CVE-2021-42760

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose sensitive information from DB tables via crafted requests...

CVE-2021-42760

CVE-2021-42760 affects Fortinet FortiWLM up to version 8.6.1, where an improper neutralization of special elements in an SQL command allows an attacker to disclose sensitive information from database tables. The vulnerability is triggered by crafted HTTP requests sent to FortiWLM’s alarms and dev...

CVE-2021-42760

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose sensitive information from DB tables via crafted requests...

CVE-2021-41029

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiWLM version 8.6.1 and below allows attacker to store malicious javascript code in the device and trigger it via crafted HTTP requests...

CVE-2021-41029

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiWLM version 8.6.1 and below allows attacker to store malicious javascript code in the device and trigger it via crafted HTTP requests...

CVE-2021-41029

Fortinet FortiWLM 8.6.1 and earlier versions are affected by a stored cross-site scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. An authenticated attacker can store malicious JavaScript on the device and trigger it via crafted HTTP requests or ...

CVE-2021-43067

A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.2 and below, version 6.2.1 and below, version 6.1.2 and below, version 6.0.7 to 6.0.1 allows attacker to duplicate a target LDAP user 2 factors authentication token via crafted...

CVE-2021-43067

A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.2 and below, version 6.2.1 and below, version 6.1.2 and below, version 6.0.7 to 6.0.1 allows attacker to duplicate a target LDAP user 2 factors authentication token via crafted...

CVE-2021-43067

Fortinet FortiAuthenticator has a information disclosure vulnerability (CVE-2021-43067) affecting version 6.4.0 and older branches (6.3.2 and below, 6.2.1 and below, 6.1.2 and below, 6.0.7 to 6.0.1). The issue allows an attacker to duplicate a target LDAP user’s two‑factor authentication token vi...

Fortinet FortiProxy SSL VPN 数据伪造问题漏洞

Fortinet FortiProxy SSL VPN is an application from Fortinet, Inc. provides an intrusion detection feature.Fortinet FortiProxy SSL VPN suffers from a cross-site request forgery vulnerability that can be exploited by unauthenticated attackers to conduct cross-site request forgery CSRF attacks...

PT-2021-21169

Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 6.4.1 and below Fortinet FortiWeb versions 6.3.15 and below Description The issue is related to improper neutralization of input during web page generation, also known as cross-site scripting. This allows an attacker...

Fortinet FortiWLM SQL注入漏洞

Fortinet FortiWLM is a wireless manager from Fortinet, Inc. An SQL injection vulnerability exists in Fortinet FortiWLM versions 8.6.1 and below, which can be exploited by attackers to contaminate database data and extract sensitive information via crafted HTTP requests to be sent to alarms and...

CVE-2021-41027: Out-of-bounds Write

A stack-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, allows an authenticated attacker to execute unauthorized code or commands via crafted certificates loaded into the device...

Fortinet FortiNAC 安全漏洞

Fortinet FortiNAC is a set of network access control solutions from the U.S. company Fita Fortinet. The product is mainly used for network access control and IoT security. There is a security vulnerability in FortiNAC that can be exploited by an authenticated attacker to access sensitive system...

Fortinet FortiWeb 安全漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. Versions 6.4.1 and earlier and 6.3.15 and...

CVE-2021-36190: Undefined Security Weakness

A unintended proxy or intermediary 'confused deputy' in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to access protected hosts via crafted HTTP requests...

CVE-2021-42760: Improper Neutralization of Special Elements used in an SQL Command

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose sensitive information from DB tables via crafted requests...

Fortinet FortiWLM 跨站脚本漏洞

Fortinet FortiWLM is a wireless manager from Fortinet, Inc. A cross-site scripting vulnerability exists in Fortinet FortiWLM versions 8.6.1 and below that could allow an authenticated attacker to execute a stored cross-site scripting attack XSS by storing a malicious load...

Fortinet FortiWLM 跨站脚本漏洞

Fortinet FortiWLM is a wireless manager from Fortinet, Inc. A cross-site scripting vulnerability exists in Fortinet FortiWLM, which can be exploited by attackers to execute malicious javascript code on the victim's host via a crafted HTTP request...

Fortinet FortiOS 路径遍历漏洞

Fortinet FortiOS is a security operating system dedicated to the FortiGate network security platform from Fortinet, a US-based company. The system provides users with a variety of security features such as firewall, anti-virus, IPSec/SSLVPN, Web content filtering and anti-spam, etc. A path...