CVE-2024-48886

CVE-2024-48886 concerns Fortinet products (FortiOS, FortiProxy, FortiManager, FortiAnalyzer Cloud, FortiManager Cloud) with a weak authentication flaw that allows an attacker to execute unauthorized code or commands via brute-force. The initial description lists affected versions across FortiOS: ...

CVE-2024-48886

A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.17, 2.0.0 through 2.0.14, FortiManager versions 7.6.0 through 7.6.1, 7.4.1...

CVE-2024-48884

CVE-2024-48884 affects Fortinet products including FortiManager (7.6.0–7.6.1, 7.4.1–7.4.3, FortiManager Cloud 7.4.1–7.4.3), FortiOS (7.6.0, 7.4.0–7.4.4, 7.2.0–7.2.9, 7.0.0–7.0.15, 6.4.0–6.4.15), FortiProxy (7.4.0–7.4.5, 7.2.0–7.2.11, 7.0.0–7.0.18, 2.0 all versions, 1.2 all versions, 1.1 all versi...

CVE-2024-46668

CVE-2024-46668 describes an allocation of resources without limits or throttling (CWE-770) in Fortinet FortiOS. The vulnerability affects FortiOS versions 7.4.0–7.4.4, 7.2.0–7.2.8, 7.0.0–7.0.15, and 6.4.0–6.4.15, where an unauthenticated remote attacker could cause memory exhaustion by uploading ...

CVE-2024-46668

An allocation of resources without limits or throttling vulnerability CWE-770 in FortiOS versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, versions 7.0.0 through 7.0.15, and versions 6.4.0 through 6.4.15 may allow an unauthenticated remote user to consume all system memory via multiple...

CVE-2024-46668

An allocation of resources without limits or throttling vulnerability CWE-770 in FortiOS versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, versions 7.0.0 through 7.0.15, and versions 6.4.0 through 6.4.15 may allow an unauthenticated remote user to consume all system memory via multiple...

CVE-2023-46715

An origin validation error CWE-346 vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and version 7.2.6 and below allows an authenticated IPSec VPN user with dynamic IP addressing to send but not receive packets spoofing the IP of another user via crafted network packets...

CVE-2023-46715

An origin validation error CWE-346 vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and version 7.2.6 and below allows an authenticated IPSec VPN user with dynamic IP addressing to send but not receive packets spoofing the IP of another user via crafted network packets...

CVE-2023-46715

CVE-2023-46715 describes an origin validation error (CWE-346) in Fortinet FortiOS IPSec VPN that allows an authenticated VPN user with dynamic IP addressing to spoof another user’s IP by sending crafted packets. Affected products and versions are Fortinet FortiOS IPSec VPN 7.4.0–7.4.1 and 7.2.6 a...

CVE-2023-42786

A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all versions allows attacker to trigger a denial of service via a crafted http request...

CVE-2023-42786

A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all versions allows attacker to trigger a denial of service via a crafted http request...

CVE-2023-42786

Fortinet FortiOS contains a null pointer dereference in its handling of HTTP requests that can trigger a denial-of-service. Affected are FortiOS releases 7.4.0–7.4.1, 7.2.0–7.2.5, and all 7.0, 6.4, 6.2, and 6.0 series versions (including FortiProxy/FortiOS HA clusters per related advisories). The...

CVE-2023-42785

A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all versions allows attacker to trigger a denial of service via a crafted http request...

CVE-2023-42785

Fortinet FortiOS contains a null pointer dereference leading to denial of service (DoS) via a crafted HTTP request. Affected products and versions include FortiOS 7.4.0–7.4.1, 7.2.0–7.2.5, and all 7.0, 6.4, 6.2, and 6.0 branches. The underlying issue is a null pointer dereference in handling craf...

CVE-2023-42785

A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all versions allows attacker to trigger a denial of service via a crafted http request...

CVE-2024-46670

An Out-of-bounds Read vulnerability CWE-125 in FortiOS version 7.6.0, version 7.4.4 and below, version 7.2.9 and below and FortiSASE FortiOS tenant version 24.3.b IPsec IKE service may allow an unauthenticated remote attacker to trigger memory consumption leading to Denial of Service via crafted...

CVE-2024-46670

An Out-of-bounds Read vulnerability CWE-125 in FortiOS version 7.6.0, version 7.4.4 and below, version 7.2.9 and below and FortiSASE FortiOS tenant version 24.3.b IPsec IKE service may allow an unauthenticated remote attacker to trigger memory consumption leading to Denial of Service via crafted...

CVE-2024-46670

CVE-2024-46670 describes an Out-of-bounds Read (CWE-125) in FortiOS: affected are FortiOS 7.6.0, 7.4.4 and below, 7.2.9 and below, and FortiSASE FortiOS tenant 24.3.b. An unauthenticated remote attacker could trigger memory consumption that leads to Denial of Service via crafted requests. The con...

CVE-2024-46669

An Integer Overflow or Wraparound vulnerability CWE-190 in version 7.4.4 and below, version 7.2.10 and below; FortiSASE version 23.4.b FortiOS tenant IPsec IKE service may allow an authenticated attacker to crash the IPsec tunnel via crafted requests, resulting in potential denial of service...

CVE-2024-46669

CVE-2024-46669 is an Integer Overflow or Wraparound (CWE-190) vulnerability in FortiSASE FortiOS IPsec IKE service, affecting FortiSASE 23.4.b and FortiOS versions 7.4.4 and below and 7.2.10 and below. Multiple sources describe an authenticated attacker able to crash the IPsec tunnel by sending c...