory",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "novell",
        "version": "8.5"
      },
      {
        "model": "edirectory",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "novell",
        "version": "8.0"
      },
      {
        "model": "hp-ux",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "hp",
        "version": "11.23"
      },
      {
        "model": "hp-ux",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "hp",
        "version": "11.11"
      },
      {
        "model": "apache-based web server",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "hp",
        "version": "2.0.43.04"
      },
      {
        "model": "apache-based web server",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "hp",
        "version": "2.0.43.00"
      },
      {
        "model": "freebsd",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "freebsd",
        "version": "5.2"
      },
      {
        "model": "freebsd",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "freebsd",
        "version": "5.1"
      },
      {
        "model": "webns",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "7.10"
      },
      {
        "model": "webns",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "6.10"
      },
      {
        "model": "secure content accelerator",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "10000"
      },
      {
        "model": "okena stormwatch",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "3.2"
      },
      {
        "model": "firewall services module",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "1.1.3"
      },
      {
        "model": "firewall services module",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "1.1.2"
      },
      {
        "model": "css secure content accelerator",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "2.0"
      },
      {
        "model": "css secure content accelerator",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "1.0"
      },
      {
        "model": "ciscoworks common services",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "2.2"
      },
      {
        "model": "ciscoworks common management foundation",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "cisco",
        "version": "2.1"
      },
      {
        "model": "sg5",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "avaya",
        "version": "4.4"
      },
      {
        "model": "sg5",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "avaya",
        "version": "4.3"
      },
      {
        "model": "sg5",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "avaya",
        "version": "4.2"
      },
      {
        "model": "sg208",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "avaya",
        "version": "4.4"
      },
      {
        "model": "sg203",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "avaya",
        "version": "4.31.29"
      },
      {
        "model": "sg203",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "avaya",
        "version": "4.4"
      },
      {
        "model": "sg200",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "avaya",
        "version": "4.31.29"
      },
      {
        "model": "sg200",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "avaya",
        "version": "4.4"
      },
      {
        "model": "converged communications server",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "avaya",
        "version": "2.0"
      },
      {
        "model": "webstar",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "4d",
        "version": "5.3.1"
      },
      {
        "model": "webstar",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "4d",
        "version": "5.3"
      },
      {
        "model": "webstar",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "4d",
        "version": "5.2.4"
      },
      {
        "model": "webstar",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "4d",
        "version": "5.2.3"
      },
      {
        "model": "webstar",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "4d",
        "version": "5.2.2"
      },
      {
        "model": "webstar",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "4d",
        "version": "5.2.1"
      },
      {
        "model": "webstar",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "4d",
        "version": "5.2"
      },
      {
        "model": "webstar",
        "scope": "eq",
        "trust": 1.3,
        "vendor": "4d",
        "version": "4.0"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "0.9.6j"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "0.9.7b"
      },
      {
        "model": "cacheos ca sa",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "bluecoat",
        "version": "4.1.10"
      },
      {
        "model": "wbem",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "hp",
        "version": "a.02.00.00"
      },
      {
        "model": "s8300",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "avaya",
        "version": "r2.0.0"
      },
      {
        "model": "firewall-1",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "checkpoint",
        "version": "next_generation_fp0"
      },
      {
        "model": "enterprise",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "tarantella",
        "version": "3.40"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "0.9.6e"
      },
      {
        "model": "intuity audix",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "avaya",
        "version": "5.1.46"
      },
      {
        "model": "s8500",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "avaya",
        "version": "r2.0.0"
      },
      {
        "model": "vsu",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "avaya",
        "version": "5"
      },
      {
        "model": "vsu",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "avaya",
        "version": "2000_r2.0.1"
      },
      {
        "model": "firewall-1",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "checkpoint",
        "version": "next_generation_fp2"
      },
      {
        "model": "instant virtual extranet",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "neoteris",
        "version": "3.1"
      },
      {
        "model": "openserver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sco",
        "version": "5.0.6"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "0.9.6h"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.2.2_.111"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "12.2\\(14\\)sy1"
      },
      {
        "model": "aaa server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "hp",
        "version": "*"
      },
      {
        "model": "application and content networking software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "*"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.3\\(3.109\\)"
      },
      {
        "model": "clientless vpn gateway 4400",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "symantec",
        "version": "5.0"
      },
      {
        "model": "s8300",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "avaya",
        "version": "r2.0.1"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "0.9.7a-2"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "2.2.1"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.3\\(1\\)"
      },
      {
        "model": "enterprise",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "tarantella",
        "version": "3.20"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.0\\(2\\)"
      },
      {
        "model": "vsu",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "avaya",
        "version": "10000_r2.0.1"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "1.5.18"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.2\\(3.100\\)"
      },
      {
        "model": "threat response",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "*"
      },
      {
        "model": "firewall-1",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "checkpoint",
        "version": "next_generation_fp1"
      },
      {
        "model": "intuity audix",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "avaya",
        "version": "s3400"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.0\\(3\\)"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "0.9.6c"
      },
      {
        "model": "enterprise linux desktop",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "3.0"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.2"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "12.1\\(11b\\)e12"
      },
      {
        "model": "call manager",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "*"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "2.2"
      },
      {
        "model": "instant virtual extranet",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "neoteris",
        "version": "3.3.1"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "2.2.4"
      },
      {
        "model": "hp-ux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "hp",
        "version": "11.00"
      },
      {
        "model": "enterprise",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "tarantella",
        "version": "3.30"
      },
      {
        "model": "sg208",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "avaya",
        "version": "*"
      },
      {
        "model": "openserver",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sco",
        "version": "5.0.7"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.0\\(1\\)"
      },
      {
        "model": "vpn-1",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "checkpoint",
        "version": "next_generation_fp0"
      },
      {
        "model": "vsu",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "avaya",
        "version": "5000_r2.0.1"
      },
      {
        "model": "edirectory",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "novell",
        "version": "8.5.12a"
      },
      {
        "model": "firewall-1",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "checkpoint",
        "version": "*"
      },
      {
        "model": "vpn-1",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "checkpoint",
        "version": "next_generation_fp2"
      },
      {
        "model": "firewall services module",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "*"
      },
      {
        "model": "litespeed web server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "litespeedtech",
        "version": "1.0.1"
      },
      {
        "model": "vpn-1",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "checkpoint",
        "version": "vsx_ng_with_application_intelligence"
      },
      {
        "model": "wbem",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "hp",
        "version": "a.02.00.01"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "12.1\\(19\\)e1"
      },
      {
        "model": "s8700",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "avaya",
        "version": "r2.0.0"
      },
      {
        "model": "instant virtual extranet",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "neoteris",
        "version": "3.3"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "0.9.7c"
      },
      {
        "model": "firewall-1",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "checkpoint",
        "version": "2.0"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.3\\(2\\)"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "0.9.6d"
      },
      {
        "model": "enterprise linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "3.0"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "0.9.7a"
      },
      {
        "model": "s8500",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "avaya",
        "version": "r2.0.1"
      },
      {
        "model": "bsafe ssl-j",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "dell",
        "version": "3.0"
      },
      {
        "model": "gss 4490 global site selector",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "*"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "0.9.6g"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "12.1\\(13\\)e9"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "1.7"
      },
      {
        "model": "sidewinder",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "securecomputing",
        "version": "5.2"
      },
      {
        "model": "wbem",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "hp",
        "version": "a.01.05.08"
      },
      {
        "model": "gsx server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "2.5.1_build_5336"
      },
      {
        "model": "s8700",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "avaya",
        "version": "r2.0.1"
      },
      {
        "model": "provider-1",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "checkpoint",
        "version": "4.1"
      },
      {
        "model": "sidewinder",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "securecomputing",
        "version": "5.2.1.02"
      },
      {
        "model": "webns",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.10_b4"
      },
      {
        "model": "stonebeat fullcluster",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "stonesoft",
        "version": "1_3.0"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "1.7.1"
      },
      {
        "model": "mds 9000",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "*"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "2.0.4"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "12.1\\(11b\\)e"
      },
      {
        "model": "stonebeat fullcluster",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "stonesoft",
        "version": "2.0"
      },
      {
        "model": "bsafe ssl-j",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "dell",
        "version": "3.0.1"
      },
      {
        "model": "crypto accelerator 4000",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "sun",
        "version": "1.0"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "0.9.6k"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "2.0.8"
      },
      {
        "model": "firewall services module",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "1.1_\\(3.005\\)"
      },
      {
        "model": "css11000 content services switch",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "*"
      },
      {
        "model": "webns",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "7.2_0.0.03"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "2.0.5"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "12.2sy"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.0"
      },
      {
        "model": "hp-ux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "hp",
        "version": "8.05"
      },
      {
        "model": "intuity audix",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "avaya",
        "version": "s3210"
      },
      {
        "model": "sidewinder",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "securecomputing",
        "version": "5.2.1"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "0.9.6-15"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.1\\(1\\)"
      },
      {
        "model": "sidewinder",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "securecomputing",
        "version": "5.2.0.04"
      },
      {
        "model": "instant virtual extranet",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "neoteris",
        "version": "3.0"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "12.2za"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "0.9.6b-3"
      },
      {
        "model": "access registrar",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "*"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "1.6.3"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "2.0.6"
      },
      {
        "model": "content services switch 11500",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "*"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.0\\(4\\)"
      },
      {
        "model": "stonebeat fullcluster",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "stonesoft",
        "version": "3.0"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.3"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.1\\(4\\)"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.3\\(3.102\\)"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.0\\(4.101\\)"
      },
      {
        "model": "sidewinder",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "securecomputing",
        "version": "5.2.0.02"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "2.0.9"
      },
      {
        "model": "webns",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "7.1_0.1.02"
      },
      {
        "model": "cacheos ca sa",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "bluecoat",
        "version": "4.1.12"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "0.9.6f"
      },
      {
        "model": "vpn-1",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "checkpoint",
        "version": "next_generation_fp1"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "12.1\\(11b\\)e14"
      },
      {
        "model": "webns",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "7.1_0.2.06"
      },
      {
        "model": "vsu",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "avaya",
        "version": "7500_r2.0.1"
      },
      {
        "model": "freebsd",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "freebsd",
        "version": "5.2.1"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "12.2\\(14\\)sy"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "2.0.1"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "2.0.7"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.2\\(3\\)"
      },
      {
        "model": "sidewinder",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "securecomputing",
        "version": "5.2.0.01"
      },
      {
        "model": "intuity audix",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "avaya",
        "version": "*"
      },
      {
        "model": "instant virtual extranet",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "neoteris",
        "version": "3.2"
      },
      {
        "model": "gsx server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "3.0_build_7592"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.1\\(3\\)"
      },
      {
        "model": "gsx server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "2.0.1_build_2129"
      },
      {
        "model": "firewall services module",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "2.1_\\(0.208\\)"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.1\\(5\\)"
      },
      {
        "model": "vsu",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "avaya",
        "version": "5x"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "1.6.2"
      },
      {
        "model": "gss 4480 global site selector",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "*"
      },
      {
        "model": "bsafe ssl-j",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "dell",
        "version": "3.1"
      },
      {
        "model": "mac os x",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.3.3"
      },
      {
        "model": "ios",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "12.1\\(11\\)e"
      },
      {
        "model": "webns",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "7.10_.0.06s"
      },
      {
        "model": "stonebeat fullcluster",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "stonesoft",
        "version": "2.5"
      },
      {
        "model": "proxysg",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "bluecoat",
        "version": "*"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.2\\(1\\)"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "0.9.6i"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.1\\(2\\)"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.2\\(2\\)"
      },
      {
        "model": "pix firewall software",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "6.1"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "2.1"
      },
      {
