CVE-2022-38376

Multiple improper neutralization of input during web page generation 'Cross-site Scripting' vulnerabilities CWE-79 in Fortinet FortiNAC portal UI before 9.4.1 allows an attacker to perform an XSS attack via crafted HTTP requests...

CVE-2022-38375

CVE-2022-38375 affects Fortinet FortiNAC: versions 9.4.0 through 9.4.1 and prior to 9.2.6 expose an improper authorization flaw (CWE-285) that allows an unauthenticated attacker to perform administrative operations via crafted HTTP POST requests. Root cause is improper authorization leading to el...

CVE-2022-38375

An improper authorization vulnerability CWE-285 in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests...

CVE-2022-38375

An improper authorization vulnerability CWE-285 in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests...

CVE-2023-23782

A heap-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb version 6.3.0 through 6.3.19, FortiWeb 6.4 all versions, FortiWeb 6.2 all versions, FortiWeb 6.1 all versions allows attacker to escalation of privilege via specifically crafted arguments to existing commands...

CVE-2023-23782

Fortinet FortiWeb is affected by a heap-based buffer overflow in the CLI that can be exploited by an authenticated attacker to escalate privileges and potentially execute arbitrary code. The CVE-2023-23782 description covers FortiWeb versions 7.0.0–7.0.1, 6.3.0–6.3.19, and all 6.4, 6.2, and 6.1 v...

CVE-2023-23782

A heap-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb version 6.3.0 through 6.3.19, FortiWeb 6.4 all versions, FortiWeb 6.2 all versions, FortiWeb 6.1 all versions allows attacker to escalation of privilege via specifically crafted arguments to existing commands...

CVE-2023-23783

A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted command arguments...

CVE-2023-23783

A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted command arguments...

CVE-2023-23783

CVE-2023-23783 relates to Fortinet FortiWeb, where a vulnerability stems from an externally-controlled format string in the command line interface. Affected products include FortiWeb 7.0.0–7.0.1 and FortiWeb 6.4 (all versions). The root cause is improper handling of format strings, which could al...

CVE-2023-23784

A relative path traversal in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to information disclosure via specially crafted web requests...

CVE-2023-23784

A relative path traversal in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to information disclosure via specially crafted web requests...

CVE-2023-23784

CVE-2023-23784 describes a relative path traversal in Fortinet FortiWeb that could disclose information via crafted requests. Affected products include FortiWeb 7.0.0–7.0.2, FortiWeb 6.3.6–6.3.20, and FortiWeb 6.4 (all versions). The root cause is a vulnerability in the API that permits access to...

CVE-2023-23780

CVE-2023-23780 affects Fortinet FortiWeb: a stack-based buffer overflow in FortiWeb’s web server (versions 7.0.0–7.0.1, 6.3.6–6.3.19, and 6.4 all) can lead to privilege escalation via specially crafted HTTP requests. The advisory FG-IR-22-118 and related entries confirm the vulnerability class an...

CVE-2023-23780

A stack-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, Fortinet FortiWeb version 6.3.6 through 6.3.19, Fortinet FortiWeb 6.4 all versions allows attacker to escalation of privilege via specifically crafted HTTP requests...

CVE-2023-23780

A stack-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, Fortinet FortiWeb version 6.3.6 through 6.3.19, Fortinet FortiWeb 6.4 all versions allows attacker to escalation of privilege via specifically crafted HTTP requests...

CVE-2023-25602

A stack-based buffer overflow in Fortinet FortiWeb 6.4 all versions, FortiWeb versions 6.3.17 and earlier, FortiWeb versions 6.2.6 and earlier, FortiWeb versions 6.1.2 and earlier, FortiWeb versions 6.0.7 and earlier, FortiWeb versions 5.9.1 and earlier, FortiWeb 5.8 all versions, FortiWeb 5.7 al...

CVE-2023-25602

A stack-based buffer overflow in Fortinet FortiWeb 6.4 all versions, FortiWeb versions 6.3.17 and earlier, FortiWeb versions 6.2.6 and earlier, FortiWeb versions 6.1.2 and earlier, FortiWeb versions 6.0.7 and earlier, FortiWeb versions 5.9.1 and earlier, FortiWeb 5.8 all versions, FortiWeb 5.7 al...

CVE-2023-25602

The CVE-2023-25602 entry documents a stack-based buffer overflow in Fortinet FortiWeb across multiple versions (6.4 and earlier, 6.3.17 and earlier, 6.2.6 and earlier, 6.1.2 and earlier, 6.0.7 and earlier, 5.9.1 and earlier, 5.8 all versions, 5.7 all versions, 5.6 all versions) that permits an at...

CVE-2022-41335

A relative path traversal vulnerability CWE-23 in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, FortiProxy version 7.2.0 through 7.2.1, 7.0.0 through 7.0.7 and before 2.0.10, FortiSwitchManager 7.2.0 and before 7.0.0 allows an authenticated attacker to read...