Fortinet
Page 8 of 11 — Fortinet CVEs from a corpus of 1081, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-27484 | Medium | 5.4 | 2022-08-03 | A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x allows an authenticated attacker to bypass the Old Password… |
CVE-2022-23442 | Medium | 4.3 | 2022-08-03 | An improper access control vulnerability [CWE-284] in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.0.0 through 7.0.5 may allow an authentic… |
CVE-2022-30302 | Medium | 6.5 | 2022-07-19 | Multiple relative path traversal vulnerabilities [CWE-23] in FortiDeceptor management interface 1.0.0 through 3.2.x, 3.3.0 through 3.3.2, 4.0.0 through 4.0.1 m… |
CVE-2022-30301 | High | 7.8 | 2022-07-19 | A path traversal vulnerability [CWE-22] in FortiAP-U CLI 6.2.0 through 6.2.3, 6.0.0 through 6.0.4, 5.4.0 through 5.4.6 may allow an admin user to delete and ac… |
CVE-2022-29060 | High | 8.1 | 2022-07-19 | A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiDDoS API 5.5.0 through 5.5.1, 5.4.0 through 5.4.2, 5.3.0 through 5.3.1, 5.2.0, 5.1.0 may… |
CVE-2022-29057 | Medium | 5.4 | 2022-07-19 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiEDR version 5.1.0, 5.0.0 through 5.0.3 Patch 6 and 4.0… |
CVE-2022-27483 | High | 7.2 | 2022-07-19 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager version 7.0.0 through 7.0.3, 6.4.0 throug… |
CVE-2022-26113 | High | 7.7 | 2022-07-19 | An execution with unnecessary privileges vulnerability [CWE-250] in FortiClientWindows 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 thr… |
CVE-2022-26120 | Medium | 5.4 | 2022-07-18 | Multiple improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerabilities [CWE-89] in FortiADC management interface 7.0.0 t… |
CVE-2022-26118 | Medium | 6.7 | 2022-07-18 | A privilege chaining vulnerability [CWE-268] in FortiManager and FortiAnalyzer 6.0.x, 6.2.x, 6.4.0 through 6.4.7, 7.0.0 through 7.0.3 may allow a local and aut… |
CVE-2022-26117 | High | 8.8 | 2022-07-18 | An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and… |
CVE-2022-23438 | Medium | 4.7 | 2022-07-18 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in FortiOS version 7.0.5 and prior and 6.4.9 and… |
CVE-2021-41031 | High | 7.8 | 2022-07-18 | A relative path traversal vulnerability [CWE-23] in FortiClient for Windows versions 7.0.2 and prior, 6.4.6 and prior and 6.2.9 and below may allow a local unp… |
CVE-2021-22131 | Medium | 6.4 | 2022-07-18 | A improper validation of certificate with host mismatch in Fortinet FortiTokenAndroid version 5.0.3 and below, Fortinet FortiTokeniOS version 5.2.0 and below… |
CVE-2022-22304 | Medium | 6.1 | 2022-07-18 | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAuthenticator OWA Agent for Microsoft version 2.2 and 2.1 may all… |
CVE-2021-44170 | Medium | 6.7 | 2022-07-18 | A stack-based buffer overflow vulnerability [CWE-121] in the command line interpreter of FortiOS before 7.0.4 and FortiProxy before 2.0.8 may allow an authenti… |
CVE-2021-42755 | Medium | 4.3 | 2022-07-18 | An integer overflow / wraparound vulnerability [CWE-190] in FortiSwitch 7.0.2 and below, 6.4.9 and below, 6.2.x, 6.0.x; FortiRecorder 6.4.2 and below, 6.0.10 a… |
CVE-2022-22306 | Medium | 5.4 | 2022-05-24 | An improper certificate validation vulnerability [CWE-295] in FortiOS 6.0.0 through 6.0.14, 6.2.0 through 6.2.10, 6.4.0 through 6.4.8, 7.0.0 may allow a networ… |
CVE-2021-43066 | High | 8.4 | 2022-05-11 | A external control of file name or path in Fortinet FortiClientWindows version 7.0.2 and below, version 6.4.6 and below, version 6.2.9 and below, version 6.0.1… |
CVE-2021-44167 | Medium | 6.8 | 2022-05-11 | An incorrect permission assignment for critical resource vulnerability [CWE-732] in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and b… |
CVE-2021-43081 | Medium | 6.1 | 2022-05-11 | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.0.3 and below, 6.4.8 and below, 6.2.10 and below, 6… |
CVE-2022-26116 | High | 7.2 | 2022-05-11 | Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2 a… |