        "model": "vsu",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "avaya",
        "version": "500"
      },
      {
        "model": "sidewinder",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "securecomputing",
        "version": "5.2.0.03"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "1.5.17"
      },
      {
        "model": "vsu",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "avaya",
        "version": "100_r2.0.1"
      },
      {
        "model": "stonebeat fullcluster",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "stonesoft",
        "version": "1_2.0"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "1.7.2"
      },
      {
        "model": "mac os x server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "apple",
        "version": "10.3.3"
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "apple computer",
        "version": null
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "openssl",
        "version": null
      },
      {
        "model": "netwatcher",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u5bcc\u58eb\u901a",
        "version": null
      },
      {
        "model": "turbolinux appliance server",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30bf\u30fc\u30dc\u30ea\u30ca\u30c3\u30af\u30b9",
        "version": null
      },
      {
        "model": "red hat enterprise linux",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30ec\u30c3\u30c9\u30cf\u30c3\u30c8",
        "version": null
      },
      {
        "model": "hp-ux apache-based web server",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d2\u30e5\u30fc\u30ec\u30c3\u30c8 \u30d1\u30c3\u30ab\u30fc\u30c9",
        "version": null
      },
      {
        "model": "hp-ux",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d2\u30e5\u30fc\u30ec\u30c3\u30c8 \u30d1\u30c3\u30ab\u30fc\u30c9",
        "version": null
      },
      {
        "model": "trendmicro interscan viruswall",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c8\u30ec\u30f3\u30c9\u30de\u30a4\u30af\u30ed",
        "version": null
      },
      {
        "model": "provider-1",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c1\u30a7\u30c3\u30af \u30dd\u30a4\u30f3\u30c8 \u30bd\u30d5\u30c8\u30a6\u30a7\u30a2 \u30c6\u30af\u30ce\u30ed\u30b8\u30fc\u30ba",
        "version": null
      },
      {
        "model": "primergy sslaccelerator",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "\u5bcc\u58eb\u901a",
        "version": "7115"
      },
      {
        "model": "hp wbem services",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d2\u30e5\u30fc\u30ec\u30c3\u30c8 \u30d1\u30c3\u30ab\u30fc\u30c9",
        "version": null
      },
      {
        "model": "turbolinux server",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30bf\u30fc\u30dc\u30ea\u30ca\u30c3\u30af\u30b9",
        "version": null
      },
      {
        "model": "red hat enterprise linux desktop",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30ec\u30c3\u30c9\u30cf\u30c3\u30c8",
        "version": null
      },
      {
        "model": "netshelter\u30b7\u30ea\u30fc\u30ba",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u5bcc\u58eb\u901a",
        "version": null
      },
      {
        "model": "sun cobalt raq4",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b5\u30f3 \u30de\u30a4\u30af\u30ed\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "primergy sslaccelerator",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "\u5bcc\u58eb\u901a",
        "version": "7117"
      },
      {
        "model": "netbsd",
        "scope": null,
        "trust": 0.8,
        "vendor": "netbsd",
        "version": null
      },
      {
        "model": "vine linux",
        "scope": null,
        "trust": 0.8,
        "vendor": "vine linux",
        "version": null
      },
      {
        "model": "asianux server",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b5\u30a4\u30d0\u30fc\u30c8\u30e9\u30b9\u30c8\u682a\u5f0f\u4f1a\u793e",
        "version": null
      },
      {
        "model": "red hat linux",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30ec\u30c3\u30c9\u30cf\u30c3\u30c8",
        "version": null
      },
      {
        "model": "sun crypto accelerator",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30b5\u30f3 \u30de\u30a4\u30af\u30ed\u30b7\u30b9\u30c6\u30e0\u30ba",
        "version": null
      },
      {
        "model": "turbolinux desktop",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30bf\u30fc\u30dc\u30ea\u30ca\u30c3\u30af\u30b9",
        "version": null
      },
      {
        "model": "ipcom\u30b7\u30ea\u30fc\u30ba",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u5bcc\u58eb\u901a",
        "version": null
      },
      {
        "model": "firewall-1 gx",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c1\u30a7\u30c3\u30af \u30dd\u30a4\u30f3\u30c8 \u30bd\u30d5\u30c8\u30a6\u30a7\u30a2 \u30c6\u30af\u30ce\u30ed\u30b8\u30fc\u30ba",
        "version": null
      },
      {
        "model": "openssl",
        "scope": null,
        "trust": 0.8,
        "vendor": "openssl",
        "version": null
      },
      {
        "model": "hp-ux aaa server",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30d2\u30e5\u30fc\u30ec\u30c3\u30c8 \u30d1\u30c3\u30ab\u30fc\u30c9",
        "version": null
      },
      {
        "model": "vpn-1/firewall-1",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30c1\u30a7\u30c3\u30af \u30dd\u30a4\u30f3\u30c8 \u30bd\u30d5\u30c8\u30a6\u30a7\u30a2 \u30c6\u30af\u30ce\u30ed\u30b8\u30fc\u30ba",
        "version": null
      },
      {
        "model": "turbolinux workstation",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30bf\u30fc\u30dc\u30ea\u30ca\u30c3\u30af\u30b9",
        "version": null
      },
      {
        "model": "primergy sslaccelerator",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "\u5bcc\u58eb\u901a",
        "version": "7110"
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.6,
        "vendor": "none",
        "version": null
      },
      {
        "model": "ios 12.1 e",
        "scope": null,
        "trust": 0.6,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apple",
        "version": "x10.4.2"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apple",
        "version": "x10.3.9"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apple",
        "version": "x10.4.2"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "apple",
        "version": "x10.3.9"
      },
      {
        "model": "gsx server build",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "vmware",
        "version": "3.07592"
      },
      {
        "model": "gsx server build",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "vmware",
        "version": "2.5.15336"
      },
      {
        "model": "gsx server build",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "vmware",
        "version": "2.0.12129"
      },
      {
        "model": "enterprise",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "tarantella",
        "version": "33.40"
      },
      {
        "model": "enterprise",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "tarantella",
        "version": "33.30"
      },
      {
        "model": "enterprise",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "tarantella",
        "version": "33.200"
      },
      {
        "model": "clientless vpn gateway series",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "symantec",
        "version": "44005.0"
      },
      {
        "model": "crypto accelerator",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sun",
        "version": "40001.0"
      },
      {
        "model": "stonegate vpn client",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.0.9"
      },
      {
        "model": "stonegate vpn client",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.0.8"
      },
      {
        "model": "stonegate vpn client",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.0.7"
      },
      {
        "model": "stonegate vpn client",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.0"
      },
      {
        "model": "stonegate vpn client",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "1.7.2"
      },
      {
        "model": "stonegate vpn client",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "1.7"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.2.4"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.2.1"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.2"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.1"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.0.9"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.0.8"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.0.7"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.0.6"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.0.5"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.0.4"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.0.1"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "1.7.2"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "1.7.1"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "1.7"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "1.6.3"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "1.6.2"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "1.5.18"
      },
      {
        "model": "stonegate",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "1.5.17"
      },
      {
        "model": "stonebeat fullcluster for raptor",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.5"
      },
      {
        "model": "stonebeat fullcluster for raptor",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.0"
      },
      {
        "model": "stonebeat fullcluster for isa server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "3.0"
      },
      {
        "model": "stonebeat fullcluster for gauntlet",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.0"
      },
      {
        "model": "stonebeat fullcluster for firewall-1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "3.0"
      },
      {
        "model": "stonebeat fullcluster for firewall-1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.0"
      },
      {
        "model": "propack sp6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sgi",
        "version": "3.0"
      },
      {
        "model": "irix m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sgi",
        "version": "6.5.24"
      },
      {
        "model": "irix m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sgi",
        "version": "6.5.23"
      },
      {
        "model": "irix m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sgi",
        "version": "6.5.22"
      },
      {
        "model": "irix m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sgi",
        "version": "6.5.21"
      },
      {
        "model": "irix f",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sgi",
        "version": "6.5.21"
      },
      {
        "model": "irix m",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sgi",
        "version": "6.5.20"
      },
      {
        "model": "irix f",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sgi",
        "version": "6.5.20"
      },
      {
        "model": "computing sidewinder",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "secure",
        "version": "5.2.1.02"
      },
      {
        "model": "computing sidewinder",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "secure",
        "version": "5.2.1"
      },
      {
        "model": "computing sidewinder",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "secure",
        "version": "5.2.0.04"
      },
      {
        "model": "computing sidewinder",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "secure",
        "version": "5.2.0.03"
      },
      {
        "model": "computing sidewinder",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "secure",
        "version": "5.2.0.02"
      },
      {
        "model": "computing sidewinder",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "secure",
        "version": "5.2.0.01"
      },
      {
        "model": "computing sidewinder",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "secure",
        "version": "5.2"
      },
      {
        "model": "unixware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sco",
        "version": "7.1.3"
      },
      {
        "model": "unixware",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sco",
        "version": "7.1.1"
      },
      {
        "model": "open server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sco",
        "version": "5.0.7"
      },
      {
        "model": "open server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sco",
        "version": "5.0.6"
      },
      {
        "model": "security bsafe ssl-j sdk",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "rsa",
        "version": "3.1"
      },
      {
        "model": "security bsafe ssl-j sdk",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "rsa",
        "version": "3.0.1"
      },
      {
        "model": "security bsafe ssl-j sdk",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "rsa",
        "version": "3.0"
      },
      {
        "model": "openssl096b-0.9.6b-3.i386.rpm",
        "scope": null,
        "trust": 0.3,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "openssl096-0.9.6-15.i386.rpm",
        "scope": null,
        "trust": 0.3,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "openssl-perl-0.9.7a-2.i386.rpm",
        "scope": null,
        "trust": 0.3,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "openssl-devel-0.9.7a-2.i386.rpm",
        "scope": null,
        "trust": 0.3,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "openssl-0.9.7a-2.i386.rpm",
        "scope": null,
        "trust": 0.3,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "linux i386",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "7.3"
      },
      {
        "model": "enterprise linux ws",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "4"
      },
      {
        "model": "enterprise linux ws",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "3"
      },
      {
        "model": "enterprise linux es",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "4"
      },
      {
        "model": "enterprise linux es",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "3"
      },
      {
        "model": "desktop",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "4.0"
      },
      {
        "model": "desktop",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "3.0"
      },
      {
        "model": "hat fedora core3",
        "scope": null,
        "trust": 0.3,
        "vendor": "red",
        "version": null
      },
      {
        "model": "hat fedora core2",
        "scope": null,
        "trust": 0.3,
        "vendor": "red",
        "version": null
      },
      {
        "model": "hat fedora core1",
        "scope": null,
        "trust": 0.3,
        "vendor": "red",
        "version": null
      },
      {
        "model": "hat enterprise linux as",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "4"
      },
      {
        "model": "hat enterprise linux as",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "red",
        "version": "3"
      },
      {
        "model": "project openssl c",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "project openssl beta3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "project openssl beta2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "project openssl beta1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "project openssl b",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "project openssl a",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "project openssl",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "project openssl k",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "project openssl j",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "project openssl i",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "project openssl h",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "project openssl g",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "project openssl f",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "project openssl e",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "project openssl d",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "project openssl c",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "edirectory su1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "novell",
        "version": "8.7.1"
      },
      {
        "model": "edirectory a",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "novell",
        "version": "8.5.12"
      },
      {
        "model": "instant virtual extranet",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "netscreen",
        "version": "3.3.1"
      },
      {
        "model": "instant virtual extranet",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "netscreen",
        "version": "3.3"
      },
      {
        "model": "instant virtual extranet",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "netscreen",
        "version": "3.2"
      },
      {
        "model": "instant virtual extranet",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "netscreen",
        "version": "3.1"
      },
      {
        "model": "instant virtual extranet",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "netscreen",
        "version": "3.0"
      },
      {
        "model": "litespeed web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "lite speed",
        "version": "1.3.1"
      },
      {
        "model": "litespeed web server rc3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "lite speed",
        "version": "1.3"
      },
      {
        "model": "litespeed web server rc2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "lite speed",
        "version": "1.3"
      },
      {
        "model": "litespeed web server rc1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "lite speed",
        "version": "1.3"
      },
      {
        "model": "litespeed web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "lite speed",
        "version": "1.3"
      },
      {
        "model": "litespeed web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "lite speed",
        "version": "1.2.2"
      },
      {
        "model": "litespeed web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "lite speed",
        "version": "1.2.1"
      },
      {
        "model": "litespeed web server rc2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "lite speed",
        "version": "1.2"
      },
      {
        "model": "litespeed web server rc1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "lite speed",
        "version": "1.2"
      },
      {
        "model": "litespeed web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "lite speed",
        "version": "1.1.1"
      },
      {
        "model": "litespeed web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "lite speed",
        "version": "1.1"
      },
      {
        "model": "litespeed web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "lite speed",
        "version": "1.0.3"
      },
      {
        "model": "litespeed web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "lite speed",
        "version": "1.0.2"
      },
      {
        "model": "litespeed web server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "lite speed",
        "version": "1.0.1"
      },
      {
        "model": "wbem a.02.00.01",
        "scope": null,
        "trust": 0.3,
        "vendor": "hp",
        "version": null
      },
      {
        "model": "wbem a.02.00.00",
        "scope": null,
        "trust": 0.3,
        "vendor": "hp",
        "version": null
      },
      {
        "model": "wbem a.01.05.08",
        "scope": null,
        "trust": 0.3,
        "vendor": "hp",
        "version": null
      },
      {
        "model": "hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "11.0"
      },
      {
        "model": "hp-ux",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "hp",
        "version": "8.5"
      },
      {
        "model": "aaa server",
