CVE-2024-32115

CVE-2024-32115 is a path-traversal vulnerability in Fortinet FortiManager. The affected product is FortiManager versions 7.4.0–7.4.2 and versions before 7.2.5 . The underlying issue is a relative path traversal (CWE-23) that could allow a privileged attacker to delete files from the underlying fi...

CVE-2024-32115

A relative path traversal vulnerability CWE-23 in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 allows a privileged attacker to delete files from the underlying filesystem via crafted HTTP or HTTPs requests...

CVE-2024-32115

A relative path traversal vulnerability CWE-23 in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 allows a privileged attacker to delete files from the underlying filesystem via crafted HTTP or HTTPs requests...

CVE-2024-47571

An operation on a resource after expiration or release in Fortinet FortiManager 6.4.12 through 7.4.0 allows an attacker to gain improper access to FortiGate via valid credentials...

CVE-2024-47571

Fortinet FortiManager 6.4.12–7.4.0 exposes a post-release reuse/session expiration issue where an operation on a resource after expiration or release can allow an attacker to gain improper access to FortiGate via valid credentials. Affected component is FortiManager CLI/session handling; root cau...

CVE-2024-47571

An operation on a resource after expiration or release in Fortinet FortiManager 6.4.12 through 7.4.0 allows an attacker to gain improper access to FortiGate via valid credentials...

CVE-2024-47572

This CVE affects Fortinet FortiSOAR. The issue is an improper neutralization of formula elements in CSV files, exploitable by manipulating the CSV to cause code/command execution. Affected versions are FortiSOAR 7.2.1 through 7.4.1. Root cause: unsafe handling of CSV content leading to remote cod...

CVE-2024-47572

An improper neutralization of formula elements in a csv file in Fortinet FortiSOAR 7.2.1 through 7.4.1 allows attacker to execute unauthorized code or commands via manipulating csv file...

CVE-2024-47572

An improper neutralization of formula elements in a csv file in Fortinet FortiSOAR 7.2.1 through 7.4.1 allows attacker to execute unauthorized code or commands via manipulating csv file...

CVE-2024-46667

A allocation of resources without limits or throttling in Fortinet FortiSIEM 5.3 all versions, 5.4 all versions, 6.x all versions, 7.0 all versions, and 7.1.0 through 7.1.5 may allow an attacker to deny valid TLS traffic via consuming all allotted connections...

CVE-2024-46667

CVE-2024-46667 affects Fortinet FortiSIEM versions 5.3, 5.4, 6.x, 7.0, and 7.1.0–7.1.5. The root cause is a resource allocation issue with no limits or throttling, which can allow an attacker to exhaust all allotted TLS connections and deny valid TLS traffic. Documents consistently describe the c...

CVE-2024-46667

A allocation of resources without limits or throttling in Fortinet FortiSIEM 5.3 all versions, 5.4 all versions, 6.x all versions, 7.0 all versions, and 7.1.0 through 7.1.5 may allow an attacker to deny valid TLS traffic via consuming all allotted connections...

CVE-2024-21758

The CVE-2024-21758 entry concerns a stack-based buffer overflow in Fortinet FortiWeb CLI handling that affects FortiWeb versions 7.2.0–7.2.7 and 7.4.0–7.4.1. The vulnerability could allow a privileged user to execute arbitrary code if FortiWeb stack protections are bypassed. No exploitation detai...

CVE-2024-21758

A stack-based buffer overflow in Fortinet FortiWeb versions 7.2.0 through 7.2.7, and 7.4.0 through 7.4.1 may allow a privileged user to execute arbitrary code via specially crafted CLI commands, provided the user is able to evade FortiWeb stack protections...

CVE-2024-21758

A stack-based buffer overflow in Fortinet FortiWeb versions 7.2.0 through 7.2.7, and 7.4.0 through 7.4.1 may allow a privileged user to execute arbitrary code via specially crafted CLI commands, provided the user is able to evade FortiWeb stack protections...

CVE-2024-26012

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiAP-S 6.2 all verisons, and 6.4.0 through 6.4.9, FortiAP-W2 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.3, and 7.4.0 through 7.4.2, FortiAP 6.4 all versions, 7.0 all versions, 7.2....

CVE-2024-35277

CVE-2024-35277 affects Fortinet FortiPortal and FortiManager. The issue is a missing authentication for a critical function, enabling an attacker to access the configuration of managed devices by sending specially crafted packets. Affected versions include FortiPortal 6.0.0–6.0.15 and FortiManage...

CVE-2024-35277

A missing authentication for critical function in Fortinet FortiPortal version 6.0.0 through 6.0.15, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14 allows attacker to access to the configuration of the managed devices by sending...

CVE-2024-26012

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiAP-S 6.2 all verisons, and 6.4.0 through 6.4.9, FortiAP-W2 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.3, and 7.4.0 through 7.4.2, FortiAP 6.4 all versions, 7.0 all versions, 7.2....

CVE-2024-26012

CVE-2024-26012: Fortinet FortiAP family devices are affected by an OS command injection vulnerability due to improper neutralization of special elements in commands. A local authenticated attacker could execute unauthorized code via the CLI. Affected products and versions include FortiAP-S: 6.2 (...