Crafter CMS SQL注入漏洞

Crafter CMS is an open source content management system CMS for digital experience applications. Crafter CMS suffers from a security vulnerability that stems from an improper neutralization of a particular element used, resulting in a SQL injection vulnerability...

Input validation

Improper neutralization in the IntelR EMA software before version 1.8.1.0 may allow a privileged user to potentially enable escalation of privilege via network access...

Input validation

Improper neutralization in the IntelR Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-22638

Several improper neutralization of inputs during web page generation vulnerability CWE-79 in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and below, 8.7.6 and below, 8.6.5 and below, 8.5.4 and below, 8.3.7 and below may allow an authenticated attacker to perform several XSS...

CVE-2023-22638

Several improper neutralization of inputs during web page generation vulnerability CWE-79 in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and below, 8.7.6 and below, 8.6.5 and below, 8.5.4 and below, 8.3.7 and below may allow an authenticated attacker to perform several XSS...

CVE-2022-27489

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiExtender 7.0.0 through 7.0.3, 5.3.2, 4.2.4 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests...

CVE-2022-30304

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8 may allow a remote unauthenticated attacker to perform a stored cross site scripting XSS attack via the URL parameter observed in the FortiWeb attack event...

Cross site scripting

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8 may allow a remote unauthenticated attacker to perform a stored cross site scripting XSS attack via the URL parameter observed in the FortiWeb attack event...

Design/Logic Flaw

Several improper neutralization of inputs during web page generation vulnerability CWE-79 in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and below, 8.7.6 and below, 8.6.5 and below, 8.5.4 and below, 8.3.7 and below may allow an authenticated attacker to perform several XSS...

Command injection

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the management interface of FortiWAN 4.0.0 through 4.5.9 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...

CVE-2023-22638

Several improper neutralization of inputs during web page generation vulnerability CWE-79 in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and below, 8.7.6 and below, 8.6.5 and below, 8.5.4 and below, 8.3.7 and below may allow an authenticated attacker to perform several XSS...

CVE-2022-27482

Fortinet FortiADC is affected by CVE-2022-27482 due to improper neutralization of special elements in OS commands, enabling local attackers to run arbitrary shell code as root via CLI. Affected versions span 7.0.0–7.0.1, 6.2.0–6.2.2, 6.1.0–6.1.6, 6.0.x, and 5.x.x. The underlying issue is an OS co...

CVE-2022-41334

An improper neutralization of input during web page generation CWE-79 vulnerability in FortiOS versions 7.0.0 to 7.0.7 and 7.2.0 to 7.2.3 may allow a remote, unauthenticated attacker to launch a cross site scripting XSS attack via the "redir" parameter of the URL seen when the "Sign in with...

CVE-2022-41334

An improper neutralization of input during web page generation CWE-79 vulnerability in FortiOS versions 7.0.0 to 7.0.7 and 7.2.0 to 7.2.3 may allow a remote, unauthenticated attacker to launch a cross site scripting XSS attack via the "redir" parameter of the URL seen when the "Sign in with...

CVE-2022-41334

CVE-2022-41334 is an XSS vulnerability in Fortinet FortiOS and FortiProxy that arises from improper neutralization of user input during web page generation. Affected FortiOS versions are 7.0.0–7.0.7 and 7.2.0–7.2.3; exploitation can occur via the redir parameter in the FortiCloud sign-in flow by ...

CVE-2022-30304

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8 may allow a remote unauthenticated attacker to perform a stored cross site scripting XSS attack via the URL parameter observed in the FortiWeb attack event...

Fortinet FortiNAC 跨站脚本漏洞

Fortinet FortiNAC is a set of network access control solutions from the U.S. company Fita Fortinet. The product is primarily used for network access control and IoT security. Fortinet FortiNAC has a security vulnerability that originates from improper input neutralization, which can be exploited ...

Protect

An improper neutralization of input during web page generation CWE-79 vulnerability in FortiOS may allow a remote, unauthenticated attacker to launch a cross site scripting XSS attack via the "redir" parameter of the URL seen when the "Sign in with FortiCloud" button is clicked. Â...

PT-2023-13576 · Intel · Intel Ema

Name of the Vulnerable Software and Affected Versions: IntelR EMA software versions prior to 1.8.1.0 Description: The issue is related to improper neutralization in the IntelR EMA software, which may allow a privileged user to potentially enable escalation of privilege via network access...

FortiWAN - Command injection vulnerability

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the management interface of FortiWAN may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...