        "scope": null,
        "trust": 0.3,
        "vendor": "hp",
        "version": null
      },
      {
        "model": "-release",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "freebsd",
        "version": "5.2"
      },
      {
        "model": "-releng",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "freebsd",
        "version": "5.1"
      },
      {
        "model": "-release",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "freebsd",
        "version": "5.1"
      },
      {
        "model": "-releng",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "freebsd",
        "version": "4.8"
      },
      {
        "model": "associates etrust security command center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "computer",
        "version": "1.0"
      },
      {
        "model": "secure gateway for solaris",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "citrix",
        "version": "1.13"
      },
      {
        "model": "secure gateway for solaris",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "citrix",
        "version": "1.12"
      },
      {
        "model": "secure gateway for solaris",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "citrix",
        "version": "1.1"
      },
      {
        "model": "webns .0.06s",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "7.10"
      },
      {
        "model": "webns",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "7.20.0.03"
      },
      {
        "model": "webns",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "7.10.2.06"
      },
      {
        "model": "webns",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "7.10.1.02"
      },
      {
        "model": "webns b4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.10"
      },
      {
        "model": "threat response",
        "scope": null,
        "trust": 0.3,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.3.2"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.3.1"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.3(3.109)"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.3(3.102)"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.3(1)"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.3"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.2.3"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.2.2.111"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.2.2"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.2.1"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.2(3.100)"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.2(3)"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.2(2)"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.2(1)"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.2"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.1.5"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.1.4"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.1.3"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.1(5)"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.1(4)"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.1(3)"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.1(2)"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.1(1)"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.1"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.0.4"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.0.3"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.0(4.101)"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.0(4)"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.0(2)"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.0(1)"
      },
      {
        "model": "pix firewall",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.0"
      },
      {
        "model": "mds",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "9000"
      },
      {
        "model": "ios 12.2za",
        "scope": null,
        "trust": 0.3,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "ios 12.2sy",
        "scope": null,
        "trust": 0.3,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "ios 12.2 sy1",
        "scope": null,
        "trust": 0.3,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "ios 12.2 sy",
        "scope": null,
        "trust": 0.3,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "ios 12.1 e1",
        "scope": null,
        "trust": 0.3,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "ios 12.1 e9",
        "scope": null,
        "trust": 0.3,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "ios 12.1 e14",
        "scope": null,
        "trust": 0.3,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "ios 12.1 e12",
        "scope": null,
        "trust": 0.3,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "ios 12.1 ec",
        "scope": null,
        "trust": 0.3,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "ios 12.1 ea1",
        "scope": null,
        "trust": 0.3,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "gss global site selector",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "44900"
      },
      {
        "model": "gss global site selector",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "4480"
      },
      {
        "model": "firewall services module",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "2.1(0.208)"
      },
      {
        "model": "firewall services module",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "1.1(3.005)"
      },
      {
        "model": "firewall services module",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "0"
      },
      {
        "model": "css11500 content services switch",
        "scope": null,
        "trust": 0.3,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "css11000 content services switch",
        "scope": null,
        "trust": 0.3,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "call manager",
        "scope": null,
        "trust": 0.3,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "application \u0026 content networking software",
        "scope": null,
        "trust": 0.3,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "access registrar",
        "scope": null,
        "trust": 0.3,
        "vendor": "cisco",
        "version": null
      },
      {
        "model": "point software vpn-1 vsx ng with application intelligence",
        "scope": null,
        "trust": 0.3,
        "vendor": "check",
        "version": null
      },
      {
        "model": "point software vpn-1 next generation fp2",
        "scope": null,
        "trust": 0.3,
        "vendor": "check",
        "version": null
      },
      {
        "model": "point software vpn-1 next generation fp1",
        "scope": null,
        "trust": 0.3,
        "vendor": "check",
        "version": null
      },
      {
        "model": "point software vpn-1 next generation fp0",
        "scope": null,
        "trust": 0.3,
        "vendor": "check",
        "version": null
      },
      {
        "model": "point software providor-1 sp4",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software providor-1 sp3",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software providor-1 sp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software providor-1 sp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software providor-1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software firewall-1 vsx ng with application intelligence",
        "scope": null,
        "trust": 0.3,
        "vendor": "check",
        "version": null
      },
      {
        "model": "point software firewall-1 next generation fp2",
        "scope": null,
        "trust": 0.3,
        "vendor": "check",
        "version": null
      },
      {
        "model": "point software firewall-1 next generation fp1",
        "scope": null,
        "trust": 0.3,
        "vendor": "check",
        "version": null
      },
      {
        "model": "point software firewall-1 next generation fp0",
        "scope": null,
        "trust": 0.3,
        "vendor": "check",
        "version": null
      },
      {
        "model": "point software firewall-1 gx",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "check",
        "version": "2.0"
      },
      {
        "model": "coat systems proxysg",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "0"
      },
      {
        "model": "coat systems cacheos ca/sa",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "4.1.12"
      },
      {
        "model": "coat systems cacheos ca/sa",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "blue",
        "version": "4.1.10"
      },
      {
        "model": "vsu r2.0.1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "7500"
      },
      {
        "model": "vsu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5x0"
      },
      {
        "model": "vsu r2.0.1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5000"
      },
      {
        "model": "vsu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "5000"
      },
      {
        "model": "vsu",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "50"
      },
      {
        "model": "vsu r2.0.1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "2000"
      },
      {
        "model": "vsu r2.0.1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "10000"
      },
      {
        "model": "vsu r2.0.1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "100"
      },
      {
        "model": "sg5x",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.4"
      },
      {
        "model": "sg5x",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.3"
      },
      {
        "model": "sg5x",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "4.2"
      },
      {
        "model": "sg208",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "0"
      },
      {
        "model": "s8700 r2.0.1",
        "scope": null,
        "trust": 0.3,
        "vendor": "avaya",
        "version": null
      },
      {
        "model": "s8700 r2.0.0",
        "scope": null,
        "trust": 0.3,
        "vendor": "avaya",
        "version": null
      },
      {
        "model": "s8500 r2.0.1",
        "scope": null,
        "trust": 0.3,
        "vendor": "avaya",
        "version": null
      },
      {
        "model": "s8500 r2.0.0",
        "scope": null,
        "trust": 0.3,
        "vendor": "avaya",
        "version": null
      },
      {
        "model": "s8300 r2.0.1",
        "scope": null,
        "trust": 0.3,
        "vendor": "avaya",
        "version": null
      },
      {
        "model": "s8300 r2.0.0",
        "scope": null,
        "trust": 0.3,
        "vendor": "avaya",
        "version": null
      },
      {
        "model": "intuity r5 r5.1.46",
        "scope": null,
        "trust": 0.3,
        "vendor": "avaya",
        "version": null
      },
      {
        "model": "intuity audix r5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "avaya",
        "version": "0"
      },
      {
        "model": "intuity s3400",
        "scope": null,
        "trust": 0.3,
        "vendor": "avaya",
        "version": null
      },
      {
        "model": "intuity s3210",
        "scope": null,
        "trust": 0.3,
        "vendor": "avaya",
        "version": null
      },
      {
        "model": "intuity lx",
        "scope": null,
        "trust": 0.3,
        "vendor": "avaya",
        "version": null
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.3.3"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.3.3"
      },
      {
        "model": "gsx server",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "vmware",
        "version": "2.5.2"
      },
      {
        "model": "stonegate sparc",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.2.12"
      },
      {
        "model": "stonegate",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.2.5x86"
      },
      {
        "model": "stonegate ibm zseries",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "stonesoft",
        "version": "2.2.5"
      },
      {
        "model": "computing sidewinder",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "secure",
        "version": "5.2.1.10"
      },
      {
        "model": "security bsafe ssl-j sdk",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "rsa",
        "version": "4.1"
      },
      {
        "model": "project openssl d",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.7"
      },
      {
        "model": "project openssl m",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "openssl",
        "version": "0.9.6"
      },
      {
        "model": "litespeed web server",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "lite speed",
        "version": "1.3.2"
      },
      {
        "model": "litespeed web server",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "lite speed",
        "version": "1.0.2"
      },
      {
        "model": "secure gateway for solaris",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "citrix",
        "version": "1.14"
      },
      {
        "model": "threat response",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "2.0.3"
      },
      {
        "model": "mds",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "90002.0(0.86)"
      },
      {
        "model": "mds",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "90001.3(3.33)"
      },
      {
        "model": "point software vpn-1 sp6",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software vpn-1 sp5a",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software vpn-1 sp5",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software vpn-1 sp4",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software vpn-1 sp3",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software vpn-1 sp2",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software vpn-1 sp1",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software vpn-1",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software firewall-1 sp6",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software firewall-1 sp5a",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software firewall-1 sp5",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software firewall-1 sp4",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software firewall-1 sp3",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software firewall-1 sp2",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software firewall-1 sp1",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "point software firewall-1",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "check",
        "version": "4.1"
      },
      {
        "model": "webstar",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "4d",
        "version": "5.3.2"
      },
      {
        "model": "linux i386",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "redhat",
        "version": "9.0"
      },
      {
        "model": "fedora core2",
        "scope": null,
        "trust": 0.3,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "fedora core1",
        "scope": null,
        "trust": 0.3,
        "vendor": "redhat",
        "version": null
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.1"
      },
      {
        "model": "mac os server",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4.1"
      },
      {
        "model": "mac os",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "apple",
        "version": "x10.4"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#484726"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2004-0790"
      },
      {
        "db": "BID",
        "id": "9899"
      },
      {
        "db": "BID",
        "id": "14567"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2004-000088"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200411-112"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-0112"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:h:cisco:firewall_services_module:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:symantec:clientless_vpn_gateway_4400:5.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:hp:apache-based_web_server:2.0.43.00:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:cisco:firewall_services_module:1.1.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:cisco:firewall_services_module:1.1.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:hp:aaa_server:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:cisco:firewall_services_module:1.1_\\(3.005\\):*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:hp:apache-based_web_server:2.0.43.04:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:cisco:firewall_services_module:2.1_\\(0.208\\):*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:h:avaya:sg203:4.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:hp:hp-ux:11.11:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_desktop:3.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:hp:hp-ux:11.23:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:ciscoworks_common_management_foundation:2.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:freebsd:freebsd:5.1:releng:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:avaya:sg208:4.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:3.0:*:workstation_server:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:avaya:sg200:4.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:avaya:sg5:4.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:redhat:linux:7.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:cisco:ciscoworks_common_services:2.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:openbsd:openbsd:3.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x_server:10.3.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:freebsd:freebsd:5.1:release:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:redhat:linux:8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:redhat:linux:7.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:avaya:converged_communications_server:2.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:sco:openserver:5.0.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:hp:hp-ux:11.00:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:avaya:sg5:4.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:avaya:sg208:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:freebsd:freebsd:5.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:freebsd:freebsd:5.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:avaya:sg200:4.31.29:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:freebsd:freebsd:4.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:3.0:*:enterprise_server:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:avaya:sg203:4.31.29:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:hp:hp-ux:8.05:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:apple:mac_os_x:10.3.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:freebsd:freebsd:5.2.1:release:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:freebsd:freebsd:4.8:releng:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:sco:openserver:5.0.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:h:avaya:sg5:4.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:freebsd:freebsd:4.9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:openbsd:openbsd:3.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux:3.0:*:advanced_server:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ios:12.1\\(11\\)e:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ios:12.1\\(11b\\)e:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ios:12.1\\(11b\\)e12:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ios:12.1\\(11b\\)e14:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ios:12.1\\(13\\)e9:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ios:12.1\\(19\\)e1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ios:12.2\\(14\\)sy:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ios:12.2\\(14\\)sy1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ios:12.2sy:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:ios:12.2za:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:a:4d:webstar:4.