CVE-2022-40676

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 allows attacker to execute unauthorized co...

CVE-2022-40676

Fortinet FortiNAC is affected by CVE-2022-40676 due to improper neutralization of input during web page generation, enabling cross-site scripting (XSS) via specially crafted HTTP requests. Affected FortiNAC versions include 8.3.7, 8.5.0–8.5.4, 8.6.0–8.6.5, 8.7.0–8.7.6, 8.8.0–8.8.11, 9.1.0–9.1.8, ...

CVE-2022-39951

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specifically crafted HTTP...

CVE-2022-39951

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specifically crafted HTTP...

CVE-2022-39951

FortiWeb is affected by an OS command injection vulnerability (CVE-2022-39951) in Fortinet FortiWeb versions 7.0.0–7.0.2, 6.3.6–6.3.20, and 6.4 all versions. The issue is described as improper neutralization of special elements used in an OS command, enabling an attacker to execute unauthorized c...

CVE-2023-25605

Summary: CVE-2023-25605 affects Fortinet FortiSOAR 7.3.0–7.3.1 and is due to an improper access control flaw in the administrative interface. An attacker authenticated to the admin interface can perform unauthorized actions by sending crafted HTTP requests. Multiple connected sources corroborate ...

CVE-2023-25605

A improper access control vulnerability in Fortinet FortiSOAR 7.3.0 - 7.3.1 allows an attacker authenticated on the administrative interface to perform unauthorized actions via crafted HTTP requests...

FortiWeb - command injection in webserver

An improper neutralization of special elements used in an OS command vulnerability 'OS Command Injection' CWE-78 in FortiWeb may allow authenticated users to execute unauthorized code or commands via specifically crafted HTTP requests...

PT-2023-1863 · Fortinet · Fortisoar

Name of the Vulnerable Software and Affected Versions: Fortinet FortiSOAR versions 7.3.0 through 7.3.1 Description: The issue is related to improper access control in the administrative interface, allowing an attacker to perform unauthorized actions via crafted HTTP requests. This can enable a...

FortiSOAR - Improper Authorization in request headers

An improper access control vulnerability CWE-284 in FortiSOAR's playbook component may allow an attacker authenticated on the administrative interface to perform unauthorized actions via crafted HTTP requests...

Fortinet FortiWeb Stack-based buffer overflows in Proxyd (FG-IR-21-186)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-186 advisory. - Multiple stack-based buffer overflow vulnerabilities CWE-121 in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and...

FortiAuthenticator, FortiDeceptor & FortiMail - Improper restriction over excessive authentication attempts

An improper restriction of excessive authentication attempts vulnerability CWE-307 in FortiAuthenticator, FortiDeceptor & FortiMail may allow a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form...

FortiNAC - Multiple Reflected XSS

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability CWE-79 in FortiNAC may allow an authenticated user to perform an XSS attack via crafted HTTP requests...

The vulnerability of FortiWeb web applications’ network firewalls arises from the failure to take measures to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary code or perform arbitrary commands.

The vulnerability of FortiWeb web applications’ network firewalls exists due to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or perform arbitrary commands usin...

Schneider Electric Modicon Improper Input Validation (CVE-2021-22699)

Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that could cause denial of service when specific crafted requests are sent to the controller over HTTP. This plugin only works with Tenable.ot. Please visit...

Siretta QUARTZ-GOLD Remaining Debug Code Vulnerability

Siretta QUARTZ-GOLD is a high-speed industrial router from Siretta. Siretta QUARTZ-GOLD version G5.0.1.5-210720-141020 contains a residual debug code vulnerability that can be exploited by attackers to cause remote code execution by sending specially crafted HTTP requests...

Fortinet FortiWeb has an unspecified vulnerability (CNVD-2023-18296)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A security vulnerability exists that could b...

Osprey Pump Controller 1.0.1 Cross-Site Request Forgery

Summary Providing pumping systems and automated controls for golf courses and turf irrigation, municipal water and sewer, biogas, agricultural, and industrial markets. Osprey: door-mounted, irrigation and landscape pump controller. Technology hasn't changed dramatically on pump and electric motor...

XML External Entity (XXE) vulnerability in apoc.import.graphml

Impact A XML External Entity XXE vulnerability found in the apoc.import.graphml procedure of APOC core plugin in Neo4j graph database. XML External Entity XXE injection occurs when the XML parser allows external entities to be resolved. The XML parser used by the apoc.import.graphml procedure was...

GHSA-9VX8-F5C4-862X XML External Entity (XXE) vulnerability in apoc.import.graphml

Impact A XML External Entity XXE vulnerability found in the apoc.import.graphml procedure of APOC core plugin in Neo4j graph database. XML External Entity XXE injection occurs when the XML parser allows external entities to be resolved. The XML parser used by the apoc.import.graphml procedure was...