CVE-2023-42791

A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 and 6.2.0 through 6.2.11 allows attacker to execute unauthorized code or commands via crafted HTTP requests...

The server for managing Fortinet FortiClient Enterprise Management Server (EMS) is vulnerable due to insecure privilege management, allowing attackers to execute arbitrary commands.

The vulnerability of the Fortinet FortiClient Enterprise Management Server EMS server relates to insecure management of privileges. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using specially crafted HTTP or HTTPS requests...

CVE-2023-44253

An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in Fortinet FortiManager version 7.4.0 through 7.4.1 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.1 and before 7.2.5 and FortiAnalyzer-BigData before 7.2.5 allows an adom administrator to enumerate...

The vulnerability of the NEXO-OS operating system in the Bosch Nexo cordless nutrunner and Bosch Nexo special cordless nutrunner tools used in production lines allows a intruder to gain unauthorized access to the database.

The vulnerability of the NEXO-OS operating system for tools used in production line assembly work, such as the Bosch Nexo cordless nutrunner and the Bosch Nexo special cordless nutrunner, is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability ca...

CVE-2023-39611

An issue in Software FX Chart FX 7 version 7.0.4962.20829 allows attackers to enumerate and read files from the local filesystem by sending crafted web requests...

CVE-2023-39611

An issue in Software FX Chart FX 7 version 7.0.4962.20829 allows attackers to enumerate and read files from the local filesystem by sending crafted web requests...

CVE-2023-44250

An improper privilege management vulnerability CWE-269 in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0 through 7.4.1 allows an authenticated attacker to perform elevated actions via crafted HTTP or HTTPS requests...

CVE-2023-48257

The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution RCE with root privileges on the device. The vulnerability can be exploited directly by authenticated users, via crafted HTTP requests, or indirectly by unauthenticate...

CVE-2023-48253

The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTTP request. By abusing this vulnerability it is possible to exfiltrate other users’ password hashes or update them with arbitrary values and access their...

PT-2024-1008 · Fortinet · Fortiproxy +1

Name of the Vulnerable Software and Affected Versions: FortiOS versions 7.2.5 through 7.4.1 FortiProxy versions 7.4.0 through 7.4.1 Description: An improper privilege management issue allows an authenticated attacker to perform elevated actions via crafted HTTP or HTTPS requests. This can...

The vulnerability of the TendaTelnet function in the microprogramming software of the Tenda M3 network access controller allows a intruder to execute arbitrary commands.

The vulnerability of the TendaTelnet function in the microprogramming software of the Tenda M3 network access controller exists due to the failure to take measures to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to...

Grails Resource Management Error Vulnerability

Grails is a suite of open source frameworks for rapid web application development based on the Groovy programming language from the Grails project. Grails suffers from a resource management error vulnerability that originates from allowing an attacker to cause a denial of service DOS to the JVM v...

The vulnerability of the graphical interface of the FortiSandbox threat detection and mitigation system allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the FortiSandbox threat detection and mitigation graphical interface is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks by sending specially crafted HTTP...

UBUNTU-CVE-2023-34053

In Spring Framework versions 6.0.0 - 6.0.13, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Specifically, an application is vulnerable when all of the following are true: the application uses Spring MVC or Spring WebFlux...

PT-2023-31114 · Unknown · Ironman Powershell Universal

Name of the Vulnerable Software and Affected Versions: Ironman PowerShell Universal versions 3.0.0 through 4.2.0 Description: The issue allows remote attackers to execute arbitrary commands via crafted HTTP requests if a param block is used, due to invalid sanitization of input strings. This is...

The vulnerability of Microsoft On-Premises Data Gateways lies in security configuration errors, allowing attackers to circumvent security restrictions.

The vulnerability of Microsoft On-Premises Data Gateways is related to errors in security settings when processing certificates. Exploiting this vulnerability allows a malicious actor to bypass security restrictions by sending a specially crafted web request...

PT-2023-9193 · Fortinet · Fortiportal

Name of the Vulnerable Software and Affected Versions: Fortinet FortiPortal versions 6.0.0 through 6.0.14 Description: The issue is related to the implementation of client-side security features in Fortinet FortiPortal, allowing a remote attacker to gain unauthorized access to protected informati...

CVE-2023-42783

A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.2 through 8.4.0 and 8.3.2 through 8.3.0 and 8.2.2 allows attacker to read arbitrary files via crafted http requests...

CVE-2023-36641

A numeric truncation error in Fortinet FortiProxy version 7.2.0 through 7.2.4, FortiProxy version 7.0.0 through 7.0.10, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1, all versions, FortiProxy 1.0 all versions, FortiOS version 7.4.0, FortiOS version 7.2.0 through 7.2.5,...

CVE-2023-25603

A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.0 - 6.4.1 allow an unauthorized attacker to carry out privileged actions and retrieve sensitive information via crafted web requests...