CVE-2022-43955

An improper neutralization of input during web page generation CWE-79 in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3.0 through 6.3.21, 6.4 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow an unauthenticated and remote attacker to perform a reflected cross si...

CVE-2022-43955

CVE-2022-43955 affects Fortinet FortiWeb web interface; reported as an improper neutralization of input during web page generation (CWE-79) that can enable unauthenticated, remote attackers to perform a reflected cross-site scripting (XSS) via malicious payloads injected into log entries used to ...

CVE-2022-43948

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 7.0.0 through 7.0.3, FortiADC version 7.1.0 through 7.1.1, FortiADC version 7.0.0 through 7.0.3, FortiADC 6.2 all versions, FortiADC 6.1 all versions, FortiADC 6.0 all versions,...

CVE-2022-43948

Summary of CVE-2022-43948 details : An OS command injection vulnerability (improper neutralization of special elements used in an os command) affects Fortinet FortiWeb and FortiADC. Affected versions include FortiWeb 7.0.0–7.0.3 and FortiADC 7.0.0–7.0.3, 7.1.0–7.1.1, plus FortiADC 6.0–6.2 and 5.1...

FortiWeb - XSS vulnerability in HTML generated attack report files

An improper neutralization of input during web page generation CWE-79 in the FortiWeb web interface may allow an unauthenticated and remote attacker to perform a reflected cross site scripting attack XSS via injecting malicious payload in log entries used to build report...

PT-2023-14407 · Fortinet · Fortiadc +1

Name of the Vulnerable Software and Affected Versions: FortiWeb versions 7.0.0 through 7.0.3 FortiADC versions 7.1.0 through 7.1.1 FortiADC versions 7.0.0 through 7.0.3 FortiADC 6.2 all versions FortiADC 6.1 all versions FortiADC 6.0 all versions FortiADC 5.4 all versions FortiADC 5.3 all version...

Fortinet FortiWeb 跨站脚本漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure web applications and protect sensitive database content. A security vulnerability exists in Fortinet...

FortiWeb & FortiADC - OS command injection in CLI

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the command line interpreter of FortiWeb & FortiADC may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...

Fortinet FortiWeb 操作系统命令注入漏洞

Fortinet FortiWeb is a Web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure Web applications and protect sensitive database content. A security vulnerability exists in Fortinet...

The vulnerability of FortiWeb web applications’ network firewalls arises from the failure to take measures to neutralize special elements used in the operating system’s command set. This vulnerability allows attackers to execute arbitrary code.

The vulnerability of FortiWeb web applications lies in the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted HTTP requests...

The vulnerability of FortiWeb web applications’ network firewalls, related to writing data beyond the buffer in memory, allows attackers to escalate their privileges.

The vulnerability of FortiWeb web applications’ network firewalls is related to the writing of data beyond the buffer in memory. Exploiting this vulnerability can allow a malicious actor to enhance their privileges by sending specially crafted HTTP requests remotely...

The vulnerability of FortiWeb web application command-line interpreter and FortiRecorder video surveillance system devices allows attackers to gain unauthorized access to protected information.

The vulnerability of the command-line interpreter of FortiWeb web applications and FortiRecorder video surveillance devices relates to improper filtering of one or more special elements. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information using...

The vulnerability of FortiWeb web applications’ network firewalls stems from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.

The vulnerability of FortiWeb web applications’ network firewalls is related to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending specially crafted...

The vulnerability of FortiWeb web applications’ network firewalls arises from the failure to take measures to neutralize special elements used in the operating system’s command line. This allows attackers to execute arbitrary code with root user privileges.

The vulnerability of FortiWeb web applications’ network firewalls exists due to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary code with root privileges by sending...

Fortinet FortiWeb and FortiRecorder Arbitrary File Read Vulnerability

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. and FortiRecorder are vulnerable to arbitrar...

Fortinet FortiWeb OS Command Injection Vulnerability (CNVD-2023-18291)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. An operating system command injection...

CVE-2022-22297

An incomplete filtering of one or more instances of special elements vulnerability CWE-792 in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder...

CVE-2022-39951

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specifically crafted HTTP...

CVE-2022-22297

An incomplete filtering of one or more instances of special elements vulnerability CWE-792 in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder...

CVE-2022-39951

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specifically crafted HTTP...