CVE-2023-26211

An improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiSOAR 7.3.0 through 7.3.2 allows an authenticated, remote attacker to inject arbitrary web script or HTML via the Communications module...

CVE-2023-26211

An improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiSOAR 7.3.0 through 7.3.2 allows an authenticated, remote attacker to inject arbitrary web script or HTML via the Communications module...

CVE-2023-26211

An improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiSOAR 7.3.0 through 7.3.2 allows an authenticated, remote attacker to inject arbitrary web script or HTML via the Communications module...

CVE-2023-26211

CVE-2023-26211 : Fortinet FortiSOAR versions 7.3.0–7.3.2 are affected by a cross-site scripting vulnerability caused by improper neutralization of input during web page generation in the Communications module. An authenticated, remote attacker can inject arbitrary web script/HTML via this module....

The vulnerability of the software for coordinating the operation of security systems and for managing incident responses in real-time with Fortinet FortiSOAR lies in the lack of protection for the SQL query structure, allowing attackers to execute arbitrary code.

The vulnerability of the software for coordinating the operation of security systems and for managing incident responses in real-time with Fortinet FortiSOAR is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to...

Fortinet FortiSOAR SQL Injection Vulnerability

Fortinet FortiSOAR is a Security Orchestration, Automation and Response SOAR solution from Fortinet. A SQL injection vulnerability exists in Fortinet FortiSOAR versions prior to 7.2.0 and 7.0.3, which stems from an improper neutralization of special elements used in SQL commands, and can be...

CVE-2023-23775

Multiple improper neutralization of special elements used in SQL commands 'SQL Injection' vulnerabilities CWE-89 in FortiSOAR 7.2.0 and before 7.0.3 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters...

CVE-2023-23775

Multiple improper neutralization of special elements used in SQL commands 'SQL Injection' vulnerabilities CWE-89 in FortiSOAR 7.2.0 and before 7.0.3 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters...

CVE-2023-23775

FortiSOAR SQL injection (CVE-2023-23775) affects FortiSOAR 7.2.0 and earlier 7.0.3 due to improper neutralization of special elements in SQL commands. An authenticated attacker can potentially execute unauthorized code or commands via specially crafted string parameters, with risk described as hi...

CVE-2023-23775

Multiple improper neutralization of special elements used in SQL commands 'SQL Injection' vulnerabilities CWE-89 in FortiSOAR 7.2.0 and before 7.0.3 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters...

Fortinet FortiSOAR SQL注入漏洞

Fortinet FortiSOAR is a Security Orchestration, Automation and Response SOAR solution from Fortinet. A SQL injection vulnerability exists in Fortinet FortiSOAR versions prior to 7.2.0 and 7.0.3, which stems from an improper neutralization of special elements used in SQL commands, and can be...

PT-2024-4149 · Fortinet · Fortisoar

Name of the Vulnerable Software and Affected Versions: FortiSOAR versions 7.2.0 through 7.0.3 Description: The issue is related to improper neutralization of special elements used in SQL commands, which may allow an authenticated attacker to execute unauthorized code or commands via specifically...

CVE-2024-31493

An improper removal of sensitive information before storage or transfer vulnerability CWE-212 in FortiSOAR version 7.3.0, version 7.2.2 and below, version 7.0.3 and below may allow an authenticated low privileged user to read Connector passwords in plain-text via HTTP responses...

CVE-2024-31493

An improper removal of sensitive information before storage or transfer vulnerability CWE-212 in FortiSOAR version 7.3.0, version 7.2.2 and below, version 7.0.3 and below may allow an authenticated low privileged user to read Connector passwords in plain-text via HTTP responses...

CVE-2024-31493

An improper removal of sensitive information before storage or transfer vulnerability CWE-212 in FortiSOAR version 7.3.0, version 7.2.2 and below, version 7.0.3 and below may allow an authenticated low privileged user to read Connector passwords in plain-text via HTTP responses...

CVE-2024-31493

An improper removal of sensitive information before storage or transfer vulnerability CWE-212 in FortiSOAR version 7.3.0, version 7.2.2 and below, version 7.0.3 and below may allow an authenticated low privileged user to read Connector passwords in plain-text via HTTP responses...

PT-2024-24119 · Fortinet · Fortisoar

Name of the Vulnerable Software and Affected Versions: FortiSOAR versions 7.0.3 and below FortiSOAR versions 7.2.2 and below FortiSOAR version 7.3.0 Description: The issue allows an authenticated low privileged user to read Connector passwords in plain-text via HTTP responses due to an improper...

The vulnerability of the software interface for coordinating the operation of cybersecurity systems and for managing real-time incident responses in Fortinet FortiSOAR allows a perpetrator to execute arbitrary code.

The vulnerability of the software interface for coordinating the operation of cybersecurity systems and for managing real-time incident responses in Fortinet FortiSOAR is related to errors in eliminating special elements within the template creation mechanism. Exploiting this vulnerability allows...

CVE-2023-27995

A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiSOAR 7.3.0 through 7.3.1 allows an authenticated, remote attacker to execute arbitrary code via a crafted payload...

CVE-2023-27995

A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiSOAR 7.3.0 through 7.3.1 allows an authenticated, remote attacker to execute arbitrary code via a crafted payload...