FortiWeb - Stack-based Buffer Overflow in command line interpreter

A stack-based buffer overflow CWE-121 in the command line interpreter of FortiWeb may allow an authenticated user to execute unauthorized code or commands via specially crafted command arguments...

FortiWeb - Stack-based buffer overflows in Proxyd

Multiple stack-based buffer overflow vulnerabilities CWE-121 in FortiWeb's proxy daemon may allow an unauthenticated remote attacker to achieve arbitrary code execution via specifically crafted HTTP requests...

FortiWeb - Unauthorized Configuration Download Vulnerability

An unauthorized configuration download vulnerability CWE-285 in FortiWeb may allow a local attacker to access confidential configuration files via a crafted http request...

Fortinet FortiWeb 格式化字符串错误漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A formatted string error vulnerability exist...

PT-2023-1570

Name of the Vulnerable Software and Affected Versions FortiWeb versions 5.x through 6.4 Description The issue is related to multiple stack-based buffer overflow vulnerabilities in the proxy daemon of FortiWeb, which may allow an unauthenticated remote attacker to achieve arbitrary code execution...

PT-2023-1549

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.4 through 6.4, 6.3.16 and below, 6.2, 6.1, 6.0 FortiOS versions 7.0.3 and below, 6.4.8 and below, 6.2, 6.0 FortiSwitch versions 7.0.3 and below, 6.4.10 and below, 6.2, 6.0 FortiProxy versions 7.0.1 and below, 2.0.7 and belo...

PT-2023-1652

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.3.0 through 6.3.19 FortiWeb versions 6.4 FortiWeb versions 7.0.0 through 7.0.1 Description The issue is related to an improper neutralization of special elements used in an os command, which may allow an authenticated...

PT-2023-1548

Name of the Vulnerable Software and Affected Versions FortiWeb versions 5.9.0 through 5.9.1 FortiWeb versions 6.0.0 through 6.0.7 FortiWeb versions 6.1.0 through 6.1.2 FortiWeb versions 6.2.0 through 6.2.6 FortiWeb versions 6.3.0 through 6.3.16 FortiWeb versions 6.4 all versions Description A...

PT-2023-2042

Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 6.3.6 through 6.3.19 Fortinet FortiWeb versions 7.0.0 through 7.0.1 Fortinet FortiWeb 6.4 all versions Description A stack-based buffer overflow in Fortinet FortiWeb allows an attacker to escalate privileges via...

PT-2023-3049

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.4.0 through 7.0.1 FortiWeb version 7.0.0 through 7.0.1 Description The issue is related to a use of externally-controlled format string in FortiWeb, allowing an attacker to execute unauthorized code or commands via speciall...

PT-2023-13002

Name of the Vulnerable Software and Affected Versions FortiWeb versions 7.0.1 and below FortiWeb version 6.4 all versions FortiWeb version 6.3.19 and below Description A stack-based buffer overflow vulnerability in the CA sign functionality may allow an authenticated attacker to achieve arbitrary...

CVE-2022-30304: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8 may allow a remote unauthenticated attacker to perform a stored cross site scripting XSS attack via the URL parameter observed in the FortiWeb attack event...

CVE-2022-30303: Improper Neutralization of Special Elements used in an OS Command

An improper neutralization of special elements used in an os command 'OS Command Injection' CWE-78 in FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions may allow an authenticated attacker to execute arbitrary shell code as root user via crafted HTTP requests...

Fortinet FortiWeb 跨站脚本漏洞

Fortinet FortiWeb is a Web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures Web applications and protects sensitive database content. A cross-site scripting vulnerability exists...

CVE-2022-30306: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability CWE-121 in the CA sign functionality of FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted password...

CVE-2022-30300: Relative Path Traversal

A relative path traversal vulnerability CWE-23 in FortiWeb 7.0.0 through 7.0.1, 6.3.6 through 6.3.18, 6.4 all versions may allow an authenticated attacker to obtain unauthorized access to files and data via specifically crafted HTTP GET requests...

CVE-2022-30299: Relative Path Traversal

A path traversal vulnerability CWE-23 in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions may allow an authenticated attacker to retrieve specific parts of files from the underlying file system via specially...

CVE-2023-23782: Heap-based Buffer Overflow

A heap-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb version 6.3.0 through 6.3.19, FortiWeb 6.4 all versions, FortiWeb 6.2 all versions, FortiWeb 6.1 all versions allows attacker to escalation of privilege via specifically crafted arguments to existing commands...

CVE-2023-23780: Stack-based Buffer Overflow

A stack-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, Fortinet FortiWeb version 6.3.6 through 6.3.19, Fortinet FortiWeb 6.4 all versions allows attacker to escalation of privilege via specifically crafted HTTP requests...

CVE-2023-23779: Improper Neutralization of Special Elements used in an OS Command

Multiple improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerabilities CWE-78 in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted...