CVE-2022-27487

A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0.0 through 4.0.2 and before 3.3.3 allows a remote authenticated attacker to perform unauthorized API calls via crafted HTTP or HTTPS...

CVE-2022-27487

The CVE-2022-27487 entry concerns Fortinet FortiSandbox and FortiDeceptor products with an improper privilege management flaw that allows a remote authenticated attacker to perform unauthorized API calls via crafted HTTP/HTTPS requests. Affected: FortiSandbox versions 4.2.0–4.2.2, 4.0.0–4.0.2, an...

CVE-2022-27487

A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0.0 through 4.0.2 and before 3.3.3 allows a remote authenticated attacker to perform unauthorized API calls via crafted HTTP or HTTPS...

PT-2023-9683 · Fortinet · Fortisandbox +1

Name of the Vulnerable Software and Affected Versions: FortiSandbox versions 4.2.0 through 4.2.2 FortiSandbox versions 4.0.0 through 4.0.2 FortiSandbox versions prior to 3.2.3 FortiDeceptor version 4.1.0 FortiDeceptor versions 4.0.0 through 4.0.2 FortiDeceptor versions prior to 3.3.3 Description:...

FortiSandbox - SQL injection in certificate downloading feature

An improper neutralization of special elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 in FortiSandbox may allow a remote and authenticated attacker with read permission to retrieve arbitrary files from the underlying Linux system via a crafted HTTP request...

Fortinet FortiSandbox 安全漏洞

Fortinet FortiSandbox is an APT Advanced Persistent Threat protection appliance from Fortinet. The appliance offers dual sandbox technology, dynamic threat intelligence system, real-time control panel and reporting. Fortinet FortiSandbox and FortiDeceptor have a security vulnerability that stems...

PT-2023-12903 · Fortinet · Fortisandbox

Name of the Vulnerable Software and Affected Versions: Fortinet FortiSandbox versions 3.0.x through 4.2.0 Description: The issue allows a remote and authenticated attacker with read permission to retrieve arbitrary files from the underlying Linux system via a crafted HTTP request. This is due to ...

Fortinet FortiSandbox SQL注入漏洞

Fortinet FortiSandbox is an APT Advanced Persistent Threat protection appliance from Fortinet. The appliance offers dual sandboxing technology, dynamic threat intelligence system, real-time control panel and reporting. Fortinet FortiSandbox has a security vulnerability that stems from the presenc...

FortiSandbox / FortiDeceptor - Improper profile-based access control over APIs

An improper privilege management vulnerability CWE-269 in FortiSandbox & FortiDeceptor may allow a remote authenticated attacker to perform unauthorized API calls via crafted HTTP or HTTPS requests...

CVE-2022-26115

A use of password hash with insufficient computational effort vulnerability CWE-916 in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords...

CVE-2022-26115

A use of password hash with insufficient computational effort vulnerability CWE-916 in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords...

Design/Logic Flaw

A use of password hash with insufficient computational effort vulnerability CWE-916 in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords...

CVE-2022-26115

A use of password hash with insufficient computational effort vulnerability CWE-916 in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords...

CVE-2022-26115

Fortinet FortiSandbox is affected by CVE-2022-26115 due to a use of a password hash with insufficient computational effort (CWE-916) prior to version 4.2.0. An attacker with access to the password database could mount bulk guessing attacks to recover passwords. Connected sources confirm the issue...

CVE-2022-26115

A use of password hash with insufficient computational effort vulnerability CWE-916 in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords...

Improper password storage mechanism

...

Fortinet FortiSandbox 安全漏洞

Fortinet FortiSandbox is an APT Advanced Persistent Threat protection appliance from Fortinet. The appliance offers dual sandboxing technology, dynamic threat intelligence system, real-time control panel and reporting. A security vulnerability exists in Fortinet FortiSandbox versions prior to...

The vulnerability of the FortiSandbox threat detection and removal system, as well as the FortiAuthenticator identification system, is related to an uncontrolled resource consumption, allowing attackers to trigger a service failure.

The vulnerability of the FortiSandbox threat detection and removal system, as well as the FortiAuthenticator identification system, is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to trigger service interruptions...

The vulnerability of the FortiSandbox threat detection and mitigation system lies in its improper restriction on the path to the restricted access catalog. This allows a violator to gain unauthorized access to protected information.

The vulnerability of the FortiSandbox threat detection and mitigation system is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2022-30305

An insufficient logging CWE-778 vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor versions 4.2.0, 4.1.0 through 4.1.1, 4.0.0 through 4.0.2, 3.3.0 through 3.3.3, 3.2.0 through 3.2.2,3.1.0 through 3.1.1 and 3.0.0 through 3.0.2 may allow a...