CVE-2021-32591

A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier may allow an attacker in possession of the password store to compromise the...

CVE-2021-32591

A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier may allow an attacker in possession of the password store to compromise the...

CVE-2021-32591

The CVE-2021-32591 issue is a missing cryptographic steps vulnerability affecting Fortinet products: FortiSandbox < 4.0.1, FortiWeb < 6.3.12, FortiADC < 6.2.1, and FortiMail

CVE-2021-36180

Multiple improper neutralization of special elements used in a command vulnerabilities CWE-77 in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests...

CVE-2021-36180

Multiple improper neutralization of special elements used in a command vulnerabilities CWE-77 in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests...

CVE-2021-36180

Multiple improper neutralization of special elements used in a command vulnerabilities CWE-77 in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests...

Command injection

Multiple improper neutralization of special elements used in a command vulnerabilities CWE-77 in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests...

CVE-2021-36180

CVE-2021-36180 affects Fortinet FortiWeb, specifically the management interface. The issue is described as multiple improper neutralization of special elements used in a command (CWE-77) that could allow an authenticated attacker to execute unauthorized code or commands via crafted HTTP request p...

CVE-2021-36180

Multiple improper neutralization of special elements used in a command vulnerabilities CWE-77 in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests...

CVE-2021-36180

Multiple improper neutralization of special elements used in a command vulnerabilities CWE-77 in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests...

PT-2021-21172 · Fortinet · Fortiweb

Name of the Vulnerable Software and Affected Versions: Fortinet FortiWeb versions 6.4.1 and below Fortinet FortiWeb versions 6.3.15 and below Description: The issue involves an unintended proxy or intermediary, referred to as a 'confused deputy', which allows an unauthenticated attacker to access...

Fortinet FortiWeb 操作系统命令注入漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. management interface is vulnerable to comman...

Vulnerability fixed in Fortinet products

A vulnerability has been fixed in FortiSandbox, FortiWeb, FortiADC and FortiMail. A malicious party in possession of the password store could potentially gain access to encrypted data. Fortinet has released updates to address the vulnerability. fix. For more information, see:...

PT-2021-19797 · Fortinet · Fortimail +3

Name of the Vulnerable Software and Affected Versions: FortiSandbox versions prior to 4.0.1 FortiWeb versions prior to 6.3.12 FortiADC versions prior to 6.2.1 FortiMail versions 7.0.1 and earlier Description: A missing cryptographic steps issue in the function that encrypts users' LDAP and RADIUS...

PT-2021-23051

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.3.0 through 6.3.15 FortiWeb versions 6.4.0 through 6.4.1 Description Multiple heap-based buffer overflow vulnerabilities in some web API controllers of FortiWeb may allow a remote authenticated attacker to execute arbitrary...

PT-2021-23053

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.4.0 through 6.4.1 Description A stack-based buffer overflow allows an authenticated attacker to execute unauthorized code or commands via crafted certificates loaded into the device. Recommendations For FortiWeb versions...

PT-2021-23048

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.4.1 and below FortiWeb versions 6.3.15 and below Description An improper access control issue in the Report Browse section of Log & Report may allow an unauthorized and unauthenticated user to access the Log reports via the...

PT-2021-23050

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.4.1 and below FortiWeb versions 6.3.15 and below Description The issue is related to improper neutralization of input during web page generation, also known as cross-site scripting. This allows an attacker to execute...

PT-2021-23741

Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 6.4.1 through 6.4.0 Fortinet FortiWeb version 6.3.15 and below Fortinet FortiWeb version 6.2.6 and below Description The issue allows for a url redirection to an untrusted site, also known as an 'open redirect',...

CVE-2021-41025: Concurrent Execution using Shared Resource with Improper Synchronization

Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 thorugh 6.0.7, including an instance of concurrent execution using shared resource with improper synchronization and one of...