CVE-2022-45861

An access of uninitialized pointer vulnerability CWE-824 in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.11 and FortiProxy version 7.2.0 through 7.2.1, version 7.0.0 through 7.0.7 and before 2.0.11 allows a remote authenticated...

CVE-2022-45861

CVE-2022-45861 describes an access of uninitialized pointer vulnerability (CWE-824) in the SSL VPN portal of Fortinet FortiOS (versions 7.2.0–7.2.3, 7.0.0–7.0.9, and before 6.4.11) and FortiProxy (7.2.0–7.2.1, 7.0.0–7.0.7, and before 2.0.11). A remote authenticated attacker could crash the sslvpn...

CVE-2022-27490

Fortinet information disclosure CVE-2022-27490 affects FortiManager (6.0.0–6.0.4), FortiAnalyzer (6.0.0–6.0.4), FortiPortal (6.0.0–6.0.9, 5.3.0–5.3.8, 5.2.x, 5.1.0, 5.0.x, 4.2.x, 4.1.x), and FortiSwitch (7.0.0–7.0.4, 6.4.0–6.4.10, 6.2.x, 6.0.x). Root cause is exposure of sensitive data via diagno...

CVE-2022-27490

A exposure of sensitive information to an unauthorized actor in Fortinet FortiManager version 6.0.0 through 6.0.4, FortiAnalyzer version 6.0.0 through 6.0.4, FortiPortal version 6.0.0 through 6.0.9, 5.3.0 through 5.3.8, 5.2.x, 5.1.0, 5.0.x, 4.2.x, 4.1.x, FortiSwitch version 7.0.0 through 7.0.4,...

CVE-2022-27490

A exposure of sensitive information to an unauthorized actor in Fortinet FortiManager version 6.0.0 through 6.0.4, FortiAnalyzer version 6.0.0 through 6.0.4, FortiPortal version 6.0.0 through 6.0.9, 5.3.0 through 5.3.8, 5.2.x, 5.1.0, 5.0.x, 4.2.x, 4.1.x, FortiSwitch version 7.0.0 through 7.0.4,...

CVE-2022-40676

Fortinet FortiNAC is affected by CVE-2022-40676 due to improper neutralization of input during web page generation, enabling cross-site scripting (XSS) via specially crafted HTTP requests. Affected FortiNAC versions include 8.3.7, 8.5.0–8.5.4, 8.6.0–8.6.5, 8.7.0–8.7.6, 8.8.0–8.8.11, 9.1.0–9.1.8, ...

CVE-2022-40676

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 allows attacker to execute unauthorized co...

CVE-2022-41328

CVE-2022-41328 (Fortinet FortiOS path traversal) : A path traversal vulnerability in Fortinet FortiOS 7.2.0–7.2.3, 7.0.0–7.0.9, and pre-6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands (CWE-22). The issue is documented across mult...

CVE-2022-41328

A improper limitation of a pathname to a restricted directory vulnerability 'path traversal' CWE-22 in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands...

CVE-2022-41328

A improper limitation of a pathname to a restricted directory vulnerability 'path traversal' CWE-22 in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands...

CVE-2022-39953

A improper privilege management in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.6, FortiNAC version 9.1.0 through 9.1.8, FortiNAC all versions 8.8, FortiNAC all versions 8.7, FortiNAC all versions 8.6, FortiNAC all versions 8.5, FortiNAC version 8.3.7 allows...

CVE-2022-39953

CVE-2022-39953 is an improper privilege management vulnerability in Fortinet FortiNAC. FortiNAC versions affected include 8.3.7, 8.5–8.8, 9.1.0–9.1.8, 9.2.0–9.2.6, and 9.4.0–9.4.1. The root cause is weak access control that can allow a low-privilege local user with shell access to execute arbitra...

CVE-2022-39953

A improper privilege management in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.6, FortiNAC version 9.1.0 through 9.1.8, FortiNAC all versions 8.8, FortiNAC all versions 8.7, FortiNAC all versions 8.6, FortiNAC all versions 8.5, FortiNAC version 8.3.7 allows...

CVE-2022-39951

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specifically crafted HTTP...

CVE-2022-39951

FortiWeb is affected by an OS command injection vulnerability (CVE-2022-39951) in Fortinet FortiWeb versions 7.0.0–7.0.2, 6.3.6–6.3.20, and 6.4 all versions. The issue is described as improper neutralization of special elements used in an OS command, enabling an attacker to execute unauthorized c...

CVE-2023-25611

Fortinet FortiAnalyzer is affected by a CSV file vulnerability (CVE-2023-25611) allowing a local attacker to execute unauthorized code by inserting spreadsheet formulas in macro names. Affected versions: 6.4.0–6.4.9, 7.0.0–7.0.5, and 7.2.0–7.2.1. Mitigation: upgrade to a FortiAnalyzer version out...

CVE-2023-25611

A improper neutralization of formula elements in a CSV file vulnerability in Fortinet FortiAnalyzer 6.4.0 - 6.4.9, 7.0.0 - 7.0.5, and 7.2.0 - 7.2.1 allows local attacker to execute unauthorized code or commands via inserting spreadsheet formulas in macro names...

CVE-2023-25605

A improper access control vulnerability in Fortinet FortiSOAR 7.3.0 - 7.3.1 allows an attacker authenticated on the administrative interface to perform unauthorized actions via crafted HTTP requests...

CVE-2023-25605

Summary: CVE-2023-25605 affects Fortinet FortiSOAR 7.3.0–7.3.1 and is due to an improper access control flaw in the administrative interface. An attacker authenticated to the admin interface can perform unauthorized actions by sending crafted HTTP requests. Multiple connected sources corroborate ...

CVE-2023-25605

A improper access control vulnerability in Fortinet FortiSOAR 7.3.0 - 7.3.1 allows an attacker authenticated on the administrative interface to perform unauthorized actions via crafted HTTP requests...