Fortinet
Page 6 of 11 — Fortinet CVEs from a corpus of 1081, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-41841 | High | 8.1 | 2023-10-10 | An improper authorization vulnerability in Fortinet FortiOS 7.0.0 - 7.0.11 and 7.2.0 - 7.2.4 allows an attacker belonging to the prof-admin profile to perform… |
CVE-2023-41838 | High | 7.1 | 2023-10-10 | An improper neutralization of special elements used in an os command ('os command injection') in FortiManager 7.4.0 and 7.2.0 through 7.2.3 may allow attacker… |
CVE-2023-41679 | High | 8.5 | 2023-10-10 | An improper access control vulnerability [CWE-284] in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all… |
CVE-2023-41675 | Medium | 5.3 | 2023-10-10 | A use after free vulnerability [CWE-416] in FortiOS version 7.2.0 through 7.2.4 and version 7.0.0 through 7.0.10 and FortiProxy version 7.2.0 through 7.2.2 and… |
CVE-2023-40718 | High | 7.5 | 2023-10-10 | A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packets. |
CVE-2023-37939 | Low | 3.3 | 2023-10-10 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Windows 7.2.0, 7.0 all versions, 6.4 all versions, 6.2… |
CVE-2023-37935 | Medium | 6.5 | 2023-10-10 | A use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12, 7.2.0 - 7.2.5 and 7.4.0 allows an attacker to view p… |
CVE-2023-36637 | Low | 3.5 | 2023-10-10 | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiMail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authe… |
CVE-2023-36556 | High | 8.8 | 2023-10-10 | An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an auth… |
CVE-2023-36555 | Low | 3.9 | 2023-10-10 | An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized c… |
CVE-2023-36550 | Critical | 9.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-36549 | High | 8.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-36548 | Critical | 9.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-36547 | Critical | 9.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-34993 | Critical | 9.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-34992 | Critical | 10.0 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized… |
CVE-2023-34989 | High | 8.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-34988 | High | 8.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-34987 | High | 8.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-34986 | High | 8.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-34985 | High | 8.8 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through… |
CVE-2023-33301 | Medium | 6.5 | 2023-10-10 | An improper access control vulnerability in Fortinet FortiOS 7.2.0 - 7.2.4 and 7.4.0 allows an attacker to access a restricted resource from a non trusted host. |
CVE-2023-25607 | High | 7.8 | 2023-10-10 | An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78 ] in FortiManager 7.2.0 through 7.2.2, 7.0… |
CVE-2023-25604 | Medium | 5.5 | 2023-10-10 | An insertion of sensitive information into log file vulnerability in Fortinet FortiGuest 1.0.0 allows a local attacker to access plaintext passwords in the RAD… |
CVE-2022-22298 | Medium | 6.7 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiIsolator version 1.0.0, FortiIsolator version 1.1… |
CVE-2023-40717 | Medium | 5.3 | 2023-09-13 | A use of hard-coded credentials vulnerability [CWE-798] in FortiTester 2.3.0 through 7.2.3 may allow an attacker who managed to get a shell on the device to ac… |
CVE-2023-40715 | Medium | 5.5 | 2023-09-13 | A cleartext storage of sensitive information vulnerability [CWE-312] in FortiTester 2.3.0 through 7.2.3 may allow an attacker with access to the DB contents to… |
CVE-2023-36642 | Medium | 6.7 | 2023-09-13 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiTester 3.0.0 through 7.2.3 may… |
CVE-2023-36638 | Medium | 4.3 | 2023-09-13 | An improper privilege management vulnerability [CWE-269] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0… |
CVE-2023-36634 | High | 7.1 | 2023-09-13 | An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-U 7.0.0, 6.2.0 through… |
CVE-2023-36551 | Medium | 4.3 | 2023-09-13 | A exposure of sensitive information to an unauthorized actor in Fortinet FortiSIEM version 6.7.0 through 6.7.5 allows attacker to information disclosure via a… |
CVE-2023-34984 | High | 7.5 | 2023-09-13 | A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.6 through 6.3.23 allows attacker to exec… |
CVE-2023-29183 | High | 8.0 | 2023-09-13 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7.2.4, 7.0.0 through… |
CVE-2023-27998 | Medium | 5.3 | 2023-09-13 | A lack of custom error pages vulnerability [CWE-756] in FortiPresence versions 1.2.0 through 1.2.1 and all versions of 1.1 and 1.0 may allow an unauthenticated… |
CVE-2023-25608 | Medium | 5.5 | 2023-09-13 | An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-W2 7.2.0 through 7.2.1… |
