Fortinet
Page 10 of 11 — Fortinet CVEs from a corpus of 1081, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-17655 | Medium | 5.3 | 2020-06-16 | A cleartext storage in a file or on disk (CWE-313) vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.0.0, 1.2.9 and earl… |
CVE-2020-9292 | Critical | 9.8 | 2020-06-04 | An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the AoWinAgt executable s… |
CVE-2020-6640 | Medium | 5.4 | 2020-06-04 | An improper neutralization of input vulnerability in the Admin Profile of FortiAnalyzer may allow a remote authenticated attacker to perform a stored cross sit… |
CVE-2019-16150 | Medium | 5.5 | 2020-06-04 | Use of a hard-coded cryptographic key to encrypt security sensitive data in local storage and configuration in FortiClient for Windows prior to 6.4.0 may allow… |
CVE-2020-9291 | Medium | 6.3 | 2020-06-01 | An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain elevated privileges via exhausting the pool… |
CVE-2019-15709 | Medium | 6.5 | 2020-06-01 | An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators… |
CVE-2020-9294 | Critical | 9.8 | 2020-04-27 | An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthentica… |
CVE-2020-9286 | Medium | 6.5 | 2020-04-07 | An improper authorization vulnerability in FortiADC may allow a remote authenticated user with low privileges to perform certain actions such as rebooting the… |
CVE-2020-6647 | Medium | 5.4 | 2020-04-07 | An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to perform a cross site scripting attack (XS… |
CVE-2019-17657 | High | 7.5 | 2020-04-07 | An Uncontrolled Resource Consumption vulnerability in Fortinet FortiSwitch below 3.6.11, 6.0.6 and 6.2.2, FortiAnalyzer below 6.2.3, FortiManager below 6.2.3 a… |
CVE-2018-13371 | High | 8.8 | 2020-04-02 | An external control of system vulnerability in FortiOS may allow an authenticated, regular user to change the routing settings of the device via connecting to… |
CVE-2014-2723 | High | 8.8 | 2020-03-19 | In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged… |
CVE-2014-2722 | High | 8.8 | 2020-03-19 | In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged… |
CVE-2014-2721 | High | 8.8 | 2020-03-19 | In FortiBalancer 400, 1000, 2000 and 3000, a platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged… |
CVE-2020-6646 | Medium | 5.4 | 2020-03-17 | An improper neutralization of input vulnerability in FortiWeb allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via… |
CVE-2019-6696 | Medium | 6.1 | 2020-03-15 | An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may allow an attacker to perform an URL redir… |
CVE-2019-17654 | High | 8.8 | 2020-03-15 | An Insufficient Verification of Data Authenticity vulnerability in FortiManager 6.2.1, 6.2.0, 6.0.6 and below may allow an unauthenticated attacker to perform… |
CVE-2019-15708 | Medium | 6.7 | 2020-03-15 | A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin c… |
CVE-2020-9290 | High | 7.8 | 2020-03-15 | An Unsafe Search Path vulnerability in FortiClient for Windows online installer 6.2.3 and below may allow a local attacker with control over the directory in w… |
CVE-2020-9287 | High | 7.8 | 2020-03-15 | An Unsafe Search Path vulnerability in FortiClient EMS online installer 6.2.1 and below may allow a local attacker with control over the directory in which For… |
CVE-2019-6699 | Medium | 5.4 | 2020-03-13 | An improper neutralization of input vulnerability in Fortinet FortiADC 5.3.3 and earlier may allow an attacker to execute a stored Cross Site Scripting (XSS) v… |
CVE-2019-16157 | Medium | 6.5 | 2020-03-13 | An information exposure vulnerability in Fortinet FortiWeb 6.2.0 CLI and earlier may allow an authenticated user to view sensitive information being logged via… |
CVE-2019-17653 | High | 8.8 | 2020-03-12 | A Cross-Site Request Forgery (CSRF) vulnerability in the user interface of Fortinet FortiSIEM 5.2.5 could allow a remote, unauthenticated attacker to perform a… |
CVE-2020-6643 | Medium | 5.4 | 2020-03-12 | An improper neutralization of input vulnerability in the URL Description in Fortinet FortiIsolator version 1.2.2 allows a remote authenticated attacker to perf… |