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:4d:webstar:5.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:4d:webstar:5.2.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:4d:webstar:5.2.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:4d:webstar:5.2.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:4d:webstar:5.2.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:4d:webstar:5.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:4d:webstar:5.3.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:avaya:intuity_audix:*:*:lx:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:avaya:intuity_audix:5.1.46:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:avaya:intuity_audix:s3210:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:avaya:intuity_audix:s3400:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:avaya:vsu:5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:avaya:vsu:5x:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:avaya:vsu:100_r2.0.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:avaya:vsu:500:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:avaya:vsu:2000_r2.0.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:avaya:vsu:5000_r2.0.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:avaya:vsu:7500_r2.0.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:avaya:vsu:10000_r2.0.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:checkpoint:firewall-1:*:*:vsx-ng-ai:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:checkpoint:firewall-1:2.0:*:gx:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:checkpoint:firewall-1:next_generation_fp0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:checkpoint:firewall-1:next_generation_fp1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:checkpoint:firewall-1:next_generation_fp2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:checkpoint:provider-1:4.1:sp3:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:checkpoint:provider-1:4.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:checkpoint:provider-1:4.1:sp1:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:checkpoint:provider-1:4.1:sp2:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:checkpoint:provider-1:4.1:sp4:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:checkpoint:vpn-1:next_generation_fp0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:checkpoint:vpn-1:next_generation_fp1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:checkpoint:vpn-1:next_generation_fp2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:checkpoint:vpn-1:vsx_ng_with_application_intelligence:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:cisco:access_registrar:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:cisco:application_and_content_networking_software:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:cisco:css_secure_content_accelerator:1.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:cisco:css_secure_content_accelerator:2.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:cisco:css11000_content_services_switch:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:cisco:okena_stormwatch:3.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:cisco:pix_firewall:6.2.2_.111:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:cisco:threat_response:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:cisco:webns:6.10:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:cisco:webns:6.10_b4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:cisco:webns:7.1_0.1.02:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:cisco:webns:7.1_0.2.06:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:cisco:webns:7.2_0.0.03:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:cisco:webns:7.10:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:cisco:webns:7.10_.0.06s:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:dell:bsafe_ssl-j:3.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:dell:bsafe_ssl-j:3.0.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:dell:bsafe_ssl-j:3.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:forcepoint:stonegate:1.5.17:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:forcepoint:stonegate:1.5.18:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:forcepoint:stonegate:1.6.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:forcepoint:stonegate:1.6.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:forcepoint:stonegate:1.7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:forcepoint:stonegate:1.7.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:forcepoint:stonegate:1.7.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:forcepoint:stonegate:2.0.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:forcepoint:stonegate:2.0.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:forcepoint:stonegate:2.0.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:forcepoint:stonegate:2.0.6:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:forcepoint:stonegate:2.0.7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:forcepoint:stonegate:2.0.8:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:forcepoint:stonegate:2.0.9:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:forcepoint:stonegate:2.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:forcepoint:stonegate:2.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:forcepoint:stonegate:2.2.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:forcepoint:stonegate:2.2.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:hp:wbem:a.01.05.08:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:hp:wbem:a.02.00.00:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:hp:wbem:a.02.00.01:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:litespeedtech:litespeed_web_server:1.0.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:litespeedtech:litespeed_web_server:1.0.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:litespeedtech:litespeed_web_server:1.0.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:litespeedtech:litespeed_web_server:1.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:litespeedtech:litespeed_web_server:1.1.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:litespeedtech:litespeed_web_server:1.2:rc1:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:litespeedtech:litespeed_web_server:1.2:rc2:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:litespeedtech:litespeed_web_server:1.2.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:litespeedtech:litespeed_web_server:1.2.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:litespeedtech:litespeed_web_server:1.3:-:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:litespeedtech:litespeed_web_server:1.3:rc1:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:litespeedtech:litespeed_web_server:1.3:rc2:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:litespeedtech:litespeed_web_server:1.3:rc3:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:neoteris:instant_virtual_extranet:3.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:neoteris:instant_virtual_extranet:3.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:neoteris:instant_virtual_extranet:3.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:neoteris:instant_virtual_extranet:3.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:neoteris:instant_virtual_extranet:3.3.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:novell:edirectory:8.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:novell:edirectory:8.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:novell:edirectory:8.5.12a:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:novell:edirectory:8.5.27:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:novell:edirectory:8.6.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:novell:edirectory:8.7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:novell:edirectory:8.7.1:sp1:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:novell:edirectory:8.7.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:novell:imanager:1.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:novell:imanager:2.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:openssl:openssl:0.9.6c:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:openssl:openssl:0.9.6d:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:openssl:openssl:0.9.6e:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:openssl:openssl:0.9.6f:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:openssl:openssl:0.9.6g:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:openssl:openssl:0.9.6h:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:openssl:openssl:0.9.6i:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:openssl:openssl:0.9.6j:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:openssl:openssl:0.9.6k:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:openssl:openssl:0.9.7:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:openssl:openssl:0.9.7:beta3:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:openssl:openssl:0.9.7:beta2:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:openssl:openssl:0.9.7:beta1:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:openssl:openssl:0.9.7a:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:openssl:openssl:0.9.7b:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:openssl:openssl:0.9.7c:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:redhat:openssl:0.9.6-15:*:i386:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:redhat:openssl:0.9.6b-3:*:i386:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:redhat:openssl:0.9.7a-2:*:i386_dev:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:redhat:openssl:0.9.7a-2:*:i386_perl:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:redhat:openssl:0.9.7a-2:*:i386:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:sgi:propack:2.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:sgi:propack:2.4:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:sgi:propack:3.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:stonesoft:servercluster:2.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:stonesoft:servercluster:2.5.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:stonesoft:stonebeat_fullcluster:1_2.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:stonesoft:stonebeat_fullcluster:1_3.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:stonesoft:stonebeat_fullcluster:2.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:stonesoft:stonebeat_fullcluster:2.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:stonesoft:stonebeat_fullcluster:3.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:stonesoft:stonebeat_securitycluster:2.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:stonesoft:stonebeat_securitycluster:2.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:stonesoft:stonebeat_webcluster:2.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:stonesoft:stonebeat_webcluster:2.5:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:tarantella:tarantella_enterprise:3.20:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:tarantella:tarantella_enterprise:3.30:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:tarantella:tarantella_enterprise:3.40:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:vmware:gsx_server:2.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:vmware:gsx_server:2.0.1_build_2129:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:vmware:gsx_server:2.5.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:vmware:gsx_server:2.5.1_build_5336:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:a:vmware:gsx_server:3.0_build_7592:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:avaya:s8300:r2.0.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:avaya:s8300:r2.0.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:avaya:s8500:r2.0.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:avaya:s8500:r2.0.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:avaya:s8700:r2.0.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:avaya:s8700:r2.0.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:bluecoat:proxysg:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:call_manager:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:content_services_switch_11500:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:gss_4480_global_site_selector:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:gss_4490_global_site_selector:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:mds_9000:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:cisco:secure_content_accelerator:10000:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:securecomputing:sidewinder:5.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:securecomputing:sidewinder:5.2.0.01:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:securecomputing:sidewinder:5.2.0.02:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:securecomputing:sidewinder:5.2.0.03:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:securecomputing:sidewinder:5.2.0.04:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:securecomputing:sidewinder:5.2.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:securecomputing:sidewinder:5.2.1.02:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:h:sun:crypto_accelerator_4000:1.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:bluecoat:cacheos_ca_sa:4.1.10:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:bluecoat:cacheos_ca_sa:4.1.12:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.0:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.0\\(1\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.0\\(2\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.0\\(3\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.0\\(4\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.0\\(4.101\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.1:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.1\\(1\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.1\\(2\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.1\\(3\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.1\\(4\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.1\\(5\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.2:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.2\\(1\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.2\\(2\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.2\\(3\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.2\\(3.100\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.3:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.3\\(1\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.3\\(2\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.3\\(3.102\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  },
                  {
                    "cpe23Uri": "cpe:2.3:o:cisco:pix_firewall_software:6.3\\(3.109\\):*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2004-0112"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "OpenSSL Security Advisory",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200411-112"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2004-0112",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 5.0,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2004-0112",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "VHN-8542",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2004-0112",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CARNEGIE MELLON",
            "id": "VU#484726",
            "trust": 0.8,
            "value": "10.32"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200411-112",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-8542",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#484726"
      },
      {
        "db": "VULHUB",
        "id": "VHN-8542"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2004-000088"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200411-112"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-0112"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read. OpenSSL for, Kerberos using a cipher suite SSL/TLS When communicating, there is a flaw in not properly checking the communication data during the key exchange during handshake, and it is intentionally created. Please note that this vulnerability OpenSSL Applications and systems using the library may also be affected. For more detailed information about other systems, NISCC-224012 (JVN) , NISCC Advisory 224012 (CPNI Advisory 00389) Please also check.OpenSSL Applications that use this crash and cause a denial of service. (DoS) may become a state. OpenSSL is an open source SSL implementation used to implement high-strength encryption of network communications. It is now widely used in various network applications. \n\n\u00a0When using Kerberos ciphersuites, there is a flaw in the SSL / TLS handshake code. A remote attacker can construct a special SSL / TLS handshake and send it to a server configured with Kerberos ciphersuites. Most applications do not use Kerberos ciphersuites. It is therefore not affected by this vulnerability. \nFor the first issue, a NULL-pointer assignment can be triggered by attackers during SSL/TLS handshake exchanges. Versions 0.9.6c to 0.9.6k (inclusive) and from 0.9.7a to 0.9.7c (inclusive) are vulnerable. The vendor has reported that this vulnerability may not be a threat to many, because it occurs only when Kerberos ciphersuites are in use, an uncommon configuration. \nThis entry will be retired when individual BID records are created for each issue. \n*Note: A third denial-of-service vulnerability included in the announcement was discovered affecting 0.9.6 and fixed in 0.9.6d. Multiple security vulnerabilities are reported to affect Apple Mac OS X; updates are available. \nApache is prone to five vulnerabilities ranging from buffer overflows to access validation vulnerabilities. The CVE Mitre candidate IDs CAN-2005-1344, CAN-2004-0942, CAN-2004-0885, CAN-2004-1083, and CAN-2004-1084 are assigned to these issues. \nAppkit is prone to three vulnerabilities. Two of these could result in arbitrary code execution, the third could permit the creation of local accounts. The CVE Mitre candidate IDs CAN-2005-2501, CAN-2005-2502, and CAN-2005-2503 are assigned to these issues. \nBluetooth is prone to a vulnerability regarding authentication bypass. The CVE Mitre candidate ID CAN-2005-2504 is assigned to this issue. \nCoreFoundation is prone to two vulnerabilities, one resulting in a buffer overflow, the other a denial-of-service vulnerability. The CVE Mitre candidate IDs CAN-2005-2505 and CAN-2005-2506 are assigned to these issues. \nCUPS is prone to two vulnerabilities resulting in a denial of service until the service can be restarted. The CVE Mitre candidate IDs CAN-2005-2525 and CAN-2005-2526 are assigned to these issues. \nDirectory Services is prone to three vulnerabilities. These issues vary from buffer overflow, unauthorized account creation and deletion, and privilege escalation. The CVE Mitre candidate IDs CAN-2005-2507, CAN-2005-2508 and CAN-2005-2519 are assigned to these issues. \nHItoolbox is prone to a vulnerability that could result in information disclosure. The CVE Mitre candidate ID CAN-2005-2513 is assigned to this issue. \nKerberos is prone to five vulnerabilities that may result in a buffer overflow, execution of arbitrary code, and root compromise. The CVE Mitre candidate IDs CAN-2004-1189, CAN-2005-1174, CAN-2005-1175, CAN-2005-1689, and CAN-2005-2511 are assigned to these issues. \nloginwindow is prone to a vulnerability that could permit a user to gain access to other logged-in accounts. The CVE Mitre candidate ID CAN-2005-2509 is assigned to this issue. \nMail is prone to a vulnerability regarding the loss of privacy when remote images are loaded into HTML email. The CVE Mitre candidate ID CAN-2005-2512 is assigned to this issue. \nMySQL is prone to three vulnerabilities that include arbitrary code execution by remote authenticated users. The CVE Mitre candidate IDs CAN-2005-0709, CAN-2005-0710, and CAN-2005-0711 are assigned to these issues. \nOpenSSL is prone to two vulnerabilities resulting in denial of service. The CVE Mitre candidate IDs CAN-2004-0079 and CAN-2004-0112 