CVE-2023-34992

CVE-2023-34992 affects Fortinet FortiSIEM (report server) with an OS command injection via crafted API requests. Root cause: improper neutralization of special elements in OS command handling (CWE-78). Impact: remote unauthenticated attacker can execute arbitrary commands, potentially as root, on...

CVE-2022-22298

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiIsolator version 1.0.0, FortiIsolator version 1.1.0, FortiIsolator version 1.2.0 through 1.2.2, FortiIsolator version 2.0.0 through 2.0.1, FortiIsolator version 2.1.0 through 2.1.2,...

CVE-2022-22298

Fortinet CVE-2022-22298 describes OS command injection in FortiIsolator. Affected versions include 1.0.0, 1.1.0, 1.2.0–1.2.2, 2.0.0–2.0.1, 2.1.0–2.1.2, 2.2.0, and 2.3.0–2.3.4. The root cause is improper neutralization of special elements in input parameters, allowing an attacker to execute arbitr...

CVE-2022-22298

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiIsolator version 1.0.0, FortiIsolator version 1.1.0, FortiIsolator version 1.2.0 through 1.2.2, FortiIsolator version 2.0.0 through 2.0.1, FortiIsolator version 2.1.0 through 2.1.2,...

CVE-2023-25604

The CVE-2023-25604 issue affects Fortinet FortiGuest 1.0.0, where sensitive information is inserted into log files, allowing a local attacker to read plaintext passwords from RADIUS logs. The root cause is cited as insufficient protection of registration data. Exploitation status is not described...

CVE-2023-25604

An insertion of sensitive information into log file vulnerability in Fortinet FortiGuest 1.0.0 allows a local attacker to access plaintext passwords in the RADIUS logs...

CVE-2023-25604

An insertion of sensitive information into log file vulnerability in Fortinet FortiGuest 1.0.0 allows a local attacker to access plaintext passwords in the RADIUS logs...

CVE-2023-41841

An improper authorization vulnerability in Fortinet FortiOS 7.0.0 - 7.0.11 and 7.2.0 - 7.2.4 allows an attacker belonging to the prof-admin profile to perform elevated actions...

CVE-2023-41841

CVE-2023-41841 affects Fortinet FortiOS WEB UI in FortiOS 7.0.0–7.0.11 and 7.2.0–7.2.4, where an attacker with prof-admin privileges can perform elevated actions due to improper authorization. The NVD entry lists a CVSSv3.1 base score of 8.8 (HIGH) with NETWORK attack vector and LOW privileges re...

CVE-2023-41841

An improper authorization vulnerability in Fortinet FortiOS 7.0.0 - 7.0.11 and 7.2.0 - 7.2.4 allows an attacker belonging to the prof-admin profile to perform elevated actions...

CVE-2023-40718

A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packets...

CVE-2023-40718

CVE-2023-40718 concerns an interpretation/conflict in Fortinet FortiOS IPS Engine affecting Fortinet IPS Engine versions 6.158, 7.166, and 7.321, enabling evasion of IPS features via crafted TCP packets. The connected sources confirm the affected components and root cause, with Fortinet advisorie...

CVE-2023-40718

A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packets...

CVE-2023-42787

Fortinet FortiManager (versions 7.4.0 and before 7.2.3) and FortiAnalyzer (versions 7.4.0 and before 7.2.3) are affected by a client-side enforcement of server-side security vulnerability (CWE-602) that could allow a remote attacker with low privileges to access a privileged web console via clien...

CVE-2023-44249

The CVE affects Fortinet FortiManager (versions 7.4.0 and earlier 7.2.3) and FortiAnalyzer (versions 7.4.0 and earlier 7.2.3). Root cause: an authorization bypass via user-controlled key enables a remote attacker with low privileges to read sensitive information through crafted HTTP requests. Mit...

CVE-2023-44249

An authorization bypass through user-controlled key CWE-639 vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 allows a remote attacker with low privileges to read sensitive information via crafted HTTP requests...

CVE-2023-36555

An improper neutralization of script-related html tags in a web page basic xss in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components...

CVE-2023-36555

CVE-2023-36555 is an XSS vulnerability in Fortinet FortiOS 7.2.0–7.2.4 where improper neutralization of script-related HTML tags in the FortiSAML/Security Fabric context can allow a remote attacker to run unauthorized code via crafted requests. The CVE entry is corroborated by multiple sources (N...

CVE-2023-36555

An improper neutralization of script-related html tags in a web page basic xss in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components...

CVE-2023-33301

Fortinet FortiOS contains an improper access control vulnerability in the REST API (CWE-284) that can let an attacker access a restricted resource from a non-trusted host. Affected products/versions per the CVE entry and advisory: FortiOS 7.2.0–7.2.4 and 7.4.0. Mitigation: upgrade to FortiOS 7.4....