370 matches found
Fortinet FortiOS Access Control (FG-IR-21-147)
An improper access control vulnerability in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attacker with a restricted user profile to gather sensitive information and modify the SSL-VPN tunnel status of other VDOMs using specific CLI commands. Note that Nessus has...
Input validation
Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG...
CVE-2022-26531
CVE-2022-26531 stems from multiple improper input validation flaws in Zyxel devices (USG/ZyWALL, USG FLEX, ATP, VPN, NSG, NXC2500, NAP203, NWA50AX, WAC500, WAX510D) across firmware ranges up to 4.71/5.21/6.x, enabling a local authenticated attacker to trigger a buffer overflow or system crash via...
Fortinet FortiOS Access Control Error Vulnerability (CNVD-2022-50945)
Fortinet FortiOS is a dedicated security operating system for the FortiGate network security platform from Fortinet, Inc. Fortinet FortiOS versions 6.4.8 and earlier and 7.0.3 and earlier are vulnerable to an access control error that could be exploited by an authenticated attacker with a...
CVE-2021-41032
An improper access control vulnerability CWE-284 in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attacker with a restricted user profile to gather sensitive information and modify the SSL-VPN tunnel status of other VDOMs using specific CLI commands...
Improper access control
An improper access control vulnerability CWE-284 in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attacker with a restricted user profile to gather sensitive information and modify the SSL-VPN tunnel status of other VDOMs using specific CLI commands...
CVE-2021-41032
CVE-2021-41032 is an improper access control vulnerability in FortiOS where an authenticated user with a restricted profile can gather sensitive information and modify the SSL-VPN tunnel state of other VDOMs via specific CLI commands. Affected products are FortiOS 6.4.8 and prior and 7.0.3 and pr...
CVE-2021-41032
An improper access control vulnerability CWE-284 in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attacker with a restricted user profile to gather sensitive information and modify the SSL-VPN tunnel status of other VDOMs using specific CLI commands...
CVE-2021-41032
An improper access control vulnerability CWE-284 in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attacker with a restricted user profile to gather sensitive information and modify the SSL-VPN tunnel status of other VDOMs using specific CLI commands...
Cisco IOS XE Elevation of Privilege Vulnerability (CNVD-2022-55150)
Cisco IOS XE is a set of operating systems developed by Cisco for its network devices.Cisco IOS XE has an elevation of privilege vulnerability, which stems from a user executing certain CLI commands without adequately verifying user privileges, and can be exploited by attackers to cause elevation...
CVE-2022-20665 Cisco StarOS Command Injection Vulnerability
A vulnerability in the CLI of Cisco StarOS could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient input validation of CLI commands. An attacker could exploit this vulnerability by sending crafted commands to the CLI. A...
Fortinet FortiAP-C OS Command Injection Vulnerability
Fortinet FortiAP, a Fortinet controller for managing wireless access point devices, is vulnerable to an operating system command injection vulnerability that stems from the lack of valid escaping and filtering of special elements used in the FortiAP-C console, which could be exploited by an...
Cisco StarOS Command Injection (cisco-sa-staros-cmdinj-759mNT4n)
According to its self-reported version, the Cisco StarOS operating system is affected by a command injection vulnerability due to insufficient input validation of CLI commands. An authenticated, local attacker could exploit this by sending crafted commands to the CLI. A successful exploit could...
CVE-2022-22301
An improper neutralization of special elements used in an OS Command vulnerability CWE-78 in FortiAP-C console 5.4.0 through 5.4.3, 5.2.0 through 5.2.1 may allow an authenticated attacker to execute unauthorized commands by running CLI commands with specifically crafted arguments...
CVE-2022-22301
Summary (CVE-2022-22301) : FortiAP-C consoles suffer from an OS command injection due to improper neutralization of special elements in CLI arguments. Affected versions range from 5.4.0 to 5.4.3 and 5.2.0 to 5.2.1. The issue can allow an authenticated attacker to execute arbitrary commands with C...
CVE-2022-22301
An improper neutralization of special elements used in an OS Command vulnerability CWE-78 in FortiAP-C console 5.4.0 through 5.4.3, 5.2.0 through 5.2.1 may allow an authenticated attacker to execute unauthorized commands by running CLI commands with specifically crafted arguments...
CVE-2021-41016
A improper neutralization of special elements used in a command 'command injection' in Fortinet FortiExtender version 7.0.1 and below, 4.2.3 and below, 4.1.7 and below allows an authenticated attacker to execute privileged shell commands via CLI commands including special characters...
Command injection
A improper neutralization of special elements used in a command 'command injection' in Fortinet FortiExtender version 7.0.1 and below, 4.2.3 and below, 4.1.7 and below allows an authenticated attacker to execute privileged shell commands via CLI commands including special characters...