are assigned to these issues. \nping is prone to a vulnerability that could allow local privilege escalation and arbitrary code execution. The CVE Mitre candidate ID CAN-2005-2514 is assigned to this issue. \nQuartzComposerScreenSaver is prone to a vulnerability that could allow users to open pages while the RSS Visualizer screen is locked. The CVE Mitre candidate ID CAN-2005-2515 is assigned to this issue. \nSafari is prone to two vulnerabilities that could result in arbitrary command execution or have information submitted to an incorrect site. The CVE Mitre candidate IDs CAN-2005-2516 and CAN-2005-2517 are assigned to these issues. \nSecurityInterface is prone to a vulnerability that could expose recently used passwords. The CVE Mitre candidate ID CAN-2005-2520 is assigned to this issue. \nservermgrd is prone to a buffer-overflow vulnerability that could ultimately lead to the execution of arbitrary code. The CVE Mitre candidate ID CAN-2005-2518 is assigned to this issue. \nservermgr_ipfilter is prone to a vulnerability regarding firewall settings not always being written to the Active Rules. The CVE Mitre candidate ID CAN-2005-2510 is assigned to this issue. \nSquirrelMail is prone to two vulnerabilities including a cross-site scripting issue. The CVE Mitre candidate IDs CAN-2005-1769 and CAN-2005-2095 are assigned to these issues. \ntraceroute is prone to a vulnerability that could result in arbitrary code execution and privilege escalation. The CVE Mitre candidate ID CAN-2005-2521 is assigned to this issue. \nWebKit is affected by a vulnerability that could result in code execution regarding a malformed PDF file. The CVE Mitre candidate ID CAN-2005-2522 is assigned to this issue. \nWeblog Server is prone to multiple cross-site scripting vulnerabilities. The CVE Mitre candidate ID CAN-2005-2523 is assigned to this issue. \nX11 is prone to a vulnerability that could result in arbitrary code execution. The CVE Mitre candidate ID CAN-2005-0605 is assigned to this issue. \nzlib is prone to two denial-of-service vulnerabilities that may ultimately lead to arbitrary code execution. The CVE Mitre candidate IDs CAN-2005-2096 and CAN-2005-1849 are assigned to these issues. \nThese vulnerabilities will be separated into individual BIDs upon further analysis of the issues. It supports a variety of encryption algorithms, including symmetric ciphers, hash algorithms, security hashing algorithm, etc. \n\nTITLE:\nFedora update for openssl096b\n\nSECUNIA ADVISORY ID:\nSA17381\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/17381/\n\nCRITICAL:\nModerately critical\n\nIMPACT:\nDoS\n\nWHERE:\n\u003eFrom remote\n\nOPERATING SYSTEM:\nFedora Core 3\nhttp://secunia.com/product/4222/\n\nDESCRIPTION:\nFedora has issued an update for openssl096b. \n\nFor more information:\nSA10133\nSA11139\n\nSOLUTION:\nApply updated packages. \n\nFedora Core 3:\nhttp://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/\n\n8d68e4b430aa7c5ca067c12866ae694e\nSRPMS/openssl096b-0.9.6b-21.42.src.rpm\n54a9e78a2fdd625b9dc9121e09eb4398\nx86_64/openssl096b-0.9.6b-21.42.x86_64.rpm\nc5c6174e23eba8d038889d08f49231b8\nx86_64/debug/openssl096b-debuginfo-0.9.6b-21.42.x86_64.rpm\n56b63fc150d0c099b2e4f0950e21005b\nx86_64/openssl096b-0.9.6b-21.42.i386.rpm\n56b63fc150d0c099b2e4f0950e21005b\ni386/openssl096b-0.9.6b-21.42.i386.rpm\n93195495585c7e9789041c75b1ed5380\ni386/debug/openssl096b-debuginfo-0.9.6b-21.42.i386.rpm\n\nOTHER REFERENCES:\nSA10133:\nhttp://secunia.com/advisories/10133/\n\nSA11139:\nhttp://secunia.com/advisories/11139/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n      Cisco Security Advisory: Cisco OpenSSL Implementation Vulnerability\n\nRevision 1.0\n\n  For Public Release 2004 March 17 at 1300 UTC (GMT)\n\n     ----------------------------------------------------------------------\n\nContents\n\n     Summary\n     Affected Products\n     Details\n     Impact\n     Software Versions and Fixes\n     Obtaining Fixed Software\n     Workarounds\n     Exploitation and Public Announcements\n     Status of This Notice: INTERIM\n     Distribution\n     Revision History\n     Cisco Security Procedures\n\n     ----------------------------------------------------------------------\n\nSummary\n\n   A new vulnerability in the OpenSSL implementation for SSL\n   has been announced on March 17, 2004. \n\n   An affected network device running an SSL server based on an affected\n   OpenSSL implementation may be vulnerable to a Denial of Service (DoS)\n   attack. There are workarounds available to mitigate the effects of this\n   vulnerability on Cisco products in the workaround section of this\n   advisory. Cisco is providing fixed software, and recommends that customers\n   upgrade to it when it is available. \n\n   This advisory will be posted at\n   http://www.cisco.com/warp/public/707/cisco-sa-20040317-openssl.shtml. \n\n     * Cisco IOS 12.1(11)E and later in the 12.1E release train. Only crypto\n       images (56i and k2) are vulnerable for the Cisco 7100 and 7200 Series\n       Routers. \n     * Cisco IOS 12.2SY release train. Only crypto images (k8, k9 and k91)\n       are vulnerable for the Cisco Catalyst 6500 Series and Cisco 7600\n       Series Routers. \n     * Cisco PIX Firewall\n     * Cisco Firewall Services Module (FWSM) for the Cisco Catalyst 6500\n       Series and Cisco 7600 Series routers\n     * Cisco MDS 9000 Series Multilayer Switch\n     * Cisco Content Service Switch (CSS) 11000 series\n     * Cisco Global Site Selector (GSS) 4480\n     * CiscoWorks Common Services (CWCS) version 2.2 and CiscoWorks Common\n       Management Foundation (CMF) version 2.1\n     * Cisco Access Registrar (CAR)\n\n   The following products have their SSL implementation based on the OpenSSL\n   code and are not affected by this vulnerability. \n\n     * Cisco Secure Intrusion Detection System (NetRanger) appliance. This\n       includes the IDS-42xx appliances, NM-CIDS and WS-SVS-IDSM2. \n     * Cisco SN 5428 and SN 5428-2 Storage Router\n     * Cisco CNS Configuration Engine\n     * Cisco Network Analysis Modules (NAM) for the Cisco Catalyst 6000 and\n       6500 Series switches and Cisco 7600 Series routers\n     * Cisco SIP Proxy Server (SPS)\n     * CiscoWorks 1105 Hosting Solution Engine (HSE)\n     * CiscoWorks 1105 Wireless LAN Solution Engine (WLSE)\n     * Cisco Ethernet Subscriber Solution Engine (ESSE)\n\n   The following products, which implement SSL, are not affected by this\n   vulnerability. \n\n     * Cisco VPN 3000 Series Concentrators\n\n   CatOS does not implement SSL and is not vulnerable. This vulnerability is still being actively investigated\n   across Cisco products and status of some products has still not been\n   determined. \n\nDetails\n\n   Secure Sockets Layer (SSL), is a protocol used to encrypt the data\n   transferred over an TCP session. SSL in Cisco products is mainly used by\n   the HyperText Transfer Protocol Secure (HTTPS) web service for which the\n   default TCP port is 443. The affected products, listed above, are only\n   vulnerable if they have the HTTPS service enabled and the access to the\n   service is not limited to trusted hosts or network management\n   workstations. \n\n   To check if the HTTPS service is enabled one can do the following:\n\n    1. Check the configuration on the device to verify the status of the\n       HTTPS service. \n    2. Try to connect to the device using a standard web browser that\n       supports SSL using a URL similar to https://ip_address_of_device/. \n    3. Try and connect to the default HTTPS port, TCP 443, using Telnet. \n       telnet ip_address_of_device 443. If the session connects the service\n       is enabled and accessible. \n\n   Testing by the OpenSSL development team has uncovered a null-pointer\n   assignment in the do_change_cipher_spec() function. This\n   crash on many Cisco products would cause the device to reload. \n\n   A third vulnerability described in the NISCC advisory is a bug in older\n   versions of OpenSSL, versions before 0.9.6d, that can also lead to a\n   Denial of Service attack. None of the Cisco OpenSSL implementations are\n   known to be affected by this older OpenSSL issue. \n\n     * Cisco IOS - All 12.1(11)E and later IOS software crypto (56i and k2)\n       image releases in the 12.1E release train for the Cisco 7100 and 7200\n       Series Routers are affected by this vulnerability. All IOS software\n       crypto (k8, k9, and k91) image releases in the 12.2SY release train\n       for the Cisco Catalyst 6500 Series and Cisco 7600 Series Routers are\n       affected by this vulnerability. The SSH implementation in IOS is not\n       dependent on any OpenSSL code. SSH implementations in IOS do not\n       handle certificates, yet, and therefore do not use any SSL code for\n       SSH. OpenSSL in 12.1E and 12.2SY release trains is only used for\n       providing the HTTPS and VPN Device Manager (VDM) services. This\n       vulnerability is documented in the Cisco Bug Toolkit (registered\n       customers only) as Bug ID CSCee00041. The HTTPS web service, that uses\n       the OpenSSL code, on the device is disabled by default. The no ip http\n       secure-server command may be used to disable the HTTPS web service on\n       the device, if required. The SSH and IPSec services in IOS are not\n       vulnerable to this vulnerability. \n     * Cisco PIX Firewall - PIX 6.x releases are affected by this\n       vulnerability. PIX 5.x releases do not contain any SSL code and are\n       not vulnerable. This vulnerability is documented in the Cisco Bug\n       Toolkit (registered customers only) as Bug ID CSCed90672. \n     * Cisco Firewall Services Module (FWSM) for the Cisco Catalyst 6500\n       Series and Cisco 7600 Series routers - This vulnerability is\n       documented in the Cisco Bug Toolkit (registered customers only) as Bug\n       ID CSCee02055. \n     * Cisco MDS 9000 Series Multilayer Switches - This vulnerability is\n       documented in the Cisco Bug Toolkit (registered customers only) as Bug\n       ID CSCed96246. \n     * Cisco Content Service Switch (CSS) 11000 series - WebNS version 6.x\n       and 7.x are affected by this vulnerability. This vulnerability is\n       documented in the Cisco Bug Toolkit (registered customers only) as Bug\n       ID CSCee01234 for SCM and is documented in the Cisco Bug Toolkit\n       (registered customers only) as Bug ID CSCee01240 for the SSL module. \n     * Cisco Global Site Selector (GSS) 4480 - This vulnerability is\n       documented in the Cisco Bug Toolkit (registered customers only) as Bug\n       ID CSCee01057. \n     * CiscoWorks Common Services (CWCS) version 2.2 and CiscoWorks Common\n       Management Foundation (CMF) version 2.1 - This vulnerability is\n       documented in the Cisco Bug Toolkit (registered customers only) as Bug\n       ID CSCsa13748. \n     * Cisco Access Registrar (CAR) - This vulnerability is documented in the\n       Cisco Bug Toolkit (registered customers only) as Bug ID CSCee01956. \n\n   The Internetworking Terms and Cisco Systems Acronyms online guides can be\n   found at http://www.cisco.com/univercd/cc/td/doc/cisintwk/. \n\nImpact\n\n   An affected network device running an SSL server based on the OpenSSL\n   implementation may be vulnerable to a Denial of Service (DoS) attack. \n\nSoftware Versions and Fixes\n\n     * Cisco IOS -\n\n       +----------------------------------------+\n       |Release|  Fixed Releases  |Availability |\n       | Train |                  |             |\n       |-------+------------------+-------------|\n       |12.2SY |12.2(14)SY4       |March 25     |\n       |-------+------------------+-------------|\n       |       |12.1(13)E14       |April 8      |\n       |12.1E  |12.1.(19)E7       |April 8      |\n       |       |12.1(20)E3        |April 26     |\n       +----------------------------------------+\n\n     * Cisco PIX Firewall - The vulnerability is fixed in software releases\n       6.0(4)102, 6.1(5)102, 6.2(3)107, and 6.3(3)124. These engineering\n       builds may be obtained by contacting the Cisco Technical Assistance\n       Center (TAC). TAC Contact information is given in the Obtaining Fixed\n       Software section below. \n     * Cisco Firewall Services Module (FWSM) for the Cisco Catalyst 6500\n       Series and Cisco 7600 Series routers - The vulnerability is fixed in\n       software release 1.1.3(14) which will be available by Monday, 22 of\n       March, 2004. This engineering builds may be obtained by contacting the\n       Cisco Technical Assistance Center (TAC). TAC Contact information is\n       given in the Obtaining Fixed Software section below. \n     * Cisco MDS 9000 Series Multilayer Switches - No fixed software release\n       or software availability date has been determined yet. \n     * Cisco Content Service Switch (CSS) 11000 series -No fixed software\n       release or software availability date has been determined yet. \n     * Cisco Global Site Selector (GSS) 4480 - No fixed software release or\n       software availability date has been determined yet. \n     * CiscoWorks Common Services (CWCS) version 2.2 and CiscoWorks Common\n       Management Foundation (CMF) version 2.1 - No fixed software release or\n       software availability date has been determined yet. \n     * Cisco Access Registrar (CAR) - The vulnerability is fixed in software\n       release 3.5.0.12 which will be available by Friday, 26 of March, 2004. \n\nObtaining Fixed Software\n\n   Cisco is offering free software upgrades to address this vulnerability for\n   all affected customers. \n\n   Customers may only install and expect support for the feature sets they\n   have purchased. By installing, downloading, accessing or otherwise using\n   such software upgrades, Customers agree to be bound by the terms of\n   Cisco\u0027s software license terms found at\n   http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set\n   forth at the Cisco Connection Online Software Center at\n   http://www.cisco.com/public/sw-center/sw-usingswc.shtml. \n\n   Customers with contracts should obtain upgraded software through their\n   regular update channels. For most customers, this means that upgrades\n   should be obtained through the Software Center on Cisco\u0027s worldwide\n   website at http://www.cisco.com/tacpage/sw-center. To access the software\n   download URL, you must be a registered user and you must be logged in. \n\n   Customers whose Cisco products are provided or maintained through a prior\n   or existing agreement with third-party support organizations such as Cisco\n   Partners, authorized resellers, or service providers, should contact that\n   support organization for assistance with obtaining the software\n   upgrade(s). \n\n   Customers who purchase direct from Cisco but who do not hold a Cisco\n   service contract and customers who purchase through third-party vendors\n   but are unsuccessful at obtaining fixed software through their point of\n   sale should get their upgrades by contacting the Cisco Technical\n   Assistance Center (TAC) using the contact information listed below. In\n   these cases, customers are entitled to obtain a free upgrade to a later\n   version of the same release or as indicated by the applicable corrected\n   software version in the Software Versions and Fixes section (noted above). \n\n   Cisco TAC contacts are as follows:\n\n     * +1 800 553 2447 (toll free from within North America)\n     * +1 408 526 7209 (toll call from anywhere in the world)\n     * e-mail: tac@cisco.com\n\n   See http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for\n   additional TAC contact information, including special localized telephone\n   numbers and instructions and e-mail addresses for use in various\n   languages. \n\n   Please have your product serial number available and give the URL of this\n   notice as evidence of your entitlement to a upgrade. Upgrades for\n   non-contract customers must be requested through the TAC. \n\n   Please do not contact either \"psirt@cisco.com\" or\n   \"security-alert@cisco.com\" for software upgrades. \n\nWorkarounds\n\n   The Cisco PSIRT recommends that affected users upgrade to a fixed software\n   version of code as soon as it is available. \n\n     * Restrict access to the HTTPS server on the network device. Allow\n       access to the network device only from trusted workstations by using\n       access lists / MAC filters that are available on the affected\n       platforms. \n     * Disable the SSL server / service on the network device. This\n       workaround must be weighed against the need for secure communications\n       with the vulnerable device. \n\nExploitation and Public Announcements\n\n   The Cisco PSIRT is not aware of any malicious use of the vulnerability\n   described in this advisory. \n\nStatus of This Notice: INTERIM\n\n   This is an interim advisory. Although Cisco cannot guarantee the accuracy\n   of all statements in this advisory, all of the facts have been checked to\n   the best of our ability. Cisco does not anticipate issuing updated\n   versions of this advisory unless there is some material change in the\n   facts. Should there be a significant change in the facts, Cisco may update\n   this advisory. \n\n   A stand-alone copy or paraphrase of the text of this security advisory\n   that omits the distribution URL in the following section is an\n   uncontrolled copy, and may lack important information or contain factual\n   errors. \n\nDistribution\n\n   This advisory will be posted on Cisco\u0027s worldwide website at\n   http://www.cisco.com/warp/public/707/cisco-sa-20040317-openssl.shtml . \n\n   In addition to worldwide web posting, a text version of this notice is\n   clear-signed with the Cisco PSIRT PGP key having the fingerprint 8C82 5207\n   0CA9 ED40 1DD2 EE2A 7B31 A8CF 32B6 B590 and is posted to the following\n   e-mail and Usenet news recipients. \n\n     * cust-security-announce@cisco.com\n     * first-teams@first.org (includes CERT/CC)\n     * bugtraq@securityfocus.com\n     * vulnwatch@vulnwatch.org\n     * cisco@spot.colorado.edu\n     * cisco-nsp@puck.nether.net\n     * full-disclosure@lists.netsys.com\n     * comp.dcom.sys.cisco@newsgate.cisco.com\n\n   Future updates of this advisory, if any, will be placed on Cisco\u0027s\n   worldwide website, but may or may not be actively announced on mailing\n   lists or newsgroups. Users concerned about this problem are encouraged to\n   check the above URL for any updates. \n\nRevision History\n\n   +------------------------------------------+\n   |Revision 1.0|2004-March-17|Initial        |\n   |            |             |release.       |\n   +------------------------------------------+\n\nCisco Security Procedures\n\n   Complete information on reporting security vulnerabilities in Cisco\n   products, obtaining assistance with security incidents, and registering to\n   receive security information from Cisco, is available on Cisco\u0027s worldwide\n   website at\n   http://www.cisco.com/warp/public/707/sec_incident_response.shtml. This\n   includes instructions for press inquiries regarding Cisco security\n   notices. All Cisco security advisories are available at\n   http://www.cisco.com/go/psirt. \n\n   This advisory is copyright 2004 by Cisco Systems, Inc. This advisory may\n   be redistributed freely after the release date given at the top of the\n   text, provided that redistributed copies are complete and unmodified,\n   including all date and version information. \n\n     ----------------------------------------------------------------------\n-----BEGIN PGP SIGNATURE-----\nComment: PGP Signed by Sharad Ahlawat, Cisco Systems PSIRT\n\niD8DBQFAWFvZezGozzK2tZARAqIwAKDXDMLAY6eDYyU8y1MhKZUto2SRxwCg+oid\n7AhsNlLsNVSLwTRKTHSigu0=\n=gtba\n-----END PGP SIGNATURE-----\n. \n\nOpenSSL 0.9.7d and OpenSSL 0.9.6m are available for download via HTTP and\nFTP from the following master locations (you can find the various FTP\nmirrors under http://www.openssl.org/source/mirror.html):\n\n    ftp://ftp.openssl.org/source/\n\nThe distribution file names are:\n\n    o openssl-0.9.7d.tar.gz\n      MD5 checksum: 1b49e90fc8a75c3a507c0a624529aca5\n    \n    o openssl-0.9.6m.tar.gz [normal]\n      MD5 checksum: 1b63bfdca1c37837dddde9f1623498f9\n    o openssl-engine-0.9.6m.tar.gz [engine]\n      MD5 checksum: 4c39d2524bd466180f9077f8efddac8c\n\nThe checksums were calculated using the following command:\n\n    openssl md5 openssl-0.9*.tar.gz\n\nCredits\n-------\n\nPatches for these issues were created by Dr Stephen Henson\n(steve@openssl.org) of the OpenSSL core team.  The OpenSSL team would\nlike to thank Codenomicon for supplying the TLS Test Tool which was\nused to discover these vulnerabilities, and Joe Orton of Red Hat for\nperforming the majority of the testing. \n\nReferences\n----------\n\nhttp://www.codenomicon.com/testtools/tls/\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0079\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0112\n\nURL for this Security Advisory:\nhttp://www.openssl.org/news/secadv_20040317.txt\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2004-0112"
