Design/Logic Flaw

A cleartext transmission of sensitive information vulnerability CWE-319 in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.8, FortiProxy version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.8 allows an authenticated attacker with readonly superadmin privileges to intercept traffic in...

CVE-2023-22637

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability CWE-79 in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in License Management would permit an authenticated...

Authentication flaw

A weak authentication vulnerability CWE-1390 in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in device registration page may allow an unauthenticated attacker to perform password spraying attacks with an increas...

PT-2023-14409 · Fortinet · Fortinac-F +1

Name of the Vulnerable Software and Affected Versions: FortiNAC-F version 7.2.0 FortiNAC versions 9.4.1 and below FortiNAC versions 9.2 and earlier FortiNAC versions 8.8 and earlier FortiNAC versions 8.7 and earlier Description: A URL redirection to untrusted site 'Open Redirect' issue may allow ...

CVE-2023-30212

OURPHP = 7.2.0 is vulnerale to Cross Site Scripting XSS via /client/manage/ourphpout.php...

Cross site scripting

OURPHP = 7.2.0 is vulnerale to Cross Site Scripting XSS via /client/manage/ourphpout.php...

Cross site scripting

OURPHP = 7.2.0 is vulnerable to Cross Site Scripting XSS via ourphptz.php...

CVE-2023-30212

OURPHP = 7.2.0 is vulnerale to Cross Site Scripting XSS via /client/manage/ourphpout.php...

Open redirect

A url redirection to untrusted site 'open redirect' in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, FortiOS versions 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.2, FortiProxy version 7.0.0...

CVE-2022-42476

A relative path traversal vulnerability CWE-23 in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.11, FortiProxy version 7.2.0 through 7.2.2 and 7.0.0 through 7.0.8 allows privileged VDOM administrators to escalate their privileges to super admin of the box via...

Information disclosure

A missing cryptographic steps vulnerability CWE-325 in the functions that encrypt the DHCP and DNS keys in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.9, 6.2.x and 6.0.x may allow an attacker in possession of the encrypted key to decipher it...

PT-2022-24105 · Mutiny · Mutiny

Name of the Vulnerable Software and Affected Versions: Mutiny version 7.2.0-10788 Description: The issue is related to a hardcoded root password in the software. This could potentially allow unauthorized access to the system. Recommendations: For Mutiny version 7.2.0-10788, consider changing the...

PT-2022-24396 · Fortinet · Fortisoar

Name of the Vulnerable Software and Affected Versions: FortiSOAR versions 7.0.0 through 7.0.3 FortiSOAR version 7.2.0 Description: The issue is related to improper neutralization of input during web page generation, which may allow an authenticated attacker to inject HTML tags via input fields of...

PT-2022-27394

Name of the Vulnerable Software and Affected Versions Varnish Cache versions 7.0.0 through 7.1.1 Varnish Cache versions 7.2.0 through 7.2.0 Description An issue was discovered in Varnish Cache, allowing a request smuggling attack to be performed on Varnish Cache servers. This occurs when certain...

CVE-2022-38380

An improper access control CWE-284 vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticated read-only user to modify the interface settings via the API...

Withdrawn Advisory: ReDoS in py library when used with subversion

Withdrawn Advisory This advisory has been withdrawn because evidence does not suggest that CVE-2022-42969 is a valid, reproducible vulnerability. This link is maintained to preserve external references. Original Description The py library through 1.11.0 for Python allows remote attackers to condu...

PT-2022-26687

Name of the Vulnerable Software and Affected Versions py versions through 1.11.0 Description The py library allows remote attackers to conduct a ReDoS Regular expression Denial of Service attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled...

Mattermost Server 7.1.0 DoS (MMSA-2022-00115)

The version of Mattermost Server running on the remote host is 7.1.0. It is, therefore, affected by a denial of service DoS vulnerability. An authenticated, remote attacker can upload a specially crafted GIF file when creating a post which causes resource exhaustion on the host. Note that Nessus...

Fortinet FortiOS 跨站脚本漏洞

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, anti-virus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. A security vulnerability exists ...

Fortinet FortiSOAR 代码注入漏洞

Fortinet FortiSOAR is a Security Orchestration, Automation, and Response SOAR solution from Fortinet USA. A security vulnerability in the Fortinet FortiSOAR management interface, which stems from the incorrect neutralization of specific elements it uses, could allow an authenticated, remote...