CVE-2023-34991

CVE-2023-34991 is an SQL injection in Fortinet FortiWLM. FortiWLM versions 8.2.2–8.6.5, 8.3.0–8.3.2, 8.4.0–8.4.2, and 8.5.0–8.5.4 are affected due to improper neutralization of special elements in SQL commands, allowing a remote attacker to run arbitrary SQL via a crafted HTTP request. The connec...

CVE-2023-34991

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.0 through 8.4.2 and 8.3.0 through 8.3.2 and 8.2.2 allows attacker to execute unauthorized code or commands via a crafted http reque...

CVE-2023-34991

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.0 through 8.4.2 and 8.3.0 through 8.3.2 and 8.2.2 allows attacker to execute unauthorized code or commands via a crafted http reque...

CVE-2023-33304

A use of hard-coded credentials vulnerability in Fortinet FortiClient Windows 7.0.0 - 7.0.9 and 7.2.0 - 7.2.1 allows an attacker to bypass system protections via the use of static credentials...

CVE-2023-33304

A use of hard-coded credentials vulnerability in Fortinet FortiClient Windows 7.0.0 - 7.0.9 and 7.2.0 - 7.2.1 allows an attacker to bypass system protections via the use of static credentials...

CVE-2023-33304

CVE-2023-33304 affects Fortinet FortiClient for Windows (versions 7.0.0–7.0.9 and 7.2.0–7.2.1). The issue is hard-coded credentials that allow bypassing protections via static credentials. According to the sources, exploitation status is not detailed in these documents. Remediation is available: ...

CVE-2023-36553

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiSIEM version 5.4.0 and 5.3.0 through 5.3.3 and 5.2.5 through 5.2.8 and 5.2.1 through 5.2.2 and 5.1.0 through 5.1.3 and 5.0.0 through 5.0.1 and 4.10.0 and 4.9.0 and 4.7.2 allows attacker to...

CVE-2023-36553

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiSIEM version 5.4.0 and 5.3.0 through 5.3.3 and 5.2.5 through 5.2.8 and 5.2.1 through 5.2.2 and 5.1.0 through 5.1.3 and 5.0.0 through 5.0.1 and 4.10.0 and 4.9.0 and 4.7.2 allows attacker to...

CVE-2023-36553

Fortinet FortiSIEM CVE-2023-36553 is an OS command injection in the FortiSIEM report server (affecting FortiSIEM 4.7, 4.9, 4.10, 5.0–5.4). The root cause is improper neutralization of special characters in API requests, enabling a remote unauthenticated attacker to execute arbitrary commands. For...

CVE-2023-36641

A numeric truncation error in Fortinet FortiProxy version 7.2.0 through 7.2.4, FortiProxy version 7.0.0 through 7.0.10, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1, all versions, FortiProxy 1.0 all versions, FortiOS version 7.4.0, FortiOS version 7.2.0 through 7.2.5,...

CVE-2023-36641

A numeric truncation error in Fortinet FortiProxy version 7.2.0 through 7.2.4, FortiProxy version 7.0.0 through 7.0.10, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1, all versions, FortiProxy 1.0 all versions, FortiOS version 7.4.0, FortiOS version 7.2.0 through 7.2.5,...

CVE-2023-36641

CVE-2023-36641 is a DoS vulnerability caused by a numeric truncation error in Fortinet FortiProxy/FortiOS. Affected products include FortiProxy 1.0–2.0 and FortiOS 6.x–7.x, with exploits triggered by specially crafted HTTP requests. Red Hat, CNVD, and other sources corroborate the DoS impact and ...

CVE-2023-41840

Summary: CVE-2023-41840 affects Fortinet FortiClient for Windows ( FortiClientWindows 7.0.9 ). The issue is a local untrusted search path that enables a DLL hijack by placing a malicious OpenSSL engine library in the search path. Connected sources provide concrete details: FortiClientWindows 7.0....

CVE-2023-41840

A untrusted search path vulnerability in Fortinet FortiClientWindows 7.0.9 allows an attacker to perform a DLL Hijack attack via a malicious OpenSSL engine library in the search path...

CVE-2023-41840

A untrusted search path vulnerability in Fortinet FortiClientWindows 7.0.9 allows an attacker to perform a DLL Hijack attack via a malicious OpenSSL engine library in the search path...

CVE-2023-42783

A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.2 through 8.4.0 and 8.3.2 through 8.3.0 and 8.2.2 allows attacker to read arbitrary files via crafted http requests...

CVE-2023-42783

Fortinet FortiWLM is affected by a path traversal vulnerability (CVE-2023-42783) allowing an attacker to read arbitrary files via crafted HTTP requests. Affected versions: 8.2.2–8.3.0, 8.3.2–8.4.0, 8.4.2–8.5.4, and 8.6.0–8.6.5. Root cause relates to improper handling of relative paths to director...

CVE-2023-42783

A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.2 through 8.4.0 and 8.3.2 through 8.3.0 and 8.2.2 allows attacker to read arbitrary files via crafted http requests...

Fortinet Releases Security Updates for FortiClient and FortiGate

Fortinet has released security advisories addressing vulnerabilities in FortiClient and FortiGate. Cyber threat actors may exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following Fortinet security advisories and...

Fortinet FortiADC Security Vulnerability

Fortinet FortiADC is an application delivery controller from Fortinet. A security vulnerability exists in Fortinet FortiADC that stems from a loose cross-domain policy. An unauthorized attacker could perform privileged operations and retrieve sensitive information via a crafted web request...