      },
      {
        "db": "CERT/CC",
        "id": "VU#484726"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2004-000088"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2004-0790"
      },
      {
        "db": "BID",
        "id": "9899"
      },
      {
        "db": "BID",
        "id": "14567"
      },
      {
        "db": "VULHUB",
        "id": "VHN-8542"
      },
      {
        "db": "PACKETSTORM",
        "id": "41200"
      },
      {
        "db": "PACKETSTORM",
        "id": "41105"
      },
      {
        "db": "PACKETSTORM",
        "id": "32887"
      },
      {
        "db": "PACKETSTORM",
        "id": "32886"
      }
    ],
    "trust": 3.87
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2004-0112",
        "trust": 4.7
      },
      {
        "db": "CERT/CC",
        "id": "VU#484726",
        "trust": 3.3
      },
      {
        "db": "BID",
        "id": "9899",
        "trust": 2.8
      },
      {
        "db": "USCERT",
        "id": "TA04-078A",
        "trust": 2.5
      },
      {
        "db": "SECUNIA",
        "id": "11139",
        "trust": 1.7
      },
      {
        "db": "XF",
        "id": "15508",
        "trust": 0.8
      },
      {
        "db": "SECTRACK",
        "id": "1009458",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2004-000088",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200411-112",
        "trust": 0.7
      },
      {
        "db": "CNVD",
        "id": "CNVD-2004-0790",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "14567",
        "trust": 0.3
      },
      {
        "db": "VULHUB",
        "id": "VHN-8542",
        "trust": 0.1
      },
      {
        "db": "SECUNIA",
        "id": "17398",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "41200",
        "trust": 0.1
      },
      {
        "db": "SECUNIA",
        "id": "17381",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "41105",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "32887",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "32886",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#484726"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2004-0790"
      },
      {
        "db": "VULHUB",
        "id": "VHN-8542"
      },
      {
        "db": "BID",
        "id": "9899"
      },
      {
        "db": "BID",
        "id": "14567"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2004-000088"
      },
      {
        "db": "PACKETSTORM",
        "id": "41200"
      },
      {
        "db": "PACKETSTORM",
        "id": "41105"
      },
      {
        "db": "PACKETSTORM",
        "id": "32887"
      },
      {
        "db": "PACKETSTORM",
        "id": "32886"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200411-112"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-0112"
      }
    ]
  },
  "id": "VAR-200411-0171",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-8542"
      }
    ],
    "trust": 0.52271296
  },
  "last_update_date": "2024-03-18T21:58:08.254000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "[ important ]\u00a0OpenSSL Regarding vulnerability response Fujitsu \u00a0 Public vulnerability information",
        "trust": 0.8,
        "url": "http://www.openssl.org/news/secadv_20040317.txt"
      },
      {
        "title": "OpenSSL Repair measures for denial of service attack vulnerability",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=169016"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2004-000088"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200411-112"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-125",
        "trust": 1.0
      },
      {
        "problemtype": "Out-of-bounds read (CWE-125) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2004-000088"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-0112"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.7,
        "url": "http://www.openssl.org/news/secadv_20040317.txt"
      },
      {
        "trust": 2.5,
        "url": "http://www.securityfocus.com/bid/9899"
      },
      {
        "trust": 2.5,
        "url": "http://www.us-cert.gov/cas/techalerts/ta04-078a.html"
      },
      {
        "trust": 2.5,
        "url": "http://www.kb.cert.org/vuls/id/484726"
      },
      {
        "trust": 2.5,
        "url": "http://www.ciac.org/ciac/bulletins/o-101.shtml"
      },
      {
        "trust": 2.1,
        "url": "http://www.cisco.com/warp/public/707/cisco-sa-20040317-openssl.shtml"
      },
      {
        "trust": 1.8,
        "url": "http://www.uniras.gov.uk/vuls/2004/224012/index.htm"
      },
      {
        "trust": 1.7,
        "url": "http://lists.apple.com/archives/security-announce/2005/aug/msg00000.html"
      },
      {
        "trust": 1.7,
        "url": "http://lists.apple.com/archives/security-announce/2005//aug/msg00001.html"
      },
      {
        "trust": 1.7,
        "url": "http://docs.info.apple.com/article.html?artnum=61798"
      },
      {
        "trust": 1.7,
        "url": "http://lists.apple.com/mhonarc/security-announce/msg00045.html"
      },
      {
        "trust": 1.7,
        "url": "http://security.gentoo.org/glsa/glsa-200403-03.xml"
      },
      {
        "trust": 1.7,
        "url": "http://www.mandriva.com/security/advisories?name=mdksa-2004:023"
      },
      {
        "trust": 1.7,
        "url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a1049"
      },
      {
        "trust": 1.7,
        "url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a928"
      },
      {
        "trust": 1.7,
        "url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a9580"
      },
      {
        "trust": 1.7,
        "url": "http://www.redhat.com/support/errata/rhsa-2004-120.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.redhat.com/support/errata/rhsa-2004-121.html"
      },
      {
        "trust": 1.7,
        "url": "http://secunia.com/advisories/11139"
      },
      {
        "trust": 1.7,
        "url": "http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57524"
      },
      {
        "trust": 1.7,
        "url": "http://www.novell.com/linux/security/advisories/2004_07_openssl.html"
      },
      {
        "trust": 1.7,
        "url": "http://www.trustix.org/errata/2004/0012"
      },
      {
        "trust": 1.7,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15508"
      },
      {
        "trust": 1.6,
        "url": "http://www.slackware.org/security/viewer.php?l=slackware-security\u0026y=2004\u0026m=slackware-security.455961"
      },
      {
        "trust": 1.6,
        "url": "http://marc.info/?l=bugtraq\u0026m=108403806509920\u0026w=2"
      },
      {
        "trust": 1.6,
        "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000834"
      },
      {
        "trust": 1.6,
        "url": "http://marc.info/?l=bugtraq\u0026m=107953412903636\u0026w=2"
      },
      {
        "trust": 1.1,
        "url": "http://www.uniras.gov.uk/l1/l2/l3/alerts2004/alert-1204.txt"
      },
      {
        "trust": 1.1,
        "url": "ftp://ftp.netbsd.org/pub/netbsd/security/advisories/netbsd-sa2004-005.txt.asc"
      },
      {
        "trust": 1.1,
        "url": "ftp://ftp.sco.com/pub/updates/openserver/scosa-2004.10/scosa-2004.10.txt"
      },
      {
        "trust": 0.8,
        "url": "http://www.openssl.org"
      },
      {
        "trust": 0.8,
        "url": "http://www.ietf.org/rfc/rfc2712.txt"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/cert/jvnta04-078a/index.html"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/niscc/niscc-224012"
      },
      {
        "trust": 0.8,
        "url": "http://jvn.jp/tr/trta04-078a"
      },
      {
        "trust": 0.8,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2004-0112"
      },
      {
        "trust": 0.8,
        "url": "http://www.jpcert.or.jp/wr/2004/wr041201.txt"
      },
      {
        "trust": 0.8,
        "url": "http://www.jpcert.or.jp/wr/2004/wr041301.txt"
      },
      {
        "trust": 0.8,
        "url": "http://www.jpcert.or.jp/wr/2004/wr041701.txt"
      },
      {
        "trust": 0.8,
        "url": "http://www.jpcert.or.jp/wr/2004/wr041801.txt"
      },
      {
        "trust": 0.8,
        "url": "http://www.cpni.gov.uk/docs/re-20040317-00389.pdf?lang=en"
      },
      {
        "trust": 0.8,
        "url": "http://www.cpni.gov.uk/products/vulnerabilitydisclosures/default.aspx?id=va-20040317-00389.xml"
      },
      {
        "trust": 0.8,
        "url": "http://xforce.iss.net/xforce/xfdb/15508"
      },
      {
        "trust": 0.8,
        "url": "http://www.securitytracker.com/alerts/2004/mar/1009458.html"
      },
      {
        "trust": 0.8,
        "url": "http://www.securiteam.com/securitynews/5op0g20caa.html"
      },
      {
        "trust": 0.6,
        "url": "https://rhn.redhat.com/errata/rhsa-2004-119.html"
      },
      {
        "trust": 0.6,
        "url": "http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2f57524"
      },
      {
        "trust": 0.3,
        "url": "http://www.4d.com/products/4dwsv.html"
      },
      {
        "trust": 0.3,
        "url": "http://support.avaya.com/japple/css/japple?page=avaya.css.openpage\u0026temp.template.name=securityadvisory"
      },
      {
        "trust": 0.3,
        "url": "http://distro.conectiva.com.br/atualizacoes/index.php?id=a\u0026anuncio=000827"
      },
      {
        "trust": 0.3,
        "url": "http://distro.conectiva.com.br/atualizacoes/index.php?id=a\u0026anuncio=000834"
      },
      {
        "trust": 0.3,
        "url": "ftp://ftp.symantec.com/public/english_us_canada/products/sym_clientless_vpn/sym_clientless_vpn_5/updates/hf1-readme.txt"
      },
      {
        "trust": 0.3,
        "url": "http://www.vmware.com/support/kb/enduser/std_adp.php?p_faqid=1256"
      },
      {
        "trust": 0.3,
        "url": "http://www.vmware.com/support/kb/enduser/std_adp.php?p_faqid=1257"
      },
      {
        "trust": 0.3,
        "url": "http://www.netscreen.com/services/security/alerts/adv58466-signed.txt"
      },
      {
        "trust": 0.3,
        "url": "http://www.stonesoft.com/document/art/3123.html"
      },
      {
        "trust": 0.3,
        "url": "http://support.avaya.com/elmodocs2/security/asa-2005-239.htm"
      },
      {
        "trust": 0.3,
        "url": "http://www.checkpoint.com/techsupport/alerts/openssl.html"
      },
      {
        "trust": 0.3,
        "url": "http://rhn.redhat.com/errata/rhsa-2004-120.html"
      },
      {
        "trust": 0.3,
        "url": "http://rhn.redhat.com/errata/rhsa-2004-139.html"
      },
      {
        "trust": 0.3,
        "url": "http://rhn.redhat.com/errata/rhsa-2005-830.html"
      },
      {
        "trust": 0.3,
        "url": "http://www.bluecoat.com/support/knowledge/advisory_openssl_can-2004-0079.html"
      },
      {
        "trust": 0.3,
        "url": "http://www.apple.com/support/downloads/securityupdate_2004-04-05_(10_3_3).html"
      },
      {
        "trust": 0.3,
        "url": "http://support.novell.com/cgi-bin/search/searchtid.cgi?/2968981.htm"
      },
      {
        "trust": 0.3,
        "url": "http://www.securecomputing.com/pdf/52110relnotes.pdf"
      },
      {
        "trust": 0.3,
        "url": "http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2f57571"
      },
      {
        "trust": 0.3,
        "url": "http://www.tarantella.com/security/bulletin-10.html"
      },
      {
        "trust": 0.3,
        "url": "http://www.adiscon.com/common/en/advisory/2004-03-18.asp"
      },
      {
        "trust": 0.3,
        "url": "http://www.litespeedtech.com"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/357672"
      },
      {
        "trust": 0.3,
        "url": "http://www.info.apple.com/usen/security/security_updates.html"
      },
      {
        "trust": 0.3,
        "url": "http://www.suresec.org/advisories/adv5.pdf"
      },
      {
        "trust": 0.3,
        "url": "http://www.apple.com"
      },
      {
        "trust": 0.2,
        "url": "http://secunia.com/secunia_security_advisories/"
      },
      {
        "trust": 0.2,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.2,
        "url": "http://secunia.com/advisories/11139/"
      },
      {
        "trust": 0.2,
        "url": "http://secunia.com/about_secunia_advisories/"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2004-0079"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2004-0112"
      },
      {
        "trust": 0.1,
        "url": "http://marc.info/?l=bugtraq\u0026amp;m=107953412903636\u0026amp;w=2"
      },
      {
        "trust": 0.1,
        "url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026amp;anuncio=000834"
      },
      {
        "trust": 0.1,
        "url": "http://marc.info/?l=bugtraq\u0026amp;m=108403806509920\u0026amp;w=2"
      },
      {
        "trust": 0.1,
        "url": "http://www.slackware.org/security/viewer.php?l=slackware-security\u0026amp;y=2004\u0026amp;m=slackware-security.455961"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/48/"
      },
      {
        "trust": 0.1,
        "url": "http://rhn.redhat.com/errata/rhsa-2005-829.html"
      },
      {
        "trust": 0.1,
        "url": "http://rhn.redhat.com/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/1326/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/1306/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/17398/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/1044/"
      },
      {
        "trust": 0.1,
        "url": "http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/4222/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/17381/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/10133/"
      },
      {
        "trust": 0.1,
        "url": "http://www.cisco.com/warp/public/707/cisco-sa-20040317-openssl.shtml."
      },
      {
        "trust": 0.1,
        "url": "http://www.cisco.com/public/sw-license-agreement.html,"
      },
      {
        "trust": 0.1,
        "url": "https://ip_address_of_device/."
      },
      {
        "trust": 0.1,
        "url": "http://www.cisco.com/univercd/cc/td/doc/cisintwk/."
      },
      {
        "trust": 0.1,
        "url": "http://www.cisco.com/tacpage/sw-center."
      },
      {
        "trust": 0.1,
        "url": "http://www.cisco.com/warp/public/707/sec_incident_response.shtml."
      },
      {
        "trust": 0.1,
        "url": "http://www.cisco.com/go/psirt."
      },
      {
        "trust": 0.1,
        "url": "http://www.cisco.com/warp/public/687/directory/dirtac.shtml"
      },
      {
        "trust": 0.1,
        "url": "http://www.cisco.com/public/sw-center/sw-usingswc.shtml."
      },
      {
        "trust": 0.1,
        "url": "http://www.codenomicon.com/testtools/tls/"
      },
      {
        "trust": 0.1,
        "url": "http://www.openssl.org/source/mirror.html):"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=can-2004-0112"
      },
      {
        "trust": 0.1,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=can-2004-0079"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#484726"
      },
      {
        "db": "VULHUB",
        "id": "VHN-8542"
      },
      {
        "db": "BID",
        "id": "9899"
      },
      {
        "db": "BID",
        "id": "14567"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2004-000088"
      },
      {
        "db": "PACKETSTORM",
        "id": "41200"
      },
      {
        "db": "PACKETSTORM",
        "id": "41105"
      },
      {
        "db": "PACKETSTORM",
        "id": "32887"
      },
      {
        "db": "PACKETSTORM",
        "id": "32886"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200411-112"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-0112"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#484726"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2004-0790"
      },
      {
        "db": "VULHUB",
        "id": "VHN-8542"
      },
      {
        "db": "BID",
        "id": "9899"
      },
      {
        "db": "BID",
        "id": "14567"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2004-000088"
      },
      {
        "db": "PACKETSTORM",
        "id": "41200"
      },
      {
        "db": "PACKETSTORM",
        "id": "41105"
      },
      {
        "db": "PACKETSTORM",
        "id": "32887"
      },
      {
        "db": "PACKETSTORM",
        "id": "32886"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200411-112"
      },
      {
        "db": "NVD",
        "id": "CVE-2004-0112"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2004-03-17T00:00:00",
        "db": "CERT/CC",
        "id": "VU#484726"
      },
      {
        "date": "2004-03-17T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2004-0790"
      },
      {
        "date": "2004-11-23T00:00:00",
        "db": "VULHUB",
        "id": "VHN-8542"
      },
      {
        "date": "2004-03-17T00:00:00",
        "db": "BID",
        "id": "9899"
      },
      {
        "date": "2005-08-15T00:00:00",
        "db": "BID",
        "id": "14567"
      },
      {
        "date": "2007-04-01T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2004-000088"
      },
      {
        "date": "2005-11-03T01:02:14",
        "db": "PACKETSTORM",
        "id": "41200"
      },
      {
        "date": "2005-11-02T01:11:22",
        "db": "PACKETSTORM",
        "id": "41105"
      },
      {
        "date": "2004-03-17T15:44:08",
        "db": "PACKETSTORM",
        "id": "32887"
      },
      {
        "date": "2004-03-17T14:36:13",
        "db": "PACKETSTORM",
        "id": "32886"
      },
      {
        "date": "2003-07-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200411-112"
      },
      {
        "date": "2004-11-23T05:00:00",
        "db": "NVD",
        "id": "CVE-2004-0112"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2004-03-26T00:00:00",
        "db": "CERT/CC",
        "id": "VU#484726"
      },
      {
        "date": "2004-03-17T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2004-0790"
      },
      {
        "date": "2018-10-30T00:00:00",
        "db": "VULHUB",
        "id": "VHN-8542"
      },
      {
        "date": "2015-03-19T08:20:00",
        "db": "BID",
        "id": "9899"
      },
      {
        "date": "2006-05-05T23:10:00",
        "db": "BID",
        "id": "14567"
      },
      {
        "date": "2024-03-04T06:12:00",
        "db": "JVNDB",
        "id": "JVNDB-2004-000088"
      },
      {
        "date": "2021-11-10T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200411-112"
      },
      {
        "date": "2024-02-15T20:54:12.877000",
        "db": "NVD",
        "id": "CVE-2004-0112"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "network",
    "sources": [
      {
        "db": "BID",
        "id": "9899"
      },
      {
        "db": "BID",
        "id": "14567"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "OpenSSL does not adequately validate length of Kerberos ticket during SSL/TLS handshake",
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#484726"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Unknown",
    "sources": [
      {
        "db": "BID",
        "id": "9899"
      },
      {
        "db": "BID",
        "id": "14567"
      }
    ],
    "trust": 0.6
  }
}

