PT-2025-15476 · Fortinet · Fortiswitch

Name of the Vulnerable Software and Affected Versions: FortiSwitch versions 6.4.0 through 7.6.0 Description: A critical vulnerability in the FortiSwitch GUI allows remote, unauthenticated attackers to change admin passwords via a specially crafted request. This issue may give attackers control ov...

Fortinet Fortigate No certificate name verification for fgfm connection (FG-IR-24-046)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the FG-IR-24-046 advisory. - A improper restriction of communication channel to intended endpoints vulnerability CWE-923 in Fortinet FortiOS...

Fortinet FortiWeb No certificate name verification for fgfm connection (FG-IR-24-046)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the FG-IR-24-046 advisory. - A improper restriction of communication channel to intended endpoints vulnerability CWE-923 in Fortinet FortiOS...

Fortinet FortiWeb Incorrect user management in widgets dashboard (FG-IR-24-184)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-184 advisory. - An Incorrect User Management vulnerability CWE-286 in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version...

Fortinet Fortigate LDAP Clear-text credentials retrievable with IP modification (FG-IR-24-111)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-111 advisory. - A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0...

Fortinet多款产品 安全漏洞

Fortinet FortiOS and others are products of Fortinet, Inc. Fortinet FortiOS is a dedicated security operating system on the FortiGate network security platform.Fortinet FortiWeb is a Web application layer firewall.Fortinet Fortinet FortiManager is a centralized network security management platfor...

PT-2025-15428 · Fortinet · Fortimanager +5

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 6.2.0 through 6.2.16 Fortinet FortiOS versions 6.4.0 through 6.4.15 Fortinet FortiOS versions 7.0.0 through 7.0.14 Fortinet FortiOS versions 7.2.0 through 7.2.7 Fortinet FortiOS versions 7.4.0 through 7.4.3 Fortinet...

CVE-2023-37930: Use of Uninitialized Resource

Multiple issues including the use of uninitialized ressources CWE-908 and excessive iteration CWE-834 vulnerabilities vulnerability in Fortinet allows a VPN user to corrupt memory potentially leading to code or commands execution via specifically crafted requests...

Fortinet FortiAnalyzer 安全漏洞

Fortinet FortiAnalyzer is a set of centralized network security reporting solutions from the U.S. company Fiat Fortinet. The product is mainly used to collect network log data, and through the reporting suite of security events in the log, network traffic, Web content, etc. to analyze, report,...

CVE-2024-54025: Improper Neutralization of Special Elements used in an OS Command

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in Fortinet FortiIsolator CLI before version 2.4.6 allows a privileged attacker to execute unauthorized code or commands via crafted CLI requests...

Fortinet FortiClient 跨站脚本漏洞

Fortinet FortiClient is a mobile endpoint security solution from Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance and two-factor authentication when connected to a FortiGate firewall appliance. Fortinet FortiClient suffers from a cross-site scripting...

PT-2025-15426

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 7.2.0 through 7.2.1 Description: The issue allows an attacker to disclose information by modifying the LDAP server IP to point to a malicious server, due to passwords being stored in a recoverable format...

Fortinet FortiWeb Directory Traversal (FG-IR-24-474)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-474 advisory. - An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability CWE-22 in FortiWeb version 7.6...

Fortinet FortiWeb cgi_xmlprotection_xmlschemafile_post Directory Traversal Arbitrary File Write Vulnerability

This vulnerability allows remote attackers to create arbitrary XML schema files on affected installations of Fortinet FortiWeb. Authentication is required to exploit this vulnerability. The specific flaw exists within the cgixmlprotectionxmlschemafilepost function. The issue results from the lack...

The vulnerability of the Fortinet FortiNDR (Network Detection and Response) software, a hardware-based information protection solution utilizing AI and deep neural networks, relates to the. This vulnerability allows attackers to execute CSRF attacks.

The vulnerability of the Fortinet FortiNDR Network Detection and Response software, which is based on AI and deep neural networks, relates to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute a CSRF attack using specially crafted HTTP GET...

CVE-2023-40714

A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege via uploading certain GUI elements...

The vulnerability of the Command Line Interface (CLI) of the Fortinet FortiClient security device allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Command Line Interface CLI of the Fortinet FortiClient security device is related to the storage of critical information in an open manner. Exploiting this vulnerability can allow an attacker to gain unauthorized access to the protected information...

CVE-2023-33302

A buffer copy without checking size of input 'classic buffer overflow' in Fortinet FortiMail webmail and administrative interface version 6.4.0 through 6.4.4 and before 6.2.6 and FortiNDR administrative interface version 7.2.0 and before 7.1.0 allows an authenticated attacker with regular webmail...

CVE-2023-40714

A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege via uploading certain GUI elements...

CVE-2023-40714

A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to escalate privilege via uploading certain GUI elements...