Command injection

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specifically crafted HTTP...

Design/Logic Flaw

An incomplete filtering of one or more instances of special elements vulnerability CWE-792 in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder...

CVE-2022-22297

An incomplete filtering of one or more instances of special elements vulnerability CWE-792 in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder...

CVE-2022-22297

CVE-2022-22297 affects Fortinet FortiWeb and FortiRecorder with an incomplete filtering issue (CWE-792) in the command line interpreter, enabling an authenticated user to read arbitrary files via crafted command arguments. Affected: FortiWeb versions 6.0–6.4.1 and FortiRecorder versions 2.7–6.4.3...

CVE-2022-22297

An incomplete filtering of one or more instances of special elements vulnerability CWE-792 in the command line interpreter of FortiWeb version 6.4.0 through 6.4.1, FortiWeb version 6.3.0 through 6.3.17, FortiWeb all versions 6.2, FortiWeb all versions 6.1, FortiWeb all versions 6.0, FortiRecorder...

CVE-2022-39951

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specifically crafted HTTP...

CVE-2022-39951

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specifically crafted HTTP...

CVE-2022-39951

FortiWeb is affected by an OS command injection vulnerability (CVE-2022-39951) in Fortinet FortiWeb versions 7.0.0–7.0.2, 6.3.6–6.3.20, and 6.4 all versions. The issue is described as improper neutralization of special elements used in an OS command, enabling an attacker to execute unauthorized c...

PT-2023-1682 · Fortinet · Fortiweb

Name of the Vulnerable Software and Affected Versions: FortiWeb versions 6.3.6 through 6.3.20 FortiWeb versions 7.0.0 through 7.0.2 FortiWeb 6.4 all versions Description: The issue is related to an improper neutralization of special elements used in an os command, also known as 'os command...

FortiWeb - command injection in webserver

An improper neutralization of special elements used in an OS command vulnerability 'OS Command Injection' CWE-78 in FortiWeb may allow authenticated users to execute unauthorized code or commands via specifically crafted HTTP requests...

Fortinet FortiWeb 操作系统命令注入漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. An operating system command injection...

PT-2023-1737 · Fortinet · Fortiweb +1

Name of the Vulnerable Software and Affected Versions: FortiWeb versions 6.0 through 6.4.1 FortiRecorder versions 2.7 through 6.4.3 Description: The issue is related to an incomplete filtering of one or more instances of special elements in the command line interpreter. This may allow an...

Fortinet FortiWeb Stack-based buffer overflows in Proxyd (FG-IR-21-186)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-186 advisory. - Multiple stack-based buffer overflow vulnerabilities CWE-121 in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and...

FortiWeb and FortiRecorder - Arbitrary file read through command line pipe

An incomplete filtering of one or more instances of special elements vulnerability CWE-792 in the command line interpreter of FortiRecorder and FortiWeb may allow an authenticated user to read arbitrary files via specially crafted command arguments...

Fortinet FortiWeb 安全漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. and FortiRecorder are vulnerable to arbitrar...

The vulnerability of FortiWeb web applications’ network firewalls, related to the lack of session fixation mechanisms, allows attackers to intercept sessions of other users.

The vulnerability of FortiWeb web applications’ network firewalls is related to the lack of a session fixation mechanism. Exploiting this vulnerability allows a malicious actor to intercept sessions of other users remotely...

Vulnerabilities of FortiOS operating systems, FortiWeb network gateways for web applications, FortiSwitch Ethernet switches, and FortiProxy proxy servers, which allow attackers to disclose protected information

Vulnerabilities of FortiOS operating systems, FortiWeb network firewalls for web applications, FortiSwitch Ethernet switches, and FortiProxy proxy servers are related to improper verification of cryptographic signatures. Exploiting these vulnerabilities can allow attackers to disclose sensitive...

The vulnerability of FortiWeb web applications’ network firewalls allows attackers to execute arbitrary code.

The vulnerability of FortiWeb web applications’ network firewalls is related to buffer overflow attacks. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through specially crafted HTTP requests...

The vulnerability of FortiWeb web applications’ network firewalls arises from the failure to take measures to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary code or perform arbitrary commands.

The vulnerability of FortiWeb web applications’ network firewalls exists due to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or perform arbitrary commands usin...

Fortinet FortiWeb Buffer Overflow Vulnerability (CNVD-2023-18294)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A buffer overflow vulnerability exists that...