VAR-202110-0521

Vulnerability from variot - Updated: 2023-12-18 13:55

Forcepoint NGFW Engine versions 6.5.11 and earlier, 6.8.6 and earlier, and 6.10.0 are vulnerable to TCP reflected amplification vulnerability, if HTTP User Response has been configured

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202110-0521",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "next generation firewall",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "6.8.0"
      },
      {
        "model": "next generation firewall",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "6.10.0"
      },
      {
        "model": "next generation firewall",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "6.5.11"
      },
      {
        "model": "next generation firewall",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "6.8.6"
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2021-41530"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:forcepoint:next_generation_firewall:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "6.5.11",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:forcepoint:next_generation_firewall:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "6.8.6",
                "versionStartIncluding": "6.8.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:forcepoint:next_generation_firewall:6.10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2021-41530"
      }
    ]
  },
  "cve": "CVE-2021-41530",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "VHN-402708",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 3.9,
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2021-41530",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202110-071",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-402708",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-402708"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-41530"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202110-071"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Forcepoint NGFW Engine versions 6.5.11 and earlier, 6.8.6 and earlier, and 6.10.0 are vulnerable to TCP reflected amplification vulnerability, if HTTP User Response has been configured",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2021-41530"
      },
      {
        "db": "VULHUB",
        "id": "VHN-402708"
      }
    ],
    "trust": 0.99
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2021-41530",
        "trust": 1.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202110-071",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-402708",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-402708"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-41530"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202110-071"
      }
    ]
  },
  "id": "VAR-202110-0521",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-402708"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T13:55:43.702000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Forcepoint NGFW Engine Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=165567"
      }
    ],
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202110-071"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2021-41530"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "https://help.forcepoint.com/security/cve/cve-2021-41530.html"
      },
      {
        "trust": 0.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-41530"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/forcepoint-next-generation-firewall-denial-of-service-via-tcp-reflected-amplification-36589"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-402708"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-41530"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202110-071"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-402708"
      },
      {
        "db": "NVD",
        "id": "CVE-2021-41530"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202110-071"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-10-04T00:00:00",
        "db": "VULHUB",
        "id": "VHN-402708"
      },
      {
        "date": "2021-10-04T17:15:08.577000",
        "db": "NVD",
        "id": "CVE-2021-41530"
      },
      {
        "date": "2021-10-04T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202110-071"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-10-12T00:00:00",
        "db": "VULHUB",
        "id": "VHN-402708"
      },
      {
        "date": "2021-10-12T22:07:34.590000",
        "db": "NVD",
        "id": "CVE-2021-41530"
      },
      {
        "date": "2021-10-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202110-071"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202110-071"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Forcepoint NGFW Engine Security hole",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202110-071"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "other",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202110-071"
      }
    ],
    "trust": 0.6
  }
}

VAR-201912-0092

Vulnerability from variot - Updated: 2023-12-18 13:33

Forcepoint NGFW Security Management Center (SMC) versions lower than 6.5.12 or 6.7.1 have a rare issue that in specific circumstances can corrupt the internal configuration database. When the database is corrupted, the SMC might produce an incorrect IPsec configuration for the Forcepoint Next Generation Firewall (NGFW), possibly resulting in settings that are weaker than expected. All SMC versions lower than 6.5.12 or 6.7.1 are vulnerable. Forcepoint NGFW Security Management Center (SMC) Contains an invalid type conversion vulnerability.Information may be altered

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201912-0092",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "next generation firewall security management center",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "6.6.0"
      },
      {
        "model": "next generation firewall security management center",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "6.7.1"
      },
      {
        "model": "next generation firewall security management center",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "6.5.12"
      },
      {
        "model": "ngfw security management center",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "forcepoint",
        "version": "6.5.12"
      },
      {
        "model": "ngfw security management center",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "forcepoint",
        "version": "6.7.1"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014019"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6147"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:forcepoint:next_generation_firewall_security_management_center:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.5.12",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:forcepoint:next_generation_firewall_security_management_center:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.7.1",
                "versionStartIncluding": "6.6.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-6147"
      }
    ]
  },
  "cve": "CVE-2019-6147",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 4.3,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2019-6147",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 8.6,
            "id": "VHN-157582",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 2.2,
            "impactScore": 3.6,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "High",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.9,
            "baseSeverity": "Medium",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2019-6147",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2019-6147",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201912-1020",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-157582",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-157582"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014019"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6147"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-1020"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Forcepoint NGFW Security Management Center (SMC) versions lower than 6.5.12 or 6.7.1 have a rare issue that in specific circumstances can corrupt the internal configuration database. When the database is corrupted, the SMC might produce an incorrect IPsec configuration for the Forcepoint Next Generation Firewall (NGFW), possibly resulting in settings that are weaker than expected. All SMC versions lower than 6.5.12 or 6.7.1 are vulnerable. Forcepoint NGFW Security Management Center (SMC) Contains an invalid type conversion vulnerability.Information may be altered",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-6147"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014019"
      },
      {
        "db": "VULHUB",
        "id": "VHN-157582"
      }
    ],
    "trust": 1.71
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2019-6147",
        "trust": 2.5
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014019",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-1020",
        "trust": 0.7
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-03158",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-157582",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-157582"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014019"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6147"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-1020"
      }
    ]
  },
  "id": "VAR-201912-0092",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-157582"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T13:33:14.901000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Article Number: 000017918",
        "trust": 0.8,
        "url": "https://support.forcepoint.com/kbarticle?id=000017918"
      },
      {
        "title": "Forcepoint NGFW Security Management Center Fixes for code issue vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=108236"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014019"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-1020"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-704",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-157582"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014019"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6147"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "https://help.forcepoint.com/security/cve/cve-2019-6147.html"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6147"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-6147"
      },
      {
        "trust": 0.6,
        "url": "https://support.forcepoint.com/kbarticle?id=000017918"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/forcepoint-ngfw-security-management-center-privilege-escalation-via-incorrect-ipsec-configuration-31244"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-157582"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014019"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6147"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-1020"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-157582"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014019"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6147"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-1020"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-12-23T00:00:00",
        "db": "VULHUB",
        "id": "VHN-157582"
      },
      {
        "date": "2020-01-24T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-014019"
      },
      {
        "date": "2019-12-23T20:15:11.157000",
        "db": "NVD",
        "id": "CVE-2019-6147"
      },
      {
        "date": "2019-12-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201912-1020"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-01-10T00:00:00",
        "db": "VULHUB",
        "id": "VHN-157582"
      },
      {
        "date": "2020-01-24T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-014019"
      },
      {
        "date": "2021-09-16T13:16:08.060000",
        "db": "NVD",
        "id": "CVE-2019-6147"
      },
      {
        "date": "2021-09-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201912-1020"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-1020"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Forcepoint NGFW Security Management Center Vulnerable to incorrect type conversion",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-014019"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "code problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201912-1020"
      }
    ],
    "trust": 0.6
  }
}

VAR-202209-0654

Vulnerability from variot - Updated: 2023-12-18 13:27

Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveraged by Forcepoint One Endpoint (F1E), Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20, 2022. The XML parser in the Policy Engine was found to be improperly configured to support external entities and external DTD (Document Type Definitions), which can lead to an XXE attack. This issue affects: Forcepoint Data Loss Prevention (DLP) versions prior to 8.8.2. Forcepoint One Endpoint (F1E) with Policy Engine versions prior to 8.8.2. Forcepoint Web Security Content Gateway versions prior to 8.5.5. Forcepoint Email Security with DLP enabled versions prior to 8.5.5. Forcepoint Cloud Security Gateway prior to June 20, 2022. multiple Forcepoint LLC. The product has XML There is a vulnerability in an external entity.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202209-0654",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "web security content gateway",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "8.5.5"
      },
      {
        "model": "one endpoint with policy engine",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "8.8.2"
      },
      {
        "model": "data loss prevention",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "8.8.2"
      },
      {
        "model": "email security",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "8.5.5"
      },
      {
        "model": "cloud security gateway",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "2022-06-20"
      },
      {
        "model": "cloud security gateway",
        "scope": null,
        "trust": 0.8,
        "vendor": "forcepoint",
        "version": null
      },
      {
        "model": "web security content gateway",
        "scope": null,
        "trust": 0.8,
        "vendor": "forcepoint",
        "version": null
      },
      {
        "model": "data loss prevention",
        "scope": null,
        "trust": 0.8,
        "vendor": "forcepoint",
        "version": null
      },
      {
        "model": "email security",
        "scope": null,
        "trust": 0.8,
        "vendor": "forcepoint",
        "version": null
      },
      {
        "model": "one endpoint with policy engine",
        "scope": null,
        "trust": 0.8,
        "vendor": "forcepoint",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-016914"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-1700"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:forcepoint:cloud_security_gateway:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2022-06-20",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:forcepoint:email_security:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.5.5",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:forcepoint:one_endpoint_with_policy_engine:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.8.2",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:forcepoint:data_loss_prevention:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.8.2",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:forcepoint:web_security_content_gateway:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.5.5",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-1700"
      }
    ]
  },
  "cve": "CVE-2022-1700",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "psirt@forcepoint.com",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 9.8,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2022-1700",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2022-1700",
            "trust": 1.8,
            "value": "CRITICAL"
          },
          {
            "author": "psirt@forcepoint.com",
            "id": "CVE-2022-1700",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202209-726",
            "trust": 0.6,
            "value": "CRITICAL"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-016914"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-1700"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-1700"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202209-726"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Improper Restriction of XML External Entity Reference (\u0027XXE\u0027) vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveraged by Forcepoint One Endpoint (F1E), Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20, 2022. The XML parser in the Policy Engine was found to be improperly configured to support external entities and external DTD (Document Type Definitions), which can lead to an XXE attack. This issue affects: Forcepoint Data Loss Prevention (DLP) versions prior to 8.8.2. Forcepoint One Endpoint (F1E) with Policy Engine versions prior to 8.8.2. Forcepoint Web Security Content Gateway versions prior to 8.5.5. Forcepoint Email Security with DLP enabled versions prior to 8.5.5. Forcepoint Cloud Security Gateway prior to June 20, 2022. multiple Forcepoint LLC. The product has XML There is a vulnerability in an external entity.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-1700"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-016914"
      },
      {
        "db": "VULHUB",
        "id": "VHN-419813"
      }
    ],
    "trust": 1.71
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2022-1700",
        "trust": 3.3
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-016914",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202209-726",
        "trust": 0.7
      },
      {
        "db": "VULHUB",
        "id": "VHN-419813",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-419813"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-016914"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-1700"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202209-726"
      }
    ]
  },
  "id": "VAR-202209-0654",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-419813"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T13:27:03.236000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Forcepoint Data Loss Prevention Fixes for code issue vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=207863"
      }
    ],
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202209-726"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-611",
        "trust": 1.1
      },
      {
        "problemtype": "XML Improper restriction of external entity references (CWE-611) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-419813"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-016914"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-1700"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.5,
        "url": "https://help.forcepoint.com/security/cve/cve-2022-1700.html"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-1700"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/forcepoint-dlp-external-xml-entity-injection-39253"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/cveshow/cve-2022-1700/"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-419813"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-016914"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-1700"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202209-726"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-419813"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-016914"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-1700"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202209-726"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-09-12T00:00:00",
        "db": "VULHUB",
        "id": "VHN-419813"
      },
      {
        "date": "2023-10-06T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2022-016914"
      },
      {
        "date": "2022-09-12T19:15:08.603000",
        "db": "NVD",
        "id": "CVE-2022-1700"
      },
      {
        "date": "2022-09-12T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202209-726"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-09-15T00:00:00",
        "db": "VULHUB",
        "id": "VHN-419813"
      },
      {
        "date": "2023-10-06T08:13:00",
        "db": "JVNDB",
        "id": "JVNDB-2022-016914"
      },
      {
        "date": "2022-09-15T18:05:38.843000",
        "db": "NVD",
        "id": "CVE-2022-1700"
      },
      {
        "date": "2022-09-16T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202209-726"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202209-726"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "plural \u00a0Forcepoint\u00a0LLC.\u00a0 In the product \u00a0XML\u00a0 External entity vulnerabilities",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-016914"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "code problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202209-726"
      }
    ],
    "trust": 0.6
  }
}

