Filtered by vendor Fortinet
Subscribe
Total
548 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-36195 | 1 Fortinet | 1 Fortiweb | 2021-12-10 | 9.0 HIGH | 8.8 HIGH |
| Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, and 6.1.0 through 6.1.2 may allow an authenticated attacker to execute arbitrary commands on the underlying system shell via specially crafted command arguments. | |||||
| CVE-2021-36189 | 1 Fortinet | 1 Forticlient Enterprise Management Server | 2021-12-10 | 4.0 MEDIUM | 4.9 MEDIUM |
| A missing encryption of sensitive data in Fortinet FortiClientEMS version 7.0.1 and below, version 6.4.4 and below allows attacker to information disclosure via inspecting browser decrypted data | |||||
| CVE-2021-43204 | 1 Fortinet | 1 Forticlient | 2021-12-10 | 4.9 MEDIUM | 4.4 MEDIUM |
| A improper control of a resource through its lifetime in Fortinet FortiClientWindows version 6.4.1 and 6.4.0, version 6.2.9 and below, version 6.0.10 and below allows attacker to cause a complete denial of service of its components via changes of directory access permissions. | |||||
| CVE-2021-41017 | 1 Fortinet | 1 Fortiweb | 2021-12-10 | 6.5 MEDIUM | 8.8 HIGH |
| Multiple heap-based buffer overflow vulnerabilities in some web API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow a remote authenticated attacker to execute arbitrary code or commands via specifically crafted HTTP requests. | |||||
| CVE-2021-36194 | 1 Fortinet | 1 Fortiweb | 2021-12-10 | 6.5 MEDIUM | 8.8 HIGH |
| Multiple stack-based buffer overflows in the API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted requests. | |||||
| CVE-2021-43071 | 1 Fortinet | 1 Fortiweb | 2021-12-10 | 6.5 MEDIUM | 8.8 HIGH |
| A heap-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the LogReport API controller. | |||||
| CVE-2021-43068 | 1 Fortinet | 1 Fortiauthenticator | 2021-12-10 | 5.5 MEDIUM | 8.1 HIGH |
| A improper authentication in Fortinet FortiAuthenticator version 6.4.0 allows user to bypass the second factor of authentication via a RADIUS login portal. | |||||
| CVE-2021-42760 | 1 Fortinet | 1 Fortiwlm | 2021-12-09 | 7.5 HIGH | 8.8 HIGH |
| A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose sensitive information from DB tables via crafted requests. | |||||
| CVE-2021-26103 | 1 Fortinet | 2 Fortios, Fortiproxy | 2021-12-09 | 5.1 MEDIUM | 8.8 HIGH |
| An insufficient verification of data authenticity vulnerability (CWE-345) in the user interface of FortiProxy verison 2.0.3 and below, 1.2.11 and below and FortiGate verison 7.0.0, 6.4.6 and below, 6.2.9 and below of SSL VPN portal may allow a remote, unauthenticated attacker to conduct a cross-site request forgery (CSRF) attack . Only SSL VPN in web mode or full mode are impacted by this vulnerability. | |||||
| CVE-2021-26109 | 1 Fortinet | 1 Fortios | 2021-12-09 | 7.5 HIGH | 9.8 CRITICAL |
| An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt control data on the heap via specifically crafted requests to SSLVPN, resulting in potentially arbitrary code execution. | |||||
| CVE-2021-26108 | 1 Fortinet | 1 Fortios | 2021-12-09 | 5.0 MEDIUM | 7.5 HIGH |
| A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS before 7.0.1 may allow an attacker to retrieve the key by reverse engineering. | |||||
| CVE-2021-36190 | 1 Fortinet | 1 Fortiweb | 2021-12-09 | 6.5 MEDIUM | 6.3 MEDIUM |
| A unintended proxy or intermediary ('confused deputy') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to access protected hosts via crafted HTTP requests. | |||||
| CVE-2021-41027 | 1 Fortinet | 1 Fortiweb | 2021-12-09 | 4.6 MEDIUM | 7.8 HIGH |
| A stack-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, allows an authenticated attacker to execute unauthorized code or commands via crafted certificates loaded into the device. | |||||
| CVE-2021-43063 | 1 Fortinet | 1 Fortiweb | 2021-12-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the login webpage. | |||||
| CVE-2021-41015 | 1 Fortinet | 1 Fortiweb | 2021-12-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to SAML login handler | |||||
| CVE-2021-41014 | 1 Fortinet | 1 Fortiweb | 2021-12-09 | 5.0 MEDIUM | 7.5 HIGH |
| A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to make the httpsd daemon unresponsive via huge HTTP packets | |||||
| CVE-2021-42752 | 1 Fortinet | 1 Fortiwlm | 2021-12-09 | 3.5 LOW | 5.4 MEDIUM |
| A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute malicious javascript code on victim's host via crafted HTTP requests | |||||
| CVE-2021-41029 | 1 Fortinet | 1 Fortiwlm | 2021-12-09 | 3.5 LOW | 5.4 MEDIUM |
| A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWLM version 8.6.1 and below allows attacker to store malicious javascript code in the device and trigger it via crafted HTTP requests | |||||
| CVE-2021-41024 | 1 Fortinet | 2 Fortios, Fortiproxy | 2021-12-09 | 5.0 MEDIUM | 7.5 HIGH |
| A relative path traversal [CWE-23] vulnerabiltiy in FortiOS versions 7.0.0 and 7.0.1 and FortiProxy verison 7.0.0 may allow an unauthenticated, unauthorized attacker to inject path traversal character sequences to disclose sensitive information of the server via the GET request of the login page. | |||||
| CVE-2021-43064 | 1 Fortinet | 1 Fortiweb | 2021-12-09 | 5.8 MEDIUM | 6.1 MEDIUM |
| A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to use the device as a proxy and reach external or protected hosts via redirection handlers. | |||||