Filtered by vendor Fortinet
Subscribe
Total
548 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-42757 | 1 Fortinet | 4 Fortianalyzer, Fortimanager, Fortios and 1 more | 2021-12-09 | 4.6 MEDIUM | 6.7 MEDIUM |
| A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments. | |||||
| CVE-2021-43067 | 1 Fortinet | 1 Fortiauthenticator | 2021-12-09 | 4.3 MEDIUM | 6.5 MEDIUM |
| A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.2 and below, version 6.2.1 and below, version 6.1.2 and below, version 6.0.7 to 6.0.1 allows attacker to duplicate a target LDAP user 2 factors authentication token via crafted HTTP requests. | |||||
| CVE-2021-32592 | 1 Fortinet | 2 Forticlient, Forticlient Enterprise Management Server | 2021-12-02 | 6.9 MEDIUM | 7.8 HIGH |
| An unsafe search path vulnerability in FortiClientWindows 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x and FortiClientEMS 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x may allow an attacker to perform a DLL Hijack attack on affected devices via a malicious OpenSSL engine library in the search path. | |||||
| CVE-2021-32600 | 1 Fortinet | 1 Fortios | 2021-11-18 | 2.1 LOW | 3.8 LOW |
| An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS CLI 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, 6.0.x and 5.6.x may allow a local and authenticated user assigned to a specific VDOM to retrieve other VDOMs information such as the admin account list and the network interface list. | |||||
| CVE-2021-24018 | 1 Fortinet | 1 Fortios | 2021-11-16 | 5.8 MEDIUM | 8.8 HIGH |
| A buffer underwrite vulnerability in the firmware verification routine of FortiOS before 7.0.1 may allow an attacker located in the adjacent network to potentially execute arbitrary code via a specifically crafted firmware image. | |||||
| CVE-2021-41019 | 1 Fortinet | 1 Fortios | 2021-11-04 | 4.3 MEDIUM | 6.5 MEDIUM |
| An improper validation of certificate with host mismatch [CWE-297] vulnerability in FortiOS versions 6.4.6 and below may allow the connection to a malicious LDAP server via options in GUI, leading to disclosure of sensitive information, such as AD credentials. | |||||
| CVE-2021-36176 | 1 Fortinet | 1 Fortiportal | 2021-11-04 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a denial of service via multiple HTTP requests. | |||||
| CVE-2021-36181 | 1 Fortinet | 1 Fortiportal | 2021-11-04 | 3.5 LOW | 3.1 LOW |
| A concurrent execution using shared resource with improper Synchronization vulnerability ('Race Condition') in the customer database interface of FortiPortal before 6.0.6 may allow an authenticated, low-privilege user to bring the underlying database data into an inconsistent state via specific coordination of web requests. | |||||
| CVE-2020-15935 | 1 Fortinet | 1 Fortiadc | 2021-11-04 | 4.0 MEDIUM | 4.3 MEDIUM |
| A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and below may allow a remote authenticated attacker to retrieve some sensitive information such as users LDAP passwords and RADIUS shared secret by deobfuscating the passwords entry fields. | |||||
| CVE-2021-36174 | 1 Fortinet | 1 Fortiportal | 2021-11-04 | 5.0 MEDIUM | 7.5 HIGH |
| A memory allocation with excessive size value vulnerability in the license verification function of FortiPortal before 6.0.6 may allow an attacker to perform a denial of service attack via specially crafted license blobs. | |||||
| CVE-2021-36184 | 1 Fortinet | 1 Fortiwlm | 2021-11-04 | 4.0 MEDIUM | 6.5 MEDIUM |
| A improper neutralization of Special Elements used in an SQL Command ('SQL Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclosure device, users and database information via crafted HTTP requests. | |||||
| CVE-2021-36186 | 1 Fortinet | 1 Fortiweb | 2021-11-04 | 7.5 HIGH | 9.8 CRITICAL |
| A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests | |||||
| CVE-2021-36187 | 1 Fortinet | 1 Fortiweb | 2021-11-04 | 5.0 MEDIUM | 7.5 HIGH |
| A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to cause a denial of service for webserver daemon via crafted HTTP requests | |||||
| CVE-2021-41022 | 2 Fortinet, Microsoft | 2 Fortisiem, Windows | 2021-11-04 | 4.6 MEDIUM | 7.8 HIGH |
| A improper privilege management in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows attacker to execute privileged code or commands via powershell scripts | |||||
| CVE-2021-42754 | 1 Fortinet | 1 Forticlient | 2021-11-04 | 3.5 LOW | 5.0 MEDIUM |
| An improper control of generation of code vulnerability [CWE-94] in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and below may allow an authenticated attacker to hijack the MacOS camera without the user permission via the malicious dylib file. | |||||
| CVE-2021-36185 | 1 Fortinet | 1 Fortiwlm | 2021-11-04 | 6.5 MEDIUM | 8.8 HIGH |
| A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests. | |||||
| CVE-2020-15940 | 1 Fortinet | 1 Forticlient Enterprise Management Server | 2021-11-04 | 3.5 LOW | 5.4 MEDIUM |
| An improper neutralization of input vulnerability [CWE-79] in FortiClientEMS versions 6.4.1 and below and 6.2.9 and below may allow a remote authenticated attacker to inject malicious script/tags via the name parameter of various sections of the server. | |||||
| CVE-2021-36172 | 1 Fortinet | 1 Fortiportal | 2021-11-04 | 6.4 MEDIUM | 8.1 HIGH |
| An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who controls the producer of XML reports consumed by FortiPortal to trigger a denial of service or read arbitrary files from the underlying file system by means of specifically crafted XML documents. | |||||
| CVE-2021-32595 | 1 Fortinet | 1 Fortiportal | 2021-11-03 | 4.0 MEDIUM | 6.5 MEDIUM |
| Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a denial of service via multiple HTTP requests. | |||||
| CVE-2021-26107 | 1 Fortinet | 1 Fortimanager | 2021-11-03 | 4.0 MEDIUM | 4.3 MEDIUM |
| An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a restricted user profile to modify the VPN tunnel status of other VDOMs using VPN Manager. | |||||