CVE-2022-35849 | High | 7.8 | 2023-09-13 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiADC 7.1.0 through 7.1.1, 7.0.0… |
CVE-2021-44172 | Medium | 4.3 | 2023-09-13 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClientEMS versions 7.0.0 through 7.0.4, 7.0.6 through 7.0.7, in a… |
CVE-2023-36635 | High | 7.1 | 2023-09-07 | An improper access control in Fortinet FortiSwitchManager version 7.2.0 through 7.2.2 7.0.0 through 7.0.1 may allow a remote authenticated read-only user to m… |
CVE-2022-22305 | Medium | 5.4 | 2023-09-01 | An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; Fo… |
CVE-2023-29182 | Medium | 6.4 | 2023-08-17 | A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiOS before 7.0.3 allows a privileged attacker to execute arbitrary code via specially cra… |
CVE-2023-33308 | Critical | 9.8 | 2023-07-26 | A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7… |
CVE-2021-43072 | Medium | 6.7 | 2023-07-18 | A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiAnalyzer version 7.0.2 and below, version 6.4.7 and below, version 6… |
CVE-2023-28001 | Medium | 4.1 | 2023-07-11 | An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing… |
CVE-2023-25606 | Medium | 6.5 | 2023-07-11 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-23] in FortiAnalyzer and FortiManager management interface… |
CVE-2022-23447 | High | 7.5 | 2023-07-11 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiExtender management interface 7.0.0 through 7… |
CVE-2023-23777 | High | 7.2 | 2023-07-11 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb version 7.0.1 and below, 6.4 a… |
CVE-2022-22302 | Medium | 5.3 | 2023-07-11 | A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0… |
CVE-2023-33299 | Critical | 9.8 | 2023-06-23 | A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unaut… |
CVE-2023-33307 | Medium | 6.5 | 2023-06-16 | A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to denial of sslvpn ser… |
CVE-2023-33306 | Medium | 6.5 | 2023-06-16 | A null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11 and before 6.4.13, FortiProxy before 7.2.4 and before 7.0.10 allows attacker to den… |
CVE-2023-33305 | Medium | 4.9 | 2023-06-13 | A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all… |
CVE-2023-29178 | Medium | 4.3 | 2023-06-13 | A access of uninitialized pointer vulnerability [CWE-824] in Fortinet FortiProxy version 7.2.0 through 7.2.3 and before 7.0.9 and FortiOS version 7.2.0 throug… |
CVE-2023-29175 | Medium | 4.8 | 2023-06-13 | An improper certificate validation vulnerability [CWE-295] in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.10, 7.2.0 and FortiProxy 1.2 all ve… |
CVE-2023-28000 | Medium | 6.7 | 2023-06-13 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC CLI 7.1.0, 7.0.0 through 7.0.3, 6.2.0 through 6.2.4, 6… |
CVE-2023-27997 | Critical | 9.8 | 2023-06-13 | A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and… |
CVE-2023-26210 | High | 7.8 | 2023-06-13 | Multiple improper neutralization of special elements used in an os command ('OS Command Injection') vulnerabilties [CWE-78] vulnerability in Fortinet allows a… |
CVE-2023-26207 | Low | 3.3 | 2023-06-13 | An insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4 and FortiProxy 7.0.0 through 7.0.10. 7.2.0 through 7… |
CVE-2023-26204 | Low | 3.7 | 2023-06-13 | A plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions… |
CVE-2023-25609 | Medium | 4.3 | 2023-06-13 | A server-side request forgery (SSRF) vulnerability [CWE-918] in FortiManager and FortiAnalyzer GUI 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.8 through 6.4… |
CVE-2023-22639 | Medium | 6.7 | 2023-06-13 | A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.12, FortiOS all… |
CVE-2023-22633 | High | 7.5 | 2023-06-13 | An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and belo… |
CVE-2022-43953 | Medium | 6.7 | 2023-06-13 | A use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0, FortiOS all versions 6.4, FortiOS all v… |
CVE-2022-43949 | Medium | 6.2 | 2023-06-13 | A use of a broken or risky cryptographic algorithm [CWE-327] in Fortinet FortiSIEM before 6.7.1 allows a remote unauthenticated attacker to perform brute forc… |
CVE-2022-42478 | High | 8.1 | 2023-06-13 | An Improper Restriction of Excessive Authentication Attempts [CWE-307] in FortiSIEM below 7.0.0 may allow a non-privileged user with access to several endpoint… |
CVE-2022-42474 | Medium | 6.5 | 2023-06-13 | A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.9 and before 6.4.12, FortiProxy ver… |
CVE-2022-41327 | High | 7.8 | 2023-06-13 | A cleartext transmission of sensitive information vulnerability [CWE-319] in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.8, FortiProxy vers… |
CVE-2022-39946 | High | 7.6 | 2023-06-13 | An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8… |
