CVE-2022-39952

A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or commands via...

CVE-2022-26117

An empty password in configuration file vulnerability CWE-258 in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI...

CVE-2024-31488

An improper neutralization of inputs during web page generation vulnerability CWE-79 in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 7.2.0 through 7.2.3 may allow a remote authenticated attacker to perform stored and...

CVE-2024-31488

An improper neutralization of inputs during web page generation vulnerability CWE-79 in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 7.2.0 through 7.2.3 may allow a remote authenticated attacker to perform stored and...

CVE-2024-31488

An improper neutralization of inputs during web page generation vulnerability CWE-79 in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 7.2.0 through 7.2.3 may allow a remote authenticated attacker to perform stored and...

CVE-2024-31488

CVE-2024-31488 affects FortiNAC with an improper neutralization of inputs during web page generation, enabling stored and reflected XSS for an authenticated remote attacker. Affected FortiNAC versions per PT-2024-24117 include 7.2.0–7.2.3, 8.7.0–8.7.6, 8.8.0–8.8.11, 9.1.0–9.1.10, 9.2.0–9.2.8, and...

CVE-2024-31488

An improper neutralization of inputs during web page generation vulnerability CWE-79 in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 7.2.0 through 7.2.3 may allow a remote authenticated attacker to perform stored and...

Fortinet FortiNAC 跨站脚本漏洞

Fortinet FortiNAC is a suite of network access control solutions from the U.S. company Fiat Fortinet. The product is primarily used for network access control and IoT security. Fortinet FortiNAC suffers from a cross-site scripting vulnerability that originates from incorrect neutralization of...

Vulnerabilities fixed in Fortinet

Fortinet has fixed a number of vulnerabilities in FortiOS, FortiProxy, FortiNAC, FortiSandbox and FortiClient. A malicious person could exploit the vulnerability marked CVE-2023-45590 to executing code on a FortiClientLinux system by getting a user to visit a rogue website. Other vulnerabilities...

Fortinet FortiNAC Cross-Site Scripting Vulnerability (CNVD-2024-13094)

Fortinet FortiNAC is a set of network access control solutions from the U.S. company Fita Fortinet. The product is mainly used for network access control and IoT security. Fortinet FortiNAC has a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of...

The vulnerability in the web interface for managing access control devices in Fortinet’s FortiNAC system allows a attacker to execute XSS attacks.

The vulnerability in the Fortinet FortiNAC network access control web interface relates to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2023-26206

An improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9.1.0 - 9.1.10 and 7.2.0 allows an attacker to execute unauthorized code or commands via the name fields observed in the policy audit logs...

Cross site scripting

An improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9.1.0 - 9.1.10 and 7.2.0 allows an attacker to execute unauthorized code or commands via the name fields observed in the policy audit logs...

CVE-2023-26206

Fortinet FortiNAC is affected by a cross-site scripting (XSS) vulnerability due to improper neutralization of input in the policy audit logs name fields. Affects FortiNAC versions 7.2.0, 9.1.0–9.1.10, 9.2.0–9.2.8, and 9.4.0–9.4.2. The issue can let an attacker execute unauthorized code or command...

CVE-2023-26206

An improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9.1.0 - 9.1.10 and 7.2.0 allows an attacker to execute unauthorized code or commands via the name fields observed in the policy audit logs...

Fortinet FortiNAC 跨站脚本漏洞

Fortinet FortiNAC is a set of network access control solutions from the U.S. company Fita Fortinet. The product is mainly used for network access control and IoT security. Fortinet FortiNAC has a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of...

PT-2024-1744 · Fortinet · Fortinac

Name of the Vulnerable Software and Affected Versions: Fortinet FortiNAC versions 7.2.0 Fortinet FortiNAC versions 9.1.0 through 9.1.10 Fortinet FortiNAC versions 9.2.0 through 9.2.8 Fortinet FortiNAC versions 9.4.0 through 9.4.2 Description: The issue is related to an improper neutralization of...

The vulnerability of the access control devices in Fortinet’s FortiNAC and FortiNAC-F systems arises from the lack of protective measures for the website structure. This allows attackers to execute arbitrary code.

The vulnerability of the access control devices in Fortinet’s FortiNAC and FortiNAC-F systems exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the Fortinet FortiNAC network access control mechanism, related to deficiencies in access control, allows a intruder to perform unauthorized calls via JSP.

The vulnerability of the Fortinet FortiNAC network access control mechanism is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to perform unauthorized calls...

The vulnerability of the network access control device Fortinet FortiNAC, related to deficiencies in the deserialization mechanism, allows a perpetrator to execute arbitrary code or perform arbitrary commands.

The vulnerability of the Fortinet FortiNAC network access control device is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code or perform arbitrary commands...