CVE-2024-26011

A missing authentication for critical function in Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14, FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0....

CVE-2024-33505

A heap-based buffer overflow in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14 allows attacker to escalation of privilege...

CVE-2024-33505

CVE-2024-33505 affects Fortinet FortiAnalyzer and FortiManager. The issue is a heap-based buffer overflow in the CLI that can allow a remote attacker to escalate privileges through specially crafted HTTP requests. Affected ranges include FortiAnalyzer: 6.4.0–6.4.14, 7.0.0–7.0.12, 7.2.0–7.2.5, 7.4...

CVE-2024-33505

A heap-based buffer overflow in Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14 allows attacker to escalation of privilege...

CVE-2024-35274

An improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability CWE-22 in Fortinet FortiAnalyzer versions below 7.4.2, Fortinet FortiManager versions below 7.4.2 and Fortinet FortiAnalyzer-BigData version 7.4.0 and below 7.2.7 allows a privileged attacker with read...

CVE-2024-32118

CVE-2024-32118 affects Fortinet FortiManager (7.4.0–7.4.2 and before 7.2.5), FortiAnalyzer (7.4.0–7.4.2 and before 7.2.5), and FortiAnalyzer-BigData before 7.4.0. The issue is an OS command injection due to improper neutralization of special elements in crafted CLI requests, allowing an authentic...

CVE-2024-26011

A missing authentication for critical function in Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14, FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0....

CVE-2024-35274

CVE-2024-35274 describes a Path Traversal vulnerability affecting Fortinet FortiAnalyzer (versions below 7.4.2), FortiManager (below 7.4.2), and FortiAnalyzer-BigData (below 7.2.7 and 7.4.0). The underlying issue is an improper limitation of a pathname to a restricted directory, allowing a privil...

CVE-2024-32118

Multiple improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerabilities CWE-78 in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, Fortinet FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5 and Fortinet FortiAnalyzer-BigData...

CVE-2024-35274

An improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability CWE-22 in Fortinet FortiAnalyzer versions below 7.4.2, Fortinet FortiManager versions below 7.4.2 and Fortinet FortiAnalyzer-BigData version 7.4.0 and below 7.2.7 allows a privileged attacker with read...

CVE-2024-32118

Multiple improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerabilities CWE-78 in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, Fortinet FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5 and Fortinet FortiAnalyzer-BigData...

CVE-2024-32116

Multiple relative path traversal vulnerabilities CWE-23 in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5 and FortiAnalyzer-BigData version 7.4.0 and before 7.2.7 allows a privileged attacker to delete files from the...

CVE-2024-32116

Multiple relative path traversal vulnerabilities CWE-23 in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5, FortiAnalyzer version 7.4.0 through 7.4.2 and before 7.2.5 and FortiAnalyzer-BigData version 7.4.0 and before 7.2.7 allows a privileged attacker to delete files from the...

CVE-2024-32116

Fortinet FortiManager/FortiAnalyzer vulnerability CVE-2024-32116 involves multiple relative path traversal flaws that allow a privileged attacker to delete files on the underlying filesystem via crafted CLI requests. Affected products and versions: FortiManager 7.4.0–7.4.2 and prior to 7.2.5; For...

CVE-2023-44255

Fortinet CVE-2023-44255 affects FortiManager (before 7.4.2), FortiAnalyzer (before 7.4.2), and FortiAnalyzer-BigData (before 7.2.5). The root cause is insufficient access control, allowing a privileged attacker with administrative read permissions to read event logs of another ADOM via crafted HT...

CVE-2023-44255

An exposure of sensitive information to an unauthorized actor CWE-200 in Fortinet FortiManager before 7.4.2, FortiAnalyzer before 7.4.2 and FortiAnalyzer-BigData before 7.2.5 may allow a privileged attacker with administrative read permissions to read event logs of another adom via crafted HTTP o...

CVE-2023-44255

An exposure of sensitive information to an unauthorized actor CWE-200 in Fortinet FortiManager before 7.4.2, FortiAnalyzer before 7.4.2 and FortiAnalyzer-BigData before 7.2.5 may allow a privileged attacker with administrative read permissions to read event logs of another adom via crafted HTTP o...

CVE-2023-47543

An authorization bypass through user-controlled key vulnerability CWE-639 in Fortinet FortiPortal version 7.0.0 through 7.0.3 allows an authenticated attacker to interact with ressources of other organizations via HTTP or HTTPS requests...

CVE-2023-47543

CVE-2023-47543 affects Fortinet FortiPortal versions 7.0.0 through 7.0.3, due to an authorization bypass via a user-controlled key vulnerability (CWE-639). An authenticated attacker could interact with resources of other organizations by sending HTTP/HTTPS requests. The connected PT-security entr...

CVE-2024-32117

The CVE-2024-32117 entry describes a path traversal (CWE-22) vulnerability in Fortinet products impacting file access. Affected are: FortiManager 7.4.0–7.4.2 and below 7.2.5, FortiAnalyzer 7.4.0–7.4.2 and below 7.2.5, and FortiAnalyzer-BigData 7.4.0 and below 7.2.7 . The issue allows a privileged...