CVE-2022-33877 | High | 7.0 | 2023-06-13 | An incorrect default permission [CWE-276] vulnerability in FortiClient (Windows) versions 7.0.0 through 7.0.6 and 6.4.0 through 6.4.8 and FortiConverter (Windo… |
CVE-2023-27999 | High | 7.8 | 2023-05-03 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 7.2.0, 7.1.0 through 7.1.1 may allow an authenticated a… |
CVE-2023-27993 | Medium | 6.0 | 2023-05-03 | A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to delete arbitrary directories from the un… |
CVE-2023-26203 | Medium | 6.7 | 2023-05-03 | A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8… |
CVE-2023-22640 | High | 7.5 | 2023-05-03 | A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.11, FortiOS vers… |
CVE-2023-22637 | Medium | 6.5 | 2023-05-03 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, FortiNAC version 9… |
CVE-2022-45860 | Medium | 5.3 | 2023-05-03 | A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versi… |
CVE-2022-45859 | Medium | 4.1 | 2023-05-03 | An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all vers… |
CVE-2022-45858 | Medium | 4.2 | 2023-05-03 | A use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all versions, 8.7.0 all… |
CVE-2022-43950 | Medium | 4.3 | 2023-05-03 | A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and below, 9.2 all versions… |
CVE-2023-27995 | High | 7.2 | 2023-04-11 | A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiSOAR 7.3.0 through 7.3.1 allows an authenticated, remote… |
CVE-2023-22642 | High | 7.5 | 2023-04-11 | An improper certificate validation vulnerability [CWE-295] in FortiAnalyzer and FortiManager 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4.8 through 6.4.10 may… |
CVE-2023-22641 | Medium | 4.1 | 2023-04-11 | A url redirection to untrusted site ('open redirect') in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, FortiOS versions 6… |
CVE-2023-22635 | High | 7.3 | 2023-04-11 | A download of code without Integrity check vulnerability [CWE-494] in FortiClientMac version 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all… |
CVE-2022-43955 | High | 8.8 | 2023-04-11 | An improper neutralization of input during web page generation [CWE-79] in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3.0 through 6.3.21, 6.4 all versio… |
CVE-2022-43952 | Low | 3.5 | 2023-04-11 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiADC version 7.1.1 and below, version 7.0… |
CVE-2022-43951 | Medium | 5.3 | 2023-04-11 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and… |
CVE-2022-43948 | Medium | 6.7 | 2023-04-11 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0.3, FortiADC version… |
CVE-2022-43947 | Medium | 5.0 | 2023-04-11 | An improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiPr… |
CVE-2022-43946 | High | 7.5 | 2023-04-11 | Multiple vulnerabilities including an incorrect permission assignment for critical resource [CWE-732] vulnerability and a time-of-check time-of-use (TOCTOU) ra… |
CVE-2022-42477 | High | 7.1 | 2023-04-11 | An improper input validation vulnerability [CWE-20] in FortiAnalyzer version 7.2.1 and below, version 7.0.6 and below, 6.4 all versions may allow an authentica… |
CVE-2022-42470 | High | 7.8 | 2023-04-11 | A relative path traversal vulnerability in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to… |
CVE-2022-42469 | Medium | 4.3 | 2023-04-11 | A permissive list of allowed inputs vulnerability [CWE-183] in FortiGate version 7.2.3 and below, version 7.0.9 and below Policy-based NGFW Mode may allow an a… |
CVE-2022-41331 | Critical | 9.8 | 2023-04-11 | A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthentic… |
CVE-2022-41330 | High | 8.8 | 2023-04-11 | An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7.2.0 through 7.2.3… |
CVE-2022-40682 | High | 7.8 | 2023-04-11 | A incorrect authorization in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to execute unauth… |
CVE-2022-40679 | High | 7.8 | 2023-04-11 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 5.x all versions, 6.0 all versions, 6.1 all versions, 6… |
CVE-2022-35850 | Medium | 4.3 | 2023-04-11 | An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6… |
CVE-2022-27487 | High | 8.8 | 2023-04-11 | A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0… |
CVE-2022-27485 | Medium | 6.5 | 2023-04-11 | A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox version 4.2.0, 4.0.0 thr… |
CVE-2023-26209 | Low | 3.7 | 2023-03-09 | A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and before allows a remote unauthenticated… |
CVE-2023-26208 | Low | 3.7 | 2023-03-09 | A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.x and before allows a remote unauthenti… |
CVE-2022-29056 | Low | 3.7 | 2023-03-09 | A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 through 6.2.4 and before… |