CVE-2022-23443 | High | 7.5 | 2022-05-04 | An improper access control in Fortinet FortiSOAR before 7.2.0 allows unauthenticated attackers to access gateway API data via crafted HTTP GET requests. |
CVE-2021-43206 | Medium | 4.3 | 2022-05-04 | A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.x and FortiProxy 7.0… |
CVE-2021-41032 | Medium | 6.3 | 2022-05-04 | An improper access control vulnerability [CWE-284] in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attacker with a restricte… |
CVE-2021-41020 | High | 8.8 | 2022-05-04 | An improper access control vulnerability [CWE-284] in FortiIsolator versions 2.3.2 and below may allow an authenticated, non privileged attacker to regenerate… |
CVE-2021-41026 | Medium | 6.5 | 2022-04-06 | A relative path traversal in FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to retrieve arbitrary files from the… |
CVE-2021-32585 | High | 7.2 | 2022-04-06 | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiWAN before 4.5.9 may allow an attacker to perform a stored cross-… |
CVE-2021-26116 | Medium | 6.7 | 2022-04-06 | An improper neutralization of special elements used in an OS command vulnerability in the command line interpreter of FortiAuthenticator before 6.3.1 may allow… |
CVE-2021-26113 | Medium | 6.2 | 2022-04-06 | A use of a one-way hash with a predictable salt vulnerability [CWE-760] in FortiWAN before 4.5.9 may allow an attacker who has previously come in possession of… |
CVE-2021-26104 | High | 7.8 | 2022-04-06 | Multiple OS command injection (CWE-78) vulnerabilities in the command line interface of FortiManager 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x… |
CVE-2021-22127 | High | 7.1 | 2022-04-06 | An improper input validation vulnerability in FortiClient for Linux 6.4.x before 6.4.3, FortiClient for Linux 6.2.x before 6.2.9 may allow an unauthenticated a… |
CVE-2022-23440 | High | 7.8 | 2022-04-06 | A use of hard-coded cryptographic key vulnerability [CWE-321] in the registration mechanism of FortiEDR collectors versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allo… |
CVE-2021-44169 | High | 8.2 | 2022-04-06 | A improper initialization in Fortinet FortiClient (Windows) version 6.0.10 and below, version 6.2.9 and below, version 6.4.7 and below, version 7.0.3 and below… |
CVE-2021-43205 | Medium | 4.3 | 2022-04-06 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Linux version 7.0.2 and below, 6.4.7 and below and 6.2… |
CVE-2021-32593 | Medium | 6.5 | 2022-04-06 | A use of a broken or risky cryptographic algorithm vulnerability [CWE-327] in the Dynamic Tunnel Protocol of FortiWAN before 4.5.9 may allow an unauthenticated… |
CVE-2021-26114 | Critical | 9.8 | 2022-04-06 | Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiWAN before 4.5.9 may allow an unauthenticated attacker to e… |
CVE-2021-26112 | High | 8.1 | 2022-04-06 | Multiple stack-based buffer overflow vulnerabilities [CWE-121] both in network daemons and in the command line interpreter of FortiWAN before 4.5.9 may allow a… |
CVE-2021-24009 | High | 7.2 | 2022-04-06 | Multiple improper neutralization of special elements used in an OS command vulnerabilities (CWE-78) in the Web GUI of FortiWAN before 4.5.9 may allow an authen… |
CVE-2022-23446 | Medium | 4.4 | 2022-04-06 | A improper control of a resource through its lifetime in Fortinet FortiEDR version 5.0.3 and earlier allows attacker to make the whole application unresponsive… |
CVE-2022-23441 | Critical | 9.1 | 2022-04-06 | A use of hard-coded cryptographic key vulnerability [CWE-321] in FortiEDR versions 5.0.2, 5.0.1, 5.0.0, 4.0.0 may allow an unauthenticated attacker on the netw… |
CVE-2020-29013 | Medium | 5.4 | 2022-04-06 | An improper input validation vulnerability in the sniffer interface of FortiSandbox before 3.2.2 may allow an authenticated attacker to silently halt the sniff… |
CVE-2021-43070 | Medium | 5.4 | 2022-03-02 | Multiple relative path traversal vulnerabilities [CWE-23] in FortiWLM management interface 8.6.2 and below, 8.5.2 and below, 8.4.2 and below, 8.3.3 and below… |
CVE-2022-22303 | Low | 2.8 | 2022-03-02 | An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiManager versions prior to 7.0.2, 6.4.7 and 6.2.9… |
