CVE-2022-27487

The CVE-2022-27487 entry concerns Fortinet FortiSandbox and FortiDeceptor products with an improper privilege management flaw that allows a remote authenticated attacker to perform unauthorized API calls via crafted HTTP/HTTPS requests. Affected: FortiSandbox versions 4.2.0–4.2.2, 4.0.0–4.0.2, an...

CVE-2022-27487

A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0.0 through 4.0.2 and before 3.3.3 allows a remote authenticated attacker to perform unauthorized API calls via crafted HTTP or HTTPS...

CVE-2022-43946

Fortinet FortiClientWindows prior to version 7.0.7 contains a combination of a critical resource permission assignment error (CWE-732) and a TOCTOU race condition (CWE-367). These flaws can allow an attacker on the same file sharing network to remotely execute commands by writing data into a Wind...

CVE-2022-43946

Multiple vulnerabilities including an incorrect permission assignment for critical resource CWE-732 vulnerability and a time-of-check time-of-use TOCTOU race condition CWE-367 vulnerability in Fortinet FortiClientWindows before 7.0.7 allows attackers on the same file sharing network to execute...

CVE-2022-43946

Multiple vulnerabilities including an incorrect permission assignment for critical resource CWE-732 vulnerability and a time-of-check time-of-use TOCTOU race condition CWE-367 vulnerability in Fortinet FortiClientWindows before 7.0.7 allows attackers on the same file sharing network to execute...

CVE-2023-22641

CVE-2023-22641 is an Open Redirect vulnerability in Fortinet FortiOS and FortiProxy. Affected products and versions include FortiOS 7.2.0–7.2.3, 7.0.0–7.0.9, 6.4.0–6.4.12, 6.2.x, 6.0.x, and FortiProxy 7.2.0–7.2.2, 7.0.0–7.0.8, and all 2.0/1.2/1.1/1.0 series. The issue enables an authenticated att...

CVE-2023-22641

A url redirection to untrusted site 'open redirect' in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, FortiOS versions 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.2, FortiProxy version 7.0.0...

CVE-2023-22641

A url redirection to untrusted site 'open redirect' in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, FortiOS versions 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.2, FortiProxy version 7.0.0...

CVE-2022-43948

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 7.0.0 through 7.0.3, FortiADC version 7.1.0 through 7.1.1, FortiADC version 7.0.0 through 7.0.3, FortiADC 6.2 all versions, FortiADC 6.1 all versions, FortiADC 6.0 all versions,...

CVE-2022-43948

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 7.0.0 through 7.0.3, FortiADC version 7.1.0 through 7.1.1, FortiADC version 7.0.0 through 7.0.3, FortiADC 6.2 all versions, FortiADC 6.1 all versions, FortiADC 6.0 all versions,...

CVE-2022-43948

Summary of CVE-2022-43948 details : An OS command injection vulnerability (improper neutralization of special elements used in an os command) affects Fortinet FortiWeb and FortiADC. Affected versions include FortiWeb 7.0.0–7.0.3 and FortiADC 7.0.0–7.0.3, 7.1.0–7.1.1, plus FortiADC 6.0–6.2 and 5.1...

CVE-2022-42470

CVE-2022-42470 describes a local path-traversal vulnerability in Fortinet FortiClient for Windows. Exploitation path: a crafted request to a specific named pipe can allow an attacker with low privileges and no user interaction to execute arbitrary code or commands on the affected host. Affected s...

CVE-2022-42470

A relative path traversal vulnerability in Fortinet FortiClient Windows 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to execute unauthorized code or commands via sending a crafted request to a specific named pipe...

CVE-2022-40682

A incorrect authorization in Fortinet FortiClient Windows 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to execute unauthorized code or commands via sending a crafted request to a specific named pipe...

CVE-2022-40682

A incorrect authorization in Fortinet FortiClient Windows 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to execute unauthorized code or commands via sending a crafted request to a specific named pipe...

CVE-2022-40682

CVE-2022-40682 corresponds to Fortinet FortiClient for Windows with an incorrect authorization vulnerability that affects multiple versions (6.0.0–6.0.10, 6.2.0–6.2.9, 6.4.0–6.4.9, 7.0.0–7.0.7). The issue can allow a local attacker to execute unauthorized code via a crafted request to a specific ...

CVE-2023-27995

Fortinet FortiSOAR is affected by CVE-2023-27995 due to improper neutralization of special elements used in a template engine. The vulnerability exists in FortiSOAR versions 7.3.0 through 7.3.1 and allows an authenticated, remote attacker to execute arbitrary code via a crafted payload in the tem...

CVE-2023-27995

A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiSOAR 7.3.0 through 7.3.1 allows an authenticated, remote attacker to execute arbitrary code via a crafted payload...

CVE-2023-27995

A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiSOAR 7.3.0 through 7.3.1 allows an authenticated, remote attacker to execute arbitrary code via a crafted payload...

CVE-2022-41330

An improper neutralization of input during web page generation vulnerability 'Cross-site Scripting' CWE-79 in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9, version 6.4.0 through 6.4.11 and before 6.2.12 and FortiProxy version 7.2.0 through 7.2.1 and before 7.0.7 allow...