CVE-2021-22123

CVE-2021-22123 is an authenticated OS command injection vulnerability in FortiWeb’s management interface. It affects FortiWeb versions including 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, and 5.9.x, enabling a remote authenticated attacker to run arbitrary commands on the device via the SAML...

CVE-2021-22123: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated attacker to execute arbitrary commands on the system via the SAML server configuration page...

Fortinet FortiWeb 操作系统命令注入漏洞

FortiWeb is a Web Application Firewall WAF that protects hosted web applications from attacks targeting known and unknown vulnerabilities. An OS command injection vulnerability exists in the management interface of FortiWeb. A remote authenticated attacker could exploit this vulnerability to...

PT-2021-3437

Name of the Vulnerable Software and Affected Versions FortiWeb versions 6.3.7 and below FortiWeb versions 6.2.3 and below FortiWeb versions 6.1.x FortiWeb versions 6.0.x FortiWeb versions 5.9.x Description The issue is an OS command injection vulnerability in FortiWeb's management interface. This...

PT-2021-6932

Name of the Vulnerable Software and Affected Versions Elcomplus SmartPTT affected versions not specified Description The issue is related to the injection of JavaScript code into a specific parameter, which can be executed when accessing the dashboard or the main page. This can allow a remote...

Design/Logic Flaw

In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system administrator is able to view sensitive values by visiting a server configuration page or making an API call...

CVE-2019-14525: Undefined Security Weakness

In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system administrator is able to view sensitive values by visiting a server configuration page or making an API call...