CVE-2024-45330

CVE-2024-45330 describes an externally-controlled format string vulnerability in Fortinet FortiAnalyzer affecting 7.4.0–7.4.3 and 7.2.2–7.2.5. The flaw allows an attacker to escalate privileges by sending specially crafted requests. The available sources confirm the affected product and impact; n...

Fortinet FortiManager 信息泄露漏洞

Fortinet FortiManager is a centralized network security management platform from Fortinet. The platform supports centralized management of any number of Fortinet devices and the ability to group devices into different administrative domains ADOMs to further simplify multi-device security deployme...

Fortinet FortiAnalyzer Authorization Bypass (FG-IR-23-204)

The remote host is running a version of FortiAnalyzer that is 6.2.x, 6.4.x, 7.0.x, 7.2.x through 7.2.4, or 7.4.x through 7.4.1. It is, therefore, affected by an authorization bypass vulnerability through user-controlled key CWE-639 vulnerability that may allow a remote attacker with low privilege...

Fortinet FortiClient EMS < 7.2.5 (FG-IR-23-362)

The version of Fortinet FortiClient EMS installed on the remote host is prior to 7.2.5. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-362 advisory. - A improper limitation of a pathname to a restricted directory 'path traversal' in Fortinet FortiClientEMS versions...

Fortinet Confirms Limited Data Breach After Hacker Leaks 440 GB of Data

A hacker claims to have stolen 440 GB of data from cybersecurity firm Fortinet, exploiting an Azure SharePoint…...

Fortinet FortiClientEMS Command Injection Vulnerability

Fortinet FortiClientEMS is part of Fortinet's Endpoint Management solution from Fortinet, a U.S.-based company, and is designed to help organizations effectively manage endpoint devices in their networks and provide monitoring and control of endpoint security. A command injection vulnerability...

Fortinet FortiEDR Access Control Error Vulnerability (CNVD-2025-00410)

Fortinet FortiEDR is an endpoint security solution built from the ground up by Fortinet. Fortinet FortiEDR suffers from an Access Control Error vulnerability that stems from incorrect access control. An attacker could exploit the vulnerability to obtain sensitive information...

Fortinet FortiSOAR 安全漏洞

Fortinet FortiSOAR is a Security Orchestration, Automation and Response SOAR solution from Fortinet, Inc. A security vulnerability exists in Fortinet FortiSOAR that stems from improper authorization management. An attacker could exploit the vulnerability to conduct brute force attacks on user and...

CVE-2024-33508

An improper neutralization of special elements used in a command 'Command Injection' vulnerability CWE-77 in Fortinet FortiClientEMS 7.2.0 through 7.2.4, 7.0.0 through 7.0.12 may allow an unauthenticated attacker to execute limited and temporary operations on the underlying database via crafted...

CVE-2024-33508

An improper neutralization of special elements used in a command 'Command Injection' vulnerability CWE-77 in Fortinet FortiClientEMS 7.2.0 through 7.2.4, 7.0.0 through 7.0.12 may allow an unauthenticated attacker to execute limited and temporary operations on the underlying database via crafted...

CVE-2024-31490

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2.2 through 3.2.4, FortiSandbox 3.1.5 allows attacker to information disclosure via HTTP get...

CVE-2024-31490

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2.2 through 3.2.4, FortiSandbox 3.1.5 allows attacker to information disclosure via HTTP get...

CVE-2024-21753

A improper limitation of a pathname to a restricted directory 'path traversal' in Fortinet FortiClientEMS versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.13, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8, 1.2.1 through 1.2.5 allows attacker to perform a denial of service, read or...

CVE-2024-21753

Fortinet FortiClientEMS is affected by a path traversal vulnerability (CVE-2024-21753) across multiple releases: 1.2.1–1.2.5, 6.0.0–6.0.8, 6.2.0–6.2.9, 6.4.0–6.4.9, 7.0.0–7.0.13, and 7.2.0–7.2.4. The issue stems from improper limitation of a pathname to a restricted directory, allowing a remote a...

CVE-2024-33508

An improper neutralization of special elements used in a command 'Command Injection' vulnerability CWE-77 in Fortinet FortiClientEMS 7.2.0 through 7.2.4, 7.0.0 through 7.0.12 may allow an unauthenticated attacker to execute limited and temporary operations on the underlying database via crafted...

CVE-2024-31490

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2.2 through 3.2.4, FortiSandbox 3.1.5 allows attacker to information disclosure via HTTP get...

CVE-2024-33508

Fortinet FortiClientEMS is affected by CVE-2024-33508 through improper neutralization of special elements in a command, enabling an unauthenticated attacker to perform limited, temporary operations on the underlying database via crafted requests. Affected versions are FortiClientEMS 7.0.0–7.0.12 ...

CVE-2024-31490

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2.2 through 3.2.4, FortiSandbox 3.1.5 allows attacker to information disclosure via HTTP get...

CVE-2024-31490

CVE-2024-31490 affects Fortinet FortiSandbox products (FortiSandbox 4.4.0–4.4.4; 4.2.1–4.2.6; 4.0 all versions; 3.2.2–3.2.4; 3.1.5). The issue is an information disclosure via HTTP GET requests, enabling an attacker to access sensitive information. The connected documents confirm the affected ver...

CVE-2024-33508

An improper neutralization of special elements used in a command 'Command Injection' vulnerability CWE-77 in Fortinet FortiClientEMS 7.2.0 through 7.2.4, 7.0.0 through 7.0.12 may allow an unauthenticated attacker to execute limited and temporary operations on the underlying database via crafted...