CVE-2022-22301 | High | 7.8 | 2022-03-02 | An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiAP-C console 5.4.0 through 5.4.3, 5.2.0 through 5.2.1 may a… |
CVE-2021-44166 | Medium | 4.1 | 2022-03-02 | An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a remote attacker havin… |
CVE-2022-22300 | Medium | 4.3 | 2022-03-01 | A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.1… |
CVE-2021-43077 | High | 8.8 | 2022-03-01 | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, v… |
CVE-2021-43075 | High | 8.8 | 2022-03-01 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and be… |
CVE-2021-32586 | High | 7.7 | 2022-03-01 | An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unauthenticated attacker to alter the enviro… |
CVE-2020-15936 | Low | 2.6 | 2022-03-01 | A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version 6.0.11 and below, version 5.6.13 and below allows a… |
CVE-2021-36171 | High | 8.1 | 2022-03-01 | The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6.0.6 may allow a remote unauthenticated… |
CVE-2021-36166 | Critical | 9.8 | 2022-03-01 | An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication… |
CVE-2021-26092 | Medium | 4.7 | 2022-02-24 | Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 t… |
CVE-2021-41018 | High | 8.8 | 2022-02-02 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below all… |
CVE-2021-36193 | Medium | 6.7 | 2022-02-02 | Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code ex… |
CVE-2021-43073 | High | 8.8 | 2022-02-02 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and b… |
CVE-2021-43062 | Medium | 6.1 | 2022-02-02 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below… |
CVE-2021-42753 | High | 8.1 | 2022-02-02 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiWeb management interface 6.4.1 and below, 6.3… |
CVE-2021-41016 | High | 7.8 | 2022-02-02 | A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiExtender version 7.0.1 and below, 4.2.3 and below, 4.1.7… |
CVE-2021-36177 | Medium | 4.2 | 2022-02-02 | An improper access control vulnerability [CWE-284] in FortiAuthenticator HA service 6.3.2 and below, 6.2.x, 6.1.x, 6.0.x may allow an attacker on the same vlan… |
CVE-2020-15933 | Medium | 5.3 | 2022-01-05 | A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and below FortiMail versi… |
CVE-2021-44168 | Low | 3.3 | 2022-01-04 | A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attac… |
CVE-2021-41028 | High | 8.2 | 2021-12-16 | A combination of a use of hard-coded cryptographic key vulnerability [CWE-321] in FortiClientEMS 7.0.1 and below, 6.4.6 and below and an improper certificate v… |
CVE-2021-36169 | Medium | 4.2 | 2021-12-13 | A Hidden Functionality in Fortinet FortiOS 7.x before 7.0.1, FortiOS 6.4.x before 6.4.7 allows attacker to Execute unauthorized code or commands via specific h… |
CVE-2021-43071 | High | 8.8 | 2021-12-09 | A heap-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unautho… |
CVE-2021-43068 | Medium | 5.4 | 2021-12-09 | A improper authentication in Fortinet FortiAuthenticator version 6.4.0 allows user to bypass the second factor of authentication via a RADIUS login portal. |
CVE-2021-43065 | High | 7.8 | 2021-12-09 | A incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version 9.1.3 and below, version 8.8.9 and below allows attacker to… |
CVE-2021-42759 | Medium | 6.7 | 2021-12-09 | A violation of secure design principles in Fortinet Meru AP version 8.6.1 and below, version 8.5.5 and below allows attacker to execute unauthorized code or co… |
CVE-2021-36167 | Medium | 4.3 | 2021-12-09 | An improper authorization vulnerabiltiy [CWE-285] in FortiClient Windows versions 7.0.0 and 6.4.6 and below and 6.2.8 and below may allow an unauthenticated at… |
CVE-2021-43204 | Medium | 4.4 | 2021-12-09 | A improper control of a resource through its lifetime in Fortinet FortiClientWindows version 6.4.1 and 6.4.0, version 6.2.9 and below, version 6.0.10 and below… |
CVE-2021-36194 | High | 8.8 | 2021-12-09 | Multiple stack-based buffer overflows in the API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to achieve… |