VAR-202104-0530

Vulnerability from variot - Updated: 2023-12-18 13:07

Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202104-0530",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "web security content gateway",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "8.5.4"
      },
      {
        "model": "email security",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "8.5.4"
      },
      {
        "model": "data loss prevention",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "8.7.1"
      },
      {
        "model": "web security content gateway",
        "scope": null,
        "trust": 0.8,
        "vendor": "forcepoint",
        "version": null
      },
      {
        "model": "email security",
        "scope": null,
        "trust": 0.8,
        "vendor": "forcepoint",
        "version": null
      },
      {
        "model": "data loss prevention",
        "scope": null,
        "trust": 0.8,
        "vendor": "forcepoint",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-016513"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-6590"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:forcepoint:data_loss_prevention:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.7.1",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:forcepoint:email_security:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.5.4",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:forcepoint:web_security_content_gateway:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.5.4",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-6590"
      }
    ]
  },
  "cve": "CVE-2020-6590",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.0,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2020-6590",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-184715",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 7.5,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2020-6590",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2020-6590",
            "trust": 1.8,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202104-470",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-184715",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2020-6590",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-184715"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-6590"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-016513"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-6590"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-470"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-6590"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-016513"
      },
      {
        "db": "VULHUB",
        "id": "VHN-184715"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-6590"
      }
    ],
    "trust": 1.8
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-6590",
        "trust": 3.4
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-016513",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-470",
        "trust": 0.7
      },
      {
        "db": "VULHUB",
        "id": "VHN-184715",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-6590",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-184715"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-6590"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-016513"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-6590"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-470"
      }
    ]
  },
  "id": "VAR-202104-0530",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-184715"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T13:07:12.021000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Improper\u00a0Restriction\u00a0of\u00a0XML\u00a0External\u00a0Entity\u00a0Reference\u00a0Vulnerability\u00a0(CVE-2020-6590)",
        "trust": 0.8,
        "url": "https://help.forcepoint.com/security/cve/cve-2020-6590.html"
      },
      {
        "title": "Forcepoint Web Security Content Gateway Fixes for code issue vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=147203"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-016513"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-470"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-611",
        "trust": 1.1
      },
      {
        "problemtype": "XML Improper restrictions on external entity references (CWE-611) [NVD Evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-184715"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-016513"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-6590"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "https://help.forcepoint.com/security/cve/cve-2020-6590.html"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6590"
      },
      {
        "trust": 0.7,
        "url": "https://support.forcepoint.com/kbarticle?id=000019488"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/forcepoint-web-security-content-gateway-external-xml-entity-injection-35042"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/611.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-184715"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-6590"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-016513"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-6590"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-470"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-184715"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-6590"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-016513"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-6590"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-470"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-04-08T00:00:00",
        "db": "VULHUB",
        "id": "VHN-184715"
      },
      {
        "date": "2021-04-08T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-6590"
      },
      {
        "date": "2021-12-14T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-016513"
      },
      {
        "date": "2021-04-08T22:15:13.230000",
        "db": "NVD",
        "id": "CVE-2020-6590"
      },
      {
        "date": "2021-04-08T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202104-470"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-09-16T00:00:00",
        "db": "VULHUB",
        "id": "VHN-184715"
      },
      {
        "date": "2021-04-14T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-6590"
      },
      {
        "date": "2021-12-14T01:38:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-016513"
      },
      {
        "date": "2021-09-16T15:51:56.900000",
        "db": "NVD",
        "id": "CVE-2020-6590"
      },
      {
        "date": "2021-09-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202104-470"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-470"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Forcepoint\u00a0Web\u00a0Security\u00a0Content\u00a0Gateway\u00a0 In \u00a0XML\u00a0 External entity vulnerabilities",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-016513"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "code problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202104-470"
      }
    ],
    "trust": 0.6
  }
}

VAR-201908-0046

Vulnerability from variot - Updated: 2023-12-18 12:43

Forcepoint Next Generation Firewall (Forcepoint NGFW) 6.4.x before 6.4.7, 6.5.x before 6.5.4, and 6.6.x before 6.6.2 has a serious authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services protected by the NGFW Engine. The vulnerability affects the following NGFW features when the LDAP authentication method is used as the backend authentication: IPsec VPN, SSL VPN or Browser-based user authentication. The vulnerability does not apply when any other backend authentication is used. The RADIUS authentication method is not vulnerable, for example. Forcepoint Next Generation Firewall (Forcepoint NGFW) Contains an authentication vulnerability.Information may be obtained and information may be altered. Forcepoint Next Generation Firewall (NGFW) is a next-generation firewall product of Forcepoint Corporation in the United States

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201908-0046",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "next generation firewall",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "6.4.0"
      },
      {
        "model": "next generation firewall",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "6.6.0"
      },
      {
        "model": "next generation firewall",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "6.4.7"
      },
      {
        "model": "next generation firewall",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "6.5.4"
      },
      {
        "model": "next generation firewall",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "6.5.0"
      },
      {
        "model": "next generation firewall",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "forcepoint",
        "version": "6.6.2"
      },
      {
        "model": "next generation firewall",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "forcepoint",
        "version": "6.6.2"
      },
      {
        "model": "next generation firewall",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "forcepoint",
        "version": "6.4.7"
      },
      {
        "model": "next generation firewall",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "forcepoint",
        "version": "6.5.x"
      },
      {
        "model": "next generation firewall",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "forcepoint",
        "version": "6.4.x"
      },
      {
        "model": "next generation firewall",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "forcepoint",
        "version": "6.6.x"
      },
      {
        "model": "next generation firewall",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "forcepoint",
        "version": "6.5.4"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-008642"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6143"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:forcepoint:next_generation_firewall:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.4.7",
                "versionStartIncluding": "6.4.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:forcepoint:next_generation_firewall:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.5.4",
                "versionStartIncluding": "6.5.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:forcepoint:next_generation_firewall:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.6.2",
                "versionStartIncluding": "6.6.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-6143"
      }
    ]
  },
  "cve": "CVE-2019-6143",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 6.4,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2019-6143",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-157578",
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "impactScore": 5.2,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 9.1,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2019-6143",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2019-6143",
            "trust": 1.8,
            "value": "CRITICAL"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201908-1360",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-157578",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-157578"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-008642"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6143"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201908-1360"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Forcepoint Next Generation Firewall (Forcepoint NGFW) 6.4.x before 6.4.7, 6.5.x before 6.5.4, and 6.6.x before 6.6.2 has a serious authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services protected by the NGFW Engine. The vulnerability affects the following NGFW features when the LDAP authentication method is used as the backend authentication: IPsec VPN, SSL VPN or Browser-based user authentication. The vulnerability does not apply when any other backend authentication is used. The RADIUS authentication method is not vulnerable, for example. Forcepoint Next Generation Firewall (Forcepoint NGFW) Contains an authentication vulnerability.Information may be obtained and information may be altered. Forcepoint Next Generation Firewall (NGFW) is a next-generation firewall product of Forcepoint Corporation in the United States",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-6143"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-008642"
      },
      {
        "db": "VULHUB",
        "id": "VHN-157578"
      }
    ],
    "trust": 1.71
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2019-6143",
        "trust": 2.5
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-008642",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201908-1360",
        "trust": 0.7
      },
      {
        "db": "VULHUB",
        "id": "VHN-157578",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-157578"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-008642"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6143"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201908-1360"
      }
    ]
  },
  "id": "VAR-201908-0046",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-157578"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T12:43:24.345000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Article Number: 000017474",
        "trust": 0.8,
        "url": "https://support.forcepoint.com/kbarticle?id=000017474"
      },
      {
        "title": "Forcepoint Next Generation Firewall Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=97717"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-008642"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201908-1360"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-287",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-157578"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-008642"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6143"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "https://help.forcepoint.com/security/cve/cve-2019-6143.html"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-6143"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6143"
      },
      {
        "trust": 0.6,
        "url": "https://support.forcepoint.com/kbarticle?id=000017474"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/forcepoint-ngfw-privilege-escalation-via-ldap-authentication-30120"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-157578"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-008642"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6143"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201908-1360"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-157578"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-008642"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-6143"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201908-1360"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-08-20T00:00:00",
        "db": "VULHUB",
        "id": "VHN-157578"
      },
      {
        "date": "2019-09-04T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-008642"
      },
      {
        "date": "2019-08-20T21:15:13.357000",
        "db": "NVD",
        "id": "CVE-2019-6143"
      },
      {
        "date": "2019-08-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201908-1360"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-08-30T00:00:00",
        "db": "VULHUB",
        "id": "VHN-157578"
      },
      {
        "date": "2019-09-04T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2019-008642"
      },
      {
        "date": "2022-04-18T16:11:12.913000",
        "db": "NVD",
        "id": "CVE-2019-6143"
      },
      {
        "date": "2021-09-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201908-1360"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201908-1360"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Forcepoint Next Generation Firewall Authentication vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2019-008642"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "authorization issue",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201908-1360"
      }
    ],
    "trust": 0.6
  }
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

66 vulnerabilities by forcepoint

CVE-2025-12694 (GCVE-0-2025-12694)

CVE-2025-2274 (GCVE-0-2025-2274)

CVE-2025-12690 (GCVE-0-2025-12690)

CVE-2025-14026 (GCVE-0-2025-14026)

CVE-2025-2272 (GCVE-0-2025-2272)

CVE-2024-9103 (GCVE-0-2024-9103)

CVE-2024-2166 (GCVE-0-2024-2166)

CVE-2023-6452 (GCVE-0-2023-6452)

CVE-2023-5451 (GCVE-0-2023-5451)

CVE-2023-1705 (GCVE-0-2023-1705)

CVE-2023-2080 (GCVE-0-2023-2080)

CVE-2023-26292 (GCVE-0-2023-26292)

CVE-2023-26291 (GCVE-0-2023-26291)

CVE-2025-12694 (GCVE-0-2025-12694)

CVE-2025-2274 (GCVE-0-2025-2274)

CVE-2025-12690 (GCVE-0-2025-12690)

CVE-2025-14026 (GCVE-0-2025-14026)

CVE-2025-2272 (GCVE-0-2025-2272)

CVE-2024-9103 (GCVE-0-2024-9103)

CVE-2024-2166 (GCVE-0-2024-2166)

CVE-2023-6452 (GCVE-0-2023-6452)

CVE-2023-5451 (GCVE-0-2023-5451)

CVE-2023-1705 (GCVE-0-2023-1705)

CVE-2023-2080 (GCVE-0-2023-2080)

VAR-200411-0171

Credits

References

VAR-202110-0521

VAR-201912-0092

VAR-202209-0654

VAR-202104-0530

VAR-201908-0046

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

66 vulnerabilities by forcepoint

CVE-2025-12694 (GCVE-0-2025-12694)

CVE-2025-2274 (GCVE-0-2025-2274)

CVE-2025-12690 (GCVE-0-2025-12690)

CVE-2025-14026 (GCVE-0-2025-14026)

CVE-2025-2272 (GCVE-0-2025-2272)

CVE-2024-9103 (GCVE-0-2024-9103)

CVE-2024-2166 (GCVE-0-2024-2166)

CVE-2023-6452 (GCVE-0-2023-6452)

CVE-2023-5451 (GCVE-0-2023-5451)

CVE-2023-1705 (GCVE-0-2023-1705)

CVE-2023-2080 (GCVE-0-2023-2080)

CVE-2023-26292 (GCVE-0-2023-26292)

CVE-2023-26291 (GCVE-0-2023-26291)

CVE-2025-12694 (GCVE-0-2025-12694)

CVE-2025-2274 (GCVE-0-2025-2274)

CVE-2025-12690 (GCVE-0-2025-12690)

CVE-2025-14026 (GCVE-0-2025-14026)

CVE-2025-2272 (GCVE-0-2025-2272)

CVE-2024-9103 (GCVE-0-2024-9103)

CVE-2024-2166 (GCVE-0-2024-2166)

CVE-2023-6452 (GCVE-0-2023-6452)

CVE-2023-5451 (GCVE-0-2023-5451)

CVE-2023-1705 (GCVE-0-2023-1705)

CVE-2023-2080 (GCVE-0-2023-2080)

VAR-200411-0171

Credits

References

VAR-202110-0521

VAR-201912-0092

VAR-202209-0654

VAR-202104-0530

VAR-201908-0046

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.