CVE-2023-23783

A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted command arguments...

CVE-2023-23783

CVE-2023-23783 relates to Fortinet FortiWeb, where a vulnerability stems from an externally-controlled format string in the command line interface. Affected products include FortiWeb 7.0.0–7.0.1 and FortiWeb 6.4 (all versions). The root cause is improper handling of format strings, which could al...

CVE-2023-23784

A relative path traversal in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to information disclosure via specially crafted web requests...

CVE-2023-23784

A relative path traversal in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to information disclosure via specially crafted web requests...

CVE-2023-23784

CVE-2023-23784 describes a relative path traversal in Fortinet FortiWeb that could disclose information via crafted requests. Affected products include FortiWeb 7.0.0–7.0.2, FortiWeb 6.3.6–6.3.20, and FortiWeb 6.4 (all versions). The root cause is a vulnerability in the API that permits access to...

CVE-2023-23780

CVE-2023-23780 affects Fortinet FortiWeb: a stack-based buffer overflow in FortiWeb’s web server (versions 7.0.0–7.0.1, 6.3.6–6.3.19, and 6.4 all) can lead to privilege escalation via specially crafted HTTP requests. The advisory FG-IR-22-118 and related entries confirm the vulnerability class an...

CVE-2023-23780

A stack-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, Fortinet FortiWeb version 6.3.6 through 6.3.19, Fortinet FortiWeb 6.4 all versions allows attacker to escalation of privilege via specifically crafted HTTP requests...

CVE-2023-23780

A stack-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, Fortinet FortiWeb version 6.3.6 through 6.3.19, Fortinet FortiWeb 6.4 all versions allows attacker to escalation of privilege via specifically crafted HTTP requests...

CVE-2023-25602

A stack-based buffer overflow in Fortinet FortiWeb 6.4 all versions, FortiWeb versions 6.3.17 and earlier, FortiWeb versions 6.2.6 and earlier, FortiWeb versions 6.1.2 and earlier, FortiWeb versions 6.0.7 and earlier, FortiWeb versions 5.9.1 and earlier, FortiWeb 5.8 all versions, FortiWeb 5.7 al...

CVE-2023-25602

A stack-based buffer overflow in Fortinet FortiWeb 6.4 all versions, FortiWeb versions 6.3.17 and earlier, FortiWeb versions 6.2.6 and earlier, FortiWeb versions 6.1.2 and earlier, FortiWeb versions 6.0.7 and earlier, FortiWeb versions 5.9.1 and earlier, FortiWeb 5.8 all versions, FortiWeb 5.7 al...

CVE-2023-25602

The CVE-2023-25602 entry documents a stack-based buffer overflow in Fortinet FortiWeb across multiple versions (6.4 and earlier, 6.3.17 and earlier, 6.2.6 and earlier, 6.1.2 and earlier, 6.0.7 and earlier, 5.9.1 and earlier, 5.8 all versions, 5.7 all versions, 5.6 all versions) that permits an at...

CVE-2021-42756

Multiple stack-based buffer overflow vulnerabilities CWE-121 in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, 6.4 all versions may allow an unauthenticated remote attacker to achieve arbitrary code execution via specifically...

CVE-2021-42756

Fortinet FortiWeb Vulnerability CVE-2021-42756: A set of stack-based buffer overflow flaws in FortiWeb 5.x and various 6.x/7.x releases affects the proxy daemon, enabling an unauthenticated remote attacker to achieve arbitrary code execution via specially crafted HTTP requests. Affected products ...

CVE-2021-42756

Multiple stack-based buffer overflow vulnerabilities CWE-121 in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, 6.4 all versions may allow an unauthenticated remote attacker to achieve arbitrary code execution via specifically...

CVE-2021-42761

A condition for session fixation vulnerability CWE-384 in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session...

CVE-2021-42761

A condition for session fixation vulnerability CWE-384 in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session...

CVE-2021-42761

CVE-2021-42761 affects FortiWeb WAF session management. A session-fixation condition could allow a remote, unauthenticated attacker to infer other users’ session identifiers and potentially hijack sessions. Affected FortiWeb versions include 6.4 (all), 6.3.0–6.3.16, 6.2.0–6.2.6, 6.1.0–6.1.2, 6.0....

CVE-2022-30299

A path traversal vulnerability CWE-23 in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions may allow an authenticated attacker to retrieve specific parts of files from the underlying file system via specially...

CVE-2022-30299

A path traversal vulnerability CWE-23 in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions may allow an authenticated attacker to retrieve specific parts of files from the underlying file system via specially...

CVE-2022-30299

FortiWeb CVE-2022-30299 describes a path traversal (CWE-23) vulnerability in the FortiWeb API that could allow an attacker to retrieve parts of the underlying file system via specially crafted web requests. Affected FortiWeb versions are: 6.0, 6.1, 6.2, 6.3.0–6.3.19, 6.4, and 7.0.0–7.0.1. The iss...