CVE-2024-40591

CVE-2024-40591 is a privilege-escalation flaw in Fortinet FortiOS. Affected are FortiOS 7.6.0; 7.4.0–7.4.4; 7.2.0–7.2.9; and versions before 7.0.15. The issue arises from incorrect privilege assignment, allowing an authenticated admin with the Security Fabric permission to escalate to super-admin...

CVE-2024-40591

An incorrect privilege assignment vulnerability CWE-266 in Fortinet FortiOS version 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.9 and before 7.0.15 allows an authenticated admin whose access profile has the Security Fabric permission to escalate their privileges to super-admin by connecting the...

CVE-2024-52966

An exposure of sensitive information to an unauthorized actor in Fortinet FortiAnalyzer 6.4.0 through 7.6.0 allows attacker to cause information disclosure via filter manipulation...

CVE-2024-52966

CVE-2024-52966 affects Fortinet FortiAnalyzer versions 6.4.0 through 7.6.0. The underlying issue is an information-disclosure via filter manipulation in the Log View component, allowing an unauthorized actor to read event logs from another domain. Impact is information disclosure; no exploitation...

CVE-2024-52966

An exposure of sensitive information to an unauthorized actor in Fortinet FortiAnalyzer 6.4.0 through 7.6.0 allows attacker to cause information disclosure via filter manipulation...

CVE-2024-50569

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb 7.0.0 through 7.6.0 allows attacker to execute unauthorized code or commands via crafted input...

CVE-2024-52968

Summary of CVE-2024-52968 (Fortinet FortiClientMac) : Fortinet FortiClientMac versions 7.0.11 through 7.2.4 suffer from an improper authentication vulnerability that allows an attacker to gain improper (unauthorized) access to macOS via an empty password. This is a local impact with high confiden...

CVE-2024-52968

An improper authentication in Fortinet FortiClientMac 7.0.11 through 7.2.4 allows attacker to gain improper access to MacOS via empty password...

CVE-2024-50569

CVE-2024-50569 concerns Fortinet FortiWeb OS command injection in FortiWeb 7.0.0–7.6.0 due to improper neutralization of special elements in OS commands. The vulnerability enables an attacker to run arbitrary code via crafted input. Connected sources corroborate affected versions (7.0.0–7.6.0) an...

CVE-2024-52968

An improper authentication in Fortinet FortiClientMac 7.0.11 through 7.2.4 allows attacker to gain improper access to MacOS via empty password...

CVE-2024-50569

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb 7.0.0 through 7.6.0 allows attacker to execute unauthorized code or commands via crafted input...

PT-2025-6255 · Fortinet · Fortisandbox

Name of the Vulnerable Software and Affected Versions: Fortinet FortiSandbox versions 3.0.0 through 3.0.7 Fortinet FortiSandbox versions 3.1.0 through 3.1.5 Fortinet FortiSandbox versions 3.2.0 through 3.2.4 Fortinet FortiSandbox versions 4.0.0 through 4.0.4 Fortinet FortiSandbox versions 4.2.0...

PT-2025-6265 · Fortinet · Forticlientmac

Name of the Vulnerable Software and Affected Versions: Fortinet FortiClientMac versions 7.0.11 through 7.2.4 Description: The issue is related to improper authentication, allowing an attacker to gain unauthorized access to MacOS via an empty password. This is due to deficiencies in the...

CVE-2023-40721: Use of Externally-Controlled Format String

A use of externally-controlled format string vulnerability CWE-134 vulnerability in Fortinet allows a privileged attacker to execute arbitrary code or commands via specially crafted requests...

CVE-2024-36508: Improper Limitation of a Pathname to a Restricted Directory

An improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability CWE-22 in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 and Fortinet FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5 CLI allows an authenticated admin user with diagnose...

Fortinet FortiClient (FG-IR-23-279)

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-279 advisory. - An Improper Access Control vulnerability CWE-284 in FortiClient Windows version 7.4.0, version 7.2.6 and below, version...

Fortinet FortiOS 安全漏洞

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. Fortinet FortiOS suffers from a...

Fortinet FortiClient 授权问题漏洞

Fortinet FortiClientMac is a mobile endpoint security solution from Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance and two-factor authentication when connected to a FortiGate firewall appliance. Fortinet FortiClientMac suffers from an authorization...

Fortinet FortiWeb 操作系统命令注入漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure web applications and protect sensitive database content. Fortinet FortiWeb suffers from an operating...

Fortinet Fortigate - Format string vulnerability in CLI commands (FG-IR-23-261)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-261 advisory. - A use of externally-controlled format string vulnerability CWE-134 in Fortinet FortiOS version 7.4.0 through 7.4.1 and befo...