Command injection

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to...

Input validation

A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version 6.0.11 and below, version 5.6.13 and below allows attacker to disclose sensitive information via SNI Client Hello TLS packets...

Sql injection

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the AP...

CVE-2021-43077

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the AP...

CVE-2021-43077

FortiWLM SQL Injection (CVE-2021-43077) arises from improper neutralization of SQL in the AP monitor handlers. Affects Fortinet FortiWLM versions 8.6.2 and earlier, 8.5.2 and earlier, 8.4.2 and earlier, and 8.3.2 and earlier. An attacker can exploit this via crafted HTTP requests to AP monitor ha...

CVE-2021-43077

A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the AP...

CVE-2020-15936

Fortinet FortiGate has a CVE-2020-15936 vulnerability due to improper input validation that enables disclosure of sensitive information via SNI Client Hello TLS packets. Affected versions are FortiGate 6.4.3 and below, 6.2.5 and below, 6.0.11 and below, and 5.6.13 and below. The issue is document...

CVE-2022-22300

A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.11, FortiAnalyzer version 6.2.0 through 6.2.9, FortiAnalyzer version 6.4.0 through 6.4.7, FortiAnalyzer version 7.0.0 through 7 .0.2,...

CVE-2022-22300

CVE-2022-22300 affects Fortinet FortiAnalyzer and FortiManager across multiple release lines (FortiAnalyzer 5.6.0–5.6.11, 6.0.0–6.0.11, 6.2.0–6.2.9, 6.4.0–6.4.7, 7.0.0–7.0.2; FortiManager 5.6.0–5.6.11, 6.0.0–6.0.11, 6.2.0–6.2.9, 6.4.0–6.4.7, 7.0.0–7.0.2). The root cause is improper handling of in...

CVE-2022-22300

A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.11, FortiAnalyzer version 6.2.0 through 6.2.9, FortiAnalyzer version 6.4.0 through 6.4.7, FortiAnalyzer version 7.0.0 through 7 .0.2,...

CVE-2021-43075

CVE-2021-43075 affects Fortinet FortiWLM (FortiWLM) where an improper neutralization of special elements used in OS commands allows an attacker to execute arbitrary commands via crafted HTTP requests to the alarm dashboard and controller configuration handlers. Affected versions include 8.6.2 and...

CVE-2021-43075

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to...

CVE-2021-43075

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to...

Fortinet FortiGate 输入验证错误漏洞

Fortinet FortiGate, a next-generation firewall product developed by Fortinet, is vulnerable to an input validation error that could be exploited to disclose sensitive information via SNI client Hello TLS packets...

Fortinet FortiWLM SQL注入漏洞

Fortinet FortiWLC is a wireless LAN controller from Fortinet, Inc. An SQL injection vulnerability exists in Fortinet FortiWLC, which stems from insufficient cleaning of user-supplied data in the AP monitoring handler, and could be exploited to send specially crafted requests to affected...

Fortinet FortiWLM 操作系统命令注入漏洞

A command injection vulnerability exists in Fortinet FortiWLC, a wireless LAN controller from Fortinet, which stems from a failure to properly validate input data in the alert dashboard and controller configuration handler. HTTP requests and execute arbitrary operating system commands on the targ...

Fortinet FortiPortal 安全特征问题漏洞

Fortinet FortiPortal is an advanced, feature-rich managed security analysis and management support tool for Fortinet's FortiGate, FortiWiFi, and FortiAP product lines, available as a virtual machine for use by MSPs. versions, a security feature issue vulnerability exists that stems from the use o...

Fortinet FortiGate 信息泄露漏洞

Fortinet FortiGate is a network security platform from Fortinet, Inc. The platform provides firewall, anti-virus and intrusion prevention IPS, application control, anti-spam, wireless controller, and WAN acceleration.Fortinet fortimanager has an access control error vulnerability that is caused b...

Fortinet FortiOS 7.0.x < 7.0.2 Path Traversal (FG-IR-21-181)

The remote host is running a version of FortiOS that is 7.0.x prior to 7.0.2. It is, therefore, affected by a path traversal vulnerability that may allow an unauthenticated, unauthorized attacker to inject path traversal character sequences to disclose sensitive information of the server via the...

Iranian Hackers Targeting VMware Horizon Log4j Flaws to Deploy Ransomware

A "potentially destructive actor" aligned with the government of Iran is actively exploiting the well-known Log4j vulnerability to infect unpatched VMware Horizon servers with ransomware. Cybersecurity firm SentinelOne dubbed the group "TunnelVision" owing to their heavy reliance on tunneling...