CVE-2024-35278

Fortinet FortiPortal exposes a SQL injection vulnerability (CVE-2024-35278) due to improper neutralization of special elements in SQL commands. Affected versions are FortiPortal 7.2.4–7.2.0 and 7.0.0–7.2.8. An authenticated attacker can view the SQL query being executed on the server by manipulat...

CVE-2024-27778

An improper neutralization of special elements used in an OS Command vulnerability CWE-78 vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0....

CVE-2024-52969

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 in FortiSIEM ersion 7.1.7 and below, version 7.1.0, version 7.0.3 and below, version 6.7.9 and below, 6.7.8, version 6.6.5 and below, version 6.5.3 and below, version 6.4.4 and below...

CVE-2024-46669

An Integer Overflow or Wraparound vulnerability CWE-190 in version 7.4.4 and below, version 7.2.10 and below; FortiSASE version 23.4.b FortiOS tenant IPsec IKE service may allow an authenticated attacker to crash the IPsec tunnel via crafted requests, resulting in potential denial of service...

CVE-2024-46669

CVE-2024-46669 is an Integer Overflow or Wraparound (CWE-190) vulnerability in FortiSASE FortiOS IPsec IKE service, affecting FortiSASE 23.4.b and FortiOS versions 7.4.4 and below and 7.2.10 and below. Multiple sources describe an authenticated attacker able to crash the IPsec tunnel by sending c...

CVE-2024-46669

An Integer Overflow or Wraparound vulnerability CWE-190 in version 7.4.4 and below, version 7.2.10 and below; FortiSASE version 23.4.b FortiOS tenant IPsec IKE service may allow an authenticated attacker to crash the IPsec tunnel via crafted requests, resulting in potential denial of service...

CVE-2024-48893

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiSOAR 7.3.0 through 7.3.3, 7.2.1 through 7.2.2 may allow an authenticated attacker to perform a stored cross site scripting XSS attack via the creation of malicious playbook...

CVE-2025-0394

The CVE-2025-0394 entry concerns the WordPress Groundhogg plugin (WordPress CRM, Email & Marketing Automation). The connected Wordfence RH entry confirms an authentication-relevant issue: Groundhogg

CVE-2025-0058

In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information that should otherwise be restricted. The attacker does not have the ability to modify the information or to make the...

CVE-2025-0068

CVE-2025-0068 is an information-disclosure vulnerability in SAP NetWeaver Application Server ABAP. The root cause is a missing authorization check in remote function calls (RFC), enabling an authenticated attacker to access restricted information. The impact is limited to confidentiality (no inte...

CVE-2025-0058 Information Disclosure vulnerability in SAP Business Workflow and SAP Flexible Workflow

In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view sensitive information that should otherwise be restricted. The attacker does not have the ability to modify the information or to make the...

CVE-2025-0058

SAP Business Workflow and SAP Flexible Workflow are affected by CVE-2025-0058. An authenticated attacker can manipulate a parameter in a legitimate resource request to view sensitive information that should be restricted, without modifying the information or causing unavailability. The report cit...

Ivanti EPM 安全漏洞

Ivanti EPM is a comprehensive endpoint management solution developed by Ivanti. Ivanti EPM suffers from an elevation of privilege vulnerability that stems from an issue containing an uninitialized resource that can be exploited by an attacker to elevate its privileges...

PT-2025-2687

Name of the Vulnerable Software and Affected Versions FortiDeceptor versions 6.0.0, 5.3.3 and below, 5.2.1 and below, 5.1.0, 5.0.0 Description The issue is related to improper access control, which may allow an authenticated attacker with no privileges to perform operations on the central...

PT-2025-2585 · Fortinet · Fortivoice

Name of the Vulnerable Software and Affected Versions: Fortinet FortiVoice versions 7.0.0 through 7.0.4 Fortinet FortiVoice versions prior to 6.4.9 Description: The issue is related to an improper neutralization of special elements used in an OS command, allowing an authenticated privileged...

Ivanti EPM SQL注入漏洞

Ivanti EPM is a one-stop shop for managing user profiles and all client devices from Ivanti USA. Ivanti EPM is vulnerable to a SQL injection vulnerability that stems from the inclusion of a SQL injection vulnerability. Allowing a remote authenticated attacker with administrator privileges to...

PT-2025-2445 · Wavlink · Wavlink Ac3000

Name of the Vulnerable Software and Affected Versions: Wavlink AC3000 version M33A8.V5030.210505 Description: A buffer overflow issue exists in the set info functionality of usbip.cgi. This can be triggered by a specially crafted HTTP request, leading to a stack-based buffer overflow. An attacker...

PT-2025-1601 · Ivanti · Ivanti Application Control Engine

Name of the Vulnerable Software and Affected Versions: Ivanti Application Control Engine versions prior to 10.14.4.0 Description: A race condition in the software allows a local authenticated attacker to bypass the application blocking functionality. Recommendations: For versions prior to...

Fortinet FortiManager 操作系统命令注入漏洞

Fortinet FortiManager is a centralized network security management platform from Fortinet. The platform supports centralized management of any number of Fortinet devices, and can group devices into different management domains ADOM to further simplify the deployment and management of multi-device...

Fortinet FortiSIEM SQL注入漏洞

Fortinet FortiSIEM is a security information and event management system from Fortinet, Inc. The system includes features such as asset discovery, workflow automation, and unified management. Fortinet FortiSIEM suffers from an SQL injection vulnerability that stems from improper neutralization of...