CVE-2023-37930

CVE-2023-37930 affects Fortinet FortiOS/FortiProxy/FortiManager products. It involves use of uninitialized resources (CWE-908) and excessive iteration (CWE-834) that can cause memory corruption and potentially allow code or commands execution via specially crafted requests. The issue is addressed...

CVE-2023-37930

Multiple issues including the use of uninitialized ressources CWE-908 and excessive iteration CWE-834 vulnerabilities vulnerability in Fortinet allows a VPN user to corrupt memory potentially leading to code or commands execution via specifically crafted requests...

CVE-2024-32122

A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to information disclosure via modification of LDAP server IP to point to a malicious server...

CVE-2024-32122

A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to information disclosure via modification of LDAP server IP to point to a malicious server...

CVE-2024-32122

CVE-2024-32122 concerns Fortinet FortiOS where passwords are stored in a recoverable format. According to Fortinet PSIRT (FG-IR-24-111) and corroborating sources, an attacker can achieve information disclosure by modifying the LDAP server IP to point to a malicious server. Affected FortiOS versio...

CVE-2024-54024

CVE-2024-54024 affects Fortinet FortiIsolator prior to 2.4.6, due to improper neutralization of special elements in OS commands (OS Command Injection). A privileged attacker with a super-admin profile and CLI access can execute unauthorized code via specially crafted HTTP requests. Affected compo...

CVE-2024-54025

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in Fortinet FortiIsolator CLI before version 2.4.6 allows a privileged attacker to execute unauthorized code or commands via crafted CLI requests...

CVE-2024-54025

Fortinet FortiIsolator CLI prior to version 2.4.6 is affected by an OS Command Injection (CWE-78) vulnerability due to improper neutralization of special elements in commands. This could allow a privileged attacker to execute unauthorized commands via crafted CLI requests (local access). Affected...

CVE-2024-54024

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in Fortinet FortiIsolator before version 2.4.6 allows a privileged attacker with super-admin profile and CLI access to execute unauthorized code via specifically crafted HTTP requests...

CVE-2024-54024

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in Fortinet FortiIsolator before version 2.4.6 allows a privileged attacker with super-admin profile and CLI access to execute unauthorized code via specifically crafted HTTP requests...

CVE-2024-54025

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in Fortinet FortiIsolator CLI before version 2.4.6 allows a privileged attacker to execute unauthorized code or commands via crafted CLI requests...

CVE-2025-22855

An improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 vulnerability in Fortinet FortiClient before 7.4.1 may allow the EMS administrator to send messages containing javascript code...

CVE-2025-22855

Fortinet FortiClient EMS (FortiClient EMS) suffers a Cross-site Scripting (CWE-79) flaw due to improper input neutralization during web page generation. Affected versions include FortiClient EMS before 7.4.1 (per Fortinet/FG-IR-23-344) and FortiClient EMS 7.2.x/7.4.x up to 7.4.3 (per Nessus FG-IR...

CVE-2025-22855

An improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 vulnerability in Fortinet FortiClient before 7.4.1 may allow the EMS administrator to send messages containing javascript code...

CVE-2024-50565: Channel Accessible by Non-Endpoint

A improper restriction of communication channel to intended endpoints vulnerability CWE-923 in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15 and 6.2.0 through 6.2.16, Fortinet FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through...

PT-2025-15431 · Fortinet · Fortiisolator Cli

Name of the Vulnerable Software and Affected Versions: Fortinet FortiIsolator CLI versions prior to 2.4.6 Description: The issue is related to an improper neutralization of special elements used in an OS command, which allows a privileged attacker to execute unauthorized code or commands via...

Fortinet FortiWeb 路径遍历漏洞

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content. A...

Fortinet FortiIsolator 操作系统命令注入漏洞

Fortinet FortiIsolator is a Fortinet application that provides remote security isolation capabilities for browsers. The application adds additional advanced threat protection capabilities to the Fortinet Security Fabric and protects critical business data from sophisticated threats on the Web...

Fortinet FortiOS 安全漏洞

Fortinet FortiOS is a set of security operating systems dedicated to the FortiGate network security platform from the U.S. company Fiat Fortinet. The system provides users with a variety of security features such as firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam. A securit...

PT-2025-15424 · Fortinet · Fortiproxy +1

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 6.4.7 through 6.4.14 Fortinet FortiOS versions 7.0.1 through 7.0.11 Fortinet FortiOS version 7.4.0 Fortinet FortiProxy versions 7.0.0 through 7.0.12 Fortinet FortiProxy versions 7.2.0 through 7.2.6 Description: The...