CVE-2019-17658 | Critical | 9.8 | 2020-03-12 | An unquoted service path vulnerability in the FortiClient FortiTray component of FortiClientWindows v6.2.2 and prior allow an attacker to gain elevated privile… |
CVE-2019-16156 | Medium | 6.1 | 2020-03-12 | An Improper Neutralization of Input vulnerability in the Anomaly Detection Parameter Name in Fortinet FortiWeb 6.0.5, 6.2.0, and 6.1.1 may allow a remote unaut… |
CVE-2019-16155 | High | 7.1 | 2020-02-07 | A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to overwrite system files as root with arbitr… |
CVE-2019-17652 | Medium | 6.5 | 2020-02-06 | A stack buffer overflow vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to cause FortiClient processes running under… |
CVE-2019-16152 | Medium | 6.5 | 2020-02-06 | A Denial of service (DoS) vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to cause FortiClient processes running un… |
CVE-2019-15711 | High | 7.8 | 2020-02-06 | A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to run system commands under root privilege… |
CVE-2015-3613 | Critical | 9.8 | 2020-02-04 | A vulnerability exists in in FortiManager 5.2.1 and earlier and 5.0.10 and earlier in the WebUI FTP backup page |
CVE-2015-3612 | Medium | 5.4 | 2020-02-04 | A Cross-site Scripting (XSS) vulnerability exists in FortiManager 5.2.1 and earlier and 5.0.10 and earlier via an unspecified parameter in the FortiWeb auto up… |
CVE-2015-3611 | High | 8.8 | 2020-02-04 | A Command Injection vulnerability exists in FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier via unspecified vectors, which could let a malic… |
CVE-2019-17651 | Medium | 5.4 | 2020-01-28 | An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Schedule in FortiSIEM version 5.2.5 and below… |
CVE-2019-15712 | High | 7.2 | 2020-01-23 | An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they s… |
CVE-2019-15707 | Medium | 4.9 | 2020-01-23 | An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup con… |
CVE-2019-5593 | Medium | 5.5 | 2020-01-23 | Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plaint text private keys of system's builti… |
CVE-2019-16153 | Critical | 9.8 | 2020-01-23 | A hard-coded password vulnerability in the Fortinet FortiSIEM database component version 5.2.5 and below may allow attackers to access the device database via… |
CVE-2019-6700 | Medium | 6.5 | 2020-01-07 | An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated attacker to retriev… |
CVE-2019-16154 | Medium | 6.1 | 2020-01-07 | An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6.0.0 may allow an unauthenticated user to perform a cross-site scr… |
CVE-2019-15705 | High | 7.5 | 2019-11-27 | An Improper Input Validation vulnerability in the SSL VPN portal of FortiOS versions 6.2.1 and below, and 6.0.6 and below may allow an unauthenticated remote a… |
CVE-2019-6693 | Medium | 6.5 | 2019-11-21 | Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to dec… |
CVE-2019-17650 | High | 7.8 | 2019-11-21 | An Improper Neutralization of Special Elements used in a Command vulnerability in one of FortiClient for Mac OS root processes, may allow a local user of the s… |
CVE-2019-15704 | Medium | 5.5 | 2019-11-21 | A clear text storage of sensitive information vulnerability in FortiClient for Mac may allow a local attacker to read sensitive information logged in the conso… |
CVE-2018-9195 | Medium | 5.9 | 2019-11-21 | Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on… |
CVE-2019-15710 | High | 7.2 | 2019-10-31 | An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized administrators to run arb… |
CVE-2019-6692 | High | 7.8 | 2019-10-24 | A malicious DLL preload vulnerability in Fortinet FortiClient for Windows 6.2.0 and below allows a privileged attacker to perform arbitrary code execution via… |
CVE-2019-15703 | High | 7.5 | 2019-10-24 | An Insufficient Entropy in PRNG vulnerability in Fortinet FortiOS 6.2.1, 6.2.0, 6.0.8 and below for device not enable hardware TRNG token and models not suppor… |
CVE-2019-5590 | Medium | 6.1 | 2019-08-28 | The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands (Cr… |