CVE-2021-36189 | Medium | 6.8 | 2021-12-09 | A missing encryption of sensitive data in Fortinet FortiClientEMS version 7.0.1 and below, version 6.4.4 and below allows attacker to information disclosure vi… |
CVE-2021-41025 | High | 7.3 | 2021-12-08 | Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, 6.1.0 through 6… |
CVE-2021-41017 | High | 8.8 | 2021-12-08 | Multiple heap-based buffer overflow vulnerabilities in some web API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow a remote authentic… |
CVE-2021-36195 | Medium | 4.2 | 2021-12-08 | Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, and 6… |
CVE-2021-36173 | High | 8.0 | 2021-12-08 | A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, and 6… |
CVE-2021-41030 | Medium | 5.4 | 2021-12-08 | An authentication bypass by capture-replay vulnerability [CWE-294] in FortiClient EMS versions 7.0.1 and below and 6.4.4 and below may allow an unauthenticated… |
CVE-2021-41021 | High | 7.8 | 2021-12-08 | A privilege escalation vulnerability in FortiNAC versions 8.8.8 and below and 9.1.2 and below may allow an admin user to escalate the privileges to root via th… |
CVE-2021-41013 | Medium | 5.3 | 2021-12-08 | An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log & Report may a… |
CVE-2021-36188 | Medium | 6.1 | 2021-12-08 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows at… |
CVE-2021-43063 | Medium | 6.1 | 2021-12-08 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below… |
CVE-2021-36190 | Medium | 5.5 | 2021-12-08 | A unintended proxy or intermediary ('confused deputy') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to acc… |
CVE-2021-43064 | Medium | 4.3 | 2021-12-08 | A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows at… |
CVE-2021-41027 | High | 7.3 | 2021-12-08 | A stack-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, allows an authenticated attacker to execute unauthorized code or commands via craft… |
CVE-2021-41024 | High | 7.5 | 2021-12-08 | A relative path traversal [CWE-23] vulnerabiltiy in FortiOS versions 7.0.0 and 7.0.1 and FortiProxy verison 7.0.0 may allow an unauthenticated, unauthorized at… |
CVE-2021-41015 | Medium | 6.1 | 2021-12-08 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows at… |
CVE-2021-41014 | High | 7.5 | 2021-12-08 | A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to make the httpsd daemon… |
CVE-2021-36191 | Medium | 4.1 | 2021-12-08 | A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to use the device as proxy… |
CVE-2021-26109 | High | 8.1 | 2021-12-08 | An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt cont… |
CVE-2021-26108 | High | 7.5 | 2021-12-08 | A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS before 7.0.1 may allow an attacker to retrieve the key by reverse engineering. |
CVE-2021-43067 | High | 8.3 | 2021-12-08 | A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.2 and below, version 6.2.1 and below, ve… |
CVE-2021-42760 | High | 8.8 | 2021-12-08 | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose… |
CVE-2021-42752 | Medium | 5.4 | 2021-12-08 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute… |
CVE-2021-41029 | Medium | 6.4 | 2021-12-08 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWLM version 8.6.1 and below allows attacker to store ma… |
CVE-2021-32591 | Medium | 5.3 | 2021-12-08 | A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3… |
CVE-2021-26103 | Medium | 6.3 | 2021-12-08 | An insufficient verification of data authenticity vulnerability (CWE-345) in the user interface of FortiProxy verison 2.0.3 and below, 1.2.11 and below and For… |
CVE-2021-42758 | High | 8.8 | 2021-12-08 | An improper access control vulnerability [CWE-284] in FortiWLC 8.6.1 and below may allow an authenticated and remote attacker with low privileges to execute an… |
CVE-2021-42757 | Medium | 6.7 | 2021-12-08 | A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to ac… |
CVE-2021-36180 | High | 8.1 | 2021-12-08 | Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and be… |