CVE-2021-32591

A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier may allow an attacker in possession of the password store to compromise the...

CVE-2021-42752

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute malicious javascript code on victim's host via crafted HTTP requests...

CVE-2021-41029

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiWLM version 8.6.1 and below allows attacker to store malicious javascript code in the device and trigger it via crafted HTTP requests...

CVE-2021-42760

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose sensitive information from DB tables via crafted requests...

Authentication flaw

A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.2 and below, version 6.2.1 and below, version 6.1.2 and below, version 6.0.7 to 6.0.1 allows attacker to duplicate a target LDAP user 2 factors authentication token via crafted...

Cross site scripting

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute malicious javascript code on victim's host via crafted HTTP requests...

Cross site scripting

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiWLM version 8.6.1 and below allows attacker to store malicious javascript code in the device and trigger it via crafted HTTP requests...

Sql injection

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose sensitive information from DB tables via crafted requests...

CVE-2021-42752

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute malicious javascript code on victim's host via crafted HTTP requests...

CVE-2021-42752

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute malicious javascript code on victim's host via crafted HTTP requests...

CVE-2021-42752

CVE-2021-42752 concerns an improper neutralization of input during Fortinet FortiWLM web page generation (XSS). Affected product: FortiWLM, version 8.6.1 and earlier. The vulnerability allows an attacker to inject and execute malicious JavaScript in the victim’s browser via crafted HTTP requests,...

CVE-2021-42760

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose sensitive information from DB tables via crafted requests...

CVE-2021-42760

CVE-2021-42760 affects Fortinet FortiWLM up to version 8.6.1, where an improper neutralization of special elements in an SQL command allows an attacker to disclose sensitive information from database tables. The vulnerability is triggered by crafted HTTP requests sent to FortiWLM’s alarms and dev...

CVE-2021-42760

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose sensitive information from DB tables via crafted requests...

CVE-2021-41029

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiWLM version 8.6.1 and below allows attacker to store malicious javascript code in the device and trigger it via crafted HTTP requests...

CVE-2021-41029

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiWLM version 8.6.1 and below allows attacker to store malicious javascript code in the device and trigger it via crafted HTTP requests...

CVE-2021-41029

Fortinet FortiWLM 8.6.1 and earlier versions are affected by a stored cross-site scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. An authenticated attacker can store malicious JavaScript on the device and trigger it via crafted HTTP requests or ...

CVE-2021-43067

Fortinet FortiAuthenticator has a information disclosure vulnerability (CVE-2021-43067) affecting version 6.4.0 and older branches (6.3.2 and below, 6.2.1 and below, 6.1.2 and below, 6.0.7 to 6.0.1). The issue allows an attacker to duplicate a target LDAP user’s two‑factor authentication token vi...

CVE-2021-43067

A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.2 and below, version 6.2.1 and below, version 6.1.2 and below, version 6.0.7 to 6.0.1 allows attacker to duplicate a target LDAP user 2 factors authentication token via crafted...

CVE-2021-43067

A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.2 and below, version 6.2.1 and below, version 6.1.2 and below, version 6.0.7 to 6.0.1 allows attacker to duplicate a target LDAP user 2 factors authentication token via crafted...