CVE-2019-6695 | Critical | 9.8 | 2019-08-23 | Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-par… |
CVE-2019-5594 | Medium | 6.1 | 2019-08-23 | An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an… |
CVE-2018-13367 | Medium | 5.3 | 2019-08-23 | An information exposure vulnerability in FortiOS 6.2.3, 6.2.0 and below may allow an unauthenticated attacker to gain platform information such as version, mod… |
CVE-2019-6698 | Critical | 9.8 | 2019-08-23 | Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated attacker with knowledge of the aforementione… |
CVE-2019-5592 | Medium | 5.9 | 2019-08-23 | Multiple padding oracle vulnerabilities (Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length) in the CBC padding implementation of FortiOS IPS engine version 5.000 t… |
CVE-2019-13402 | High | 8.8 | 2019-07-08 | /usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset p… |
CVE-2019-13401 | High | 8.8 | 2019-07-08 | Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/. |
CVE-2019-13400 | Critical | 9.8 | 2019-07-08 | Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via… |
CVE-2019-13399 | Medium | 5.9 | 2019-07-08 | Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator's SSL conversation. |
CVE-2019-13398 | High | 7.2 | 2019-07-08 | Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed inject… |
CVE-2019-5588 | Medium | 6.1 | 2019-06-04 | A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized… |
CVE-2019-5587 | Medium | 6.5 | 2019-06-04 | Lack of root file system integrity checking in Fortinet FortiOS VM application images all versions below 6.0.5 may allow attacker to implant malicious programs… |
CVE-2019-5586 | Medium | 6.1 | 2019-06-04 | A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10, 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to exec… |
CVE-2018-13384 | Medium | 6.1 | 2019-06-04 | A Host Header Redirection vulnerability in Fortinet FortiOS all versions below 6.0.5 under SSL VPN web portal allows a remote attacker to potentially poison HT… |
CVE-2018-13382 | Critical | 9.1 | 2019-06-04 | An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1… |
CVE-2018-13381 | Medium | 5.3 | 2019-06-04 | A buffer overflow vulnerability in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.7, 5.4 and earlier versions and FortiProxy 2.0.0, 1.2.8 and earlier… |
CVE-2018-13380 | Medium | 4.7 | 2019-06-04 | A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below and Fortinet FortiProxy 2.0.0, 1… |
CVE-2018-13379 | Critical | 9.1 | 2019-06-04 | An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and Fo… |
CVE-2018-9193 | High | 7.8 | 2019-05-30 | A researcher has disclosed several vulnerabilities against FortiClient for Windows version 6.0.5 and below, version 5.6.6, the combination of these vulnerabili… |
CVE-2018-9191 | High | 7.8 | 2019-05-30 | A local privilege escalation in Fortinet FortiClient for Windows 6.0.4 and earlier allows attackers to execute unauthorized code or commands via the named pipe… |
CVE-2018-13368 | High | 7.8 | 2019-05-30 | A local privilege escalation in Fortinet FortiClient for Windows 6.0.4 and earlier allows attacker to execute unauthorized code or commands via the command inj… |
CVE-2018-13365 | Medium | 5.3 | 2019-05-29 | An Information Exposure vulnerability in Fortinet FortiOS 6.0.1, 5.6.5 and below, allow attackers to learn private IP as well as the hostname of FortiGate via… |
CVE-2018-13383 | Medium | 4.3 | 2019-05-29 | A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and… |
CVE-2019-5589 | High | 7.8 | 2019-05-28 | An Unsafe Search Path vulnerability in FortiClient Online Installer (Windows version before 6.0.6) may allow an unauthenticated, remote attacker with control o… |
CVE-2018-13375 | Medium | 6.1 | 2019-05-28 | An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DH… |
CVE-2018-1360 | High | 8.1 | 2019-04-25 | A cleartext transmission of sensitive information vulnerability in Fortinet FortiManager 5.2.0 through 5.2.7, 5.4.0 and 5.4.1 may allow an unauthenticated atta… |
