Filtered by vendor Fortinet
Subscribe
Total
717 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-41023 | 2 Fortinet, Microsoft | 2 Fortisiem, Windows | 2022-05-03 | 2.1 LOW | 5.5 MEDIUM |
| A unprotected storage of credentials in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows an authenticated user to disclosure agent password due to plaintext credential storage in log files | |||||
| CVE-2021-36192 | 1 Fortinet | 1 Fortimanager | 2022-05-03 | 2.1 LOW | 3.8 LOW |
| An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiManager 7.0.1 and below, 6.4.6 and below, 6.2.x, 6.0.x, 5.6.0 may allow a FortiGate user to see scripts from other ADOMS. | |||||
| CVE-2019-5587 | 1 Fortinet | 1 Fortios | 2022-04-22 | 4.0 MEDIUM | 6.5 MEDIUM |
| Lack of root file system integrity checking in Fortinet FortiOS VM application images all versions below 6.0.5 may allow attacker to implant malicious programs into the installing image by reassembling the image through specific methods. | |||||
| CVE-2022-23440 | 1 Fortinet | 1 Fortiedr | 2022-04-14 | 4.6 MEDIUM | 7.8 HIGH |
| A use of hard-coded cryptographic key vulnerability [CWE-321] in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow a local attacker to disable and uninstall the collectors from the end-points within the same deployment. | |||||
| CVE-2021-44169 | 1 Fortinet | 1 Forticlient | 2022-04-14 | 4.6 MEDIUM | 8.8 HIGH |
| A improper initialization in Fortinet FortiClient (Windows) version 6.0.10 and below, version 6.2.9 and below, version 6.4.7 and below, version 7.0.3 and below allows attacker to gain administrative privileges via placing a malicious executable inside the FortiClient installer's directory. | |||||
| CVE-2021-43205 | 1 Fortinet | 1 Forticlient | 2022-04-13 | 5.0 MEDIUM | 5.3 MEDIUM |
| An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Linux version 7.0.2 and below, 6.4.7 and below and 6.2.9 and below may allow an unauthenticated attacker to access the confighandler webserver via external binaries. | |||||
| CVE-2021-32593 | 1 Fortinet | 1 Fortiwan | 2022-04-13 | 6.4 MEDIUM | 6.5 MEDIUM |
| A use of a broken or risky cryptographic algorithm vulnerability [CWE-327] in the Dynamic Tunnel Protocol of FortiWAN before 4.5.9 may allow an unauthenticated remote attacker to decrypt and forge protocol communication messages. | |||||
| CVE-2021-26114 | 1 Fortinet | 1 Fortiwan | 2022-04-13 | 7.5 HIGH | 9.8 CRITICAL |
| Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiWAN before 4.5.9 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. | |||||
| CVE-2021-26112 | 1 Fortinet | 1 Fortiwan | 2022-04-13 | 7.5 HIGH | 9.8 CRITICAL |
| Multiple stack-based buffer overflow vulnerabilities [CWE-121] both in network daemons and in the command line interpreter of FortiWAN before 4.5.9 may allow an unauthenticated attacker to potentially corrupt control data in memory and execute arbitrary code via specifically crafted requests. | |||||
| CVE-2021-24009 | 1 Fortinet | 1 Fortiwan | 2022-04-13 | 9.0 HIGH | 8.8 HIGH |
| Multiple improper neutralization of special elements used in an OS command vulnerabilities (CWE-78) in the Web GUI of FortiWAN before 4.5.9 may allow an authenticated attacker to execute arbitrary commands on the underlying system's shell via specifically crafted HTTP requests. | |||||
| CVE-2022-23446 | 1 Fortinet | 1 Fortiedr | 2022-04-13 | 2.1 LOW | 4.4 MEDIUM |
| A improper control of a resource through its lifetime in Fortinet FortiEDR version 5.0.3 and earlier allows attacker to make the whole application unresponsive via changing its root directory access permission. | |||||
| CVE-2021-41026 | 1 Fortinet | 1 Fortiweb | 2022-04-13 | 4.0 MEDIUM | 6.5 MEDIUM |
| A relative path traversal in FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests. | |||||
| CVE-2022-23441 | 1 Fortinet | 1 Fortiedr | 2022-04-13 | 6.4 MEDIUM | 9.1 CRITICAL |
| A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiEDR versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow an unauthenticated attacker on the network to disguise as and forge messages from other collectors. | |||||
| CVE-2021-32585 | 1 Fortinet | 1 Fortiwan | 2022-04-13 | 4.3 MEDIUM | 6.1 MEDIUM |
| An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiWAN before 4.5.9 may allow an attacker to perform a stored cross-site scripting attack via specifically crafted HTTP requests. | |||||
| CVE-2021-22127 | 1 Fortinet | 1 Forticlient | 2022-04-13 | 7.9 HIGH | 8.0 HIGH |
| An improper input validation vulnerability in FortiClient for Linux 6.4.x before 6.4.3, FortiClient for Linux 6.2.x before 6.2.9 may allow an unauthenticated attacker to execute arbitrary code on the host operating system as root via tricking the user into connecting to a network with a malicious name. | |||||
| CVE-2021-26116 | 1 Fortinet | 1 Fortiauthenticator | 2022-04-13 | 6.5 MEDIUM | 8.8 HIGH |
| An improper neutralization of special elements used in an OS command vulnerability in the command line interpreter of FortiAuthenticator before 6.3.1 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands. | |||||
| CVE-2020-29013 | 1 Fortinet | 1 Fortisandbox | 2022-04-13 | 5.5 MEDIUM | 5.4 MEDIUM |
| An improper input validation vulnerability in the sniffer interface of FortiSandbox before 3.2.2 may allow an authenticated attacker to silently halt the sniffer via specifically crafted requests. | |||||
| CVE-2021-26113 | 1 Fortinet | 1 Fortiwan | 2022-04-13 | 5.0 MEDIUM | 7.5 HIGH |
| A use of a one-way hash with a predictable salt vulnerability [CWE-760] in FortiWAN before 4.5.9 may allow an attacker who has previously come in possession of the password file to potentially guess passwords therein stored. | |||||
| CVE-2019-15703 | 1 Fortinet | 1 Fortios | 2022-03-31 | 2.6 LOW | 7.5 HIGH |
| An Insufficient Entropy in PRNG vulnerability in Fortinet FortiOS 6.2.1, 6.2.0, 6.0.8 and below for device not enable hardware TRNG token and models not support builtin TRNG seed allows attacker to theoretically recover the long term ECDSA secret in a TLS client with a RSA handshake and mutual ECDSA authentication via the help of flush+reload side channel attacks in FortiGate VM models only. | |||||
| CVE-2021-26089 | 1 Fortinet | 1 Forticlient | 2022-03-30 | 7.2 HIGH | 7.8 HIGH |
| An improper symlink following in FortiClient for Mac 6.4.3 and below may allow an non-privileged user to execute arbitrary privileged shell commands during installation phase. | |||||