CVE-2018-13378 | High | 7.2 | 2019-04-17 | An information disclosure vulnerability in Fortinet FortiSIEM 5.2.0 and below versions exposes the LDAP server plaintext password via the HTML source code. |
CVE-2019-5585 | Medium | 6.1 | 2019-04-09 | An improper access control vulnerability in FortiClientMac before 6.0.5 may allow an attacker to affect the application's performance via modifying the content… |
CVE-2018-1356 | Medium | 6.1 | 2019-04-09 | A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiSandbox before 3.0 may allow an attacker to execute unauthorized code or commands via the… |
CVE-2018-13366 | Medium | 5.3 | 2019-04-09 | An information disclosure vulnerability in Fortinet FortiOS 6.0.1, 5.6.7 and below allows attacker to reveals serial number of FortiGate via hostname field def… |
CVE-2017-17544 | High | 7.2 | 2019-04-09 | A privilege escalation vulnerability in Fortinet FortiOS 6.0.0 to 6.0.6, 5.6.0 to 5.6.10, 5.4 and below allows admin users to elevate their profile to super_ad… |
CVE-2017-7342 | Critical | 9.8 | 2019-03-25 | A weak password recovery process vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via… |
CVE-2017-7340 | Medium | 6.1 | 2019-03-25 | A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via the appli… |
CVE-2018-9190 | Medium | 5.5 | 2019-02-08 | A null pointer dereference vulnerability in Fortinet FortiClientWindows 6.0.2 and earlier allows attacker to cause a denial of service via the NDIS miniport dr… |
CVE-2018-1352 | Critical | 9.8 | 2019-02-08 | A format string vulnerability in Fortinet FortiOS 5.6.0 allows attacker to execute unauthorized code or commands via the SSH username variable. |
CVE-2018-13374 | Medium | 4.3 | 2019-01-22 | A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server… |
CVE-2018-13376 | High | 7.5 | 2018-11-27 | An uninitialized memory buffer leak exists in Fortinet FortiOS 5.6.1 to 5.6.3, 5.4.6 to 5.4.7, 5.2 all versions under web proxy's disclaimer response web pages… |
CVE-2018-9194 | Medium | 5.9 | 2018-09-05 | A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowledge of the server'… |
CVE-2018-9192 | Medium | 5.9 | 2018-09-05 | A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowledge of the server'… |
CVE-2018-1353 | Medium | 4.3 | 2018-09-05 | An information disclosure vulnerability in Fortinet FortiManager 6.0.1 and below versions allows a standard user with adom assignment read the interface settin… |
CVE-2017-17541 | Medium | 6.1 | 2018-07-16 | A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows injec… |
CVE-2018-9185 | High | 8.1 | 2018-07-05 | An information disclosure vulnerability in Fortinet FortiOS 6.0.0 and below versions reveals user's web portal login credentials in a Javascript file sent to c… |
CVE-2018-1351 | Medium | 4.8 | 2018-06-28 | A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.6 and below versions allows attacker to execute HTML/javascript code via managed… |
CVE-2018-1355 | Medium | 6.1 | 2018-06-27 | An open redirect vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows attacker to injec… |
CVE-2018-1354 | Medium | 6.5 | 2018-06-27 | An improper access control vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows a regul… |
CVE-2018-9186 | Medium | 6.1 | 2018-05-31 | A cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to e… |
CVE-2017-14185 | Medium | 5.3 | 2018-05-25 | An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8 and 5.2 all versions allows SSL VPN web portal users to access inter… |
CVE-2017-14187 | Medium | 6.2 | 2018-05-24 | A local privilege escalation and local code execution vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8, and 5.2 and below versions allows attac… |
CVE-2017-17540 | Critical | 9.8 | 2018-05-08 | The presence of a hardcoded account in Fortinet FortiWLC 8.3.3 allows attackers to gain unauthorized read/write access via a remote shell. |
CVE-2017-17539 | Critical | 9.8 | 2018-05-08 | The presence of a hardcoded account in Fortinet FortiWLC 7.0.11 and earlier allows attackers to gain unauthorized read/write access via a remote shell. |
CVE-2017-17543 | High | 7.5 | 2018-04-26 | Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and be… |