Fortinet
Page 9 of 11 — Fortinet CVEs from a corpus of 1081, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-26110 | High | 7.8 | 2021-12-08 | An improper access control vulnerability [CWE-284] in FortiOS autod daemon 7.0.0, 6.4.6 and below, 6.2.9 and below, 6.0.12 and below and FortiProxy 2.0.1 and b… |
CVE-2021-32592 | High | 7.8 | 2021-12-01 | An unsafe search path vulnerability in FortiClientWindows 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x and FortiClientEMS 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x may allo… |
CVE-2021-32600 | Medium | 5.0 | 2021-11-17 | An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS CLI 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, 6.0.x and 5.6.x may… |
CVE-2021-36192 | Medium | 5.2 | 2021-11-03 | An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiManager 7.0.1 and below, 6.4.6 and below, 6.2.x, 6.0.x, 5.6.0 may… |
CVE-2021-42754 | Low | 3.2 | 2021-11-02 | An improper control of generation of code vulnerability [CWE-94] in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and below may allow an authenticated at… |
CVE-2021-41023 | Medium | 5.5 | 2021-11-02 | A unprotected storage of credentials in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows an authenticated user to disclosure agent password due… |
CVE-2021-41022 | High | 7.8 | 2021-11-02 | A improper privilege management in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows attacker to execute privileged code or commands via powershe… |
CVE-2021-36187 | Medium | 5.3 | 2021-11-02 | A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to cause a denial of service… |
CVE-2021-36186 | High | 8.8 | 2021-11-02 | A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to execute unauthorized code or com… |
CVE-2021-36185 | High | 8.8 | 2021-11-02 | A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to ex… |
CVE-2021-36184 | High | 8.8 | 2021-11-02 | A improper neutralization of Special Elements used in an SQL Command ('SQL Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclosu… |
CVE-2021-36183 | High | 7.4 | 2021-11-02 | An improper authorization vulnerability [CWE-285] in FortiClient for Windows versions 7.0.1 and below and 6.4.2 and below may allow a local unprivileged attack… |
CVE-2021-36176 | Medium | 6.1 | 2021-11-02 | Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a… |
CVE-2021-36174 | Medium | 4.3 | 2021-11-02 | A memory allocation with excessive size value vulnerability in the license verification function of FortiPortal before 6.0.6 may allow an attacker to perform a… |
CVE-2020-15935 | Medium | 4.3 | 2021-11-02 | A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and below may allow a remote authenticated attacker to retrieve… |
CVE-2021-41019 | Low | 3.5 | 2021-11-02 | An improper validation of certificate with host mismatch [CWE-297] vulnerability in FortiOS versions 6.4.6 and below may allow the connection to a malicious LD… |
CVE-2021-36181 | Low | 3.1 | 2021-11-02 | A concurrent execution using shared resource with improper Synchronization vulnerability ('Race Condition') in the customer database interface of FortiPortal b… |
CVE-2021-36172 | Medium | 4.3 | 2021-11-02 | An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who con… |
CVE-2021-32595 | Medium | 6.5 | 2021-11-02 | Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a… |
CVE-2021-26107 | Medium | 6.3 | 2021-11-02 | An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a restricted user profile… |
CVE-2020-15940 | Medium | 4.1 | 2021-11-02 | An improper neutralization of input vulnerability [CWE-79] in FortiClientEMS versions 6.4.1 and below and 6.2.9 and below may allow a remote authenticated atta… |
CVE-2020-12814 | Medium | 4.1 | 2021-11-02 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiAnalyzer version 6.0.6 and below, version 6.4.4 allows… |
CVE-2021-36178 | Medium | 4.3 | 2021-10-06 | A insufficiently protected credentials in Fortinet FortiSDNConnector version 1.1.7 and below allows attacker to disclose third-party devices credential informa… |
CVE-2021-36175 | Medium | 4.1 | 2021-10-06 | An improper neutralization of input vulnerability [CWE-79] in FortiWebManager versions 6.2.3 and below, 6.0.2 and below may allow a remote authenticated attack… |
CVE-2021-36170 | Low | 3.2 | 2021-10-06 | An information disclosure vulnerability [CWE-200] in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below may allow an authenticated attacker… |
CVE-2021-24021 | Medium | 4.3 | 2021-10-06 | An improper neutralization of input vulnerability [CWE-79] in FortiAnalyzer versions 6.4.3 and below, 6.2.7 and below and 6.0.10 and below may allow a remote a… |
CVE-2021-24019 | High | 8.1 | 2021-10-06 | An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the unex… |
CVE-2020-15941 | Medium | 5.4 | 2021-10-06 | A path traversal vulnerability [CWE-22] in FortiClientEMS versions 6.4.1 and below; 6.2.8 and below may allow an authenticated attacker to inject directory tra… |
CVE-2021-24017 | Medium | 5.4 | 2021-09-30 | An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via… |
CVE-2021-24016 | Low | 3.7 | 2021-09-30 | An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbit… |
CVE-2021-36182 | High | 8.8 | 2021-09-08 | A Improper neutralization of special elements used in a command ('Command Injection') in Fortinet FortiWeb version 6.3.13 and below allows attacker to execute… |
CVE-2021-36179 | High | 8.0 | 2021-09-08 | A stack-based buffer overflow in Fortinet FortiWeb version 6.3.14 and below, 6.2.4 and below allows attacker to execute unauthorized code or commands via craft… |
CVE-2020-29012 | Medium | 5.6 | 2021-09-08 | An insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may allow an attacker to reuse the unexpired admin user session IDs t… |
CVE-2021-24006 | Medium | 6.3 | 2021-09-06 | An improper access control vulnerability in FortiManager versions 6.4.0 to 6.4.3 may allow an authenticated attacker with a restricted user profile to access t… |
CVE-2020-15939 | Medium | 4.3 | 2021-09-06 | An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1.4 and below may allow an authenticated, unprivileged attack… |
CVE-2021-32602 | Medium | 5.8 | 2021-08-19 | An improper neutralization of input during web page generation vulnerability (CWE-79) in FortiPortal GUI 6.0.4 and below, 5.3.6 and below, 5.2.6 and below, 5.1… |
CVE-2021-32588 | Critical | 9.8 | 2021-08-18 | A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4 and below, versions 5.1.x and 5.0.x may… |
CVE-2021-32597 | Medium | 4.6 | 2021-08-06 | Multiple improper neutralization of input during web page generation (CWE-79) in FortiManager and FortiAnalyzer versions 7.0.0, 6.4.5 and below, 6.2.7 and belo… |
CVE-2021-32587 | Medium | 4.3 | 2021-08-06 | An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and… |
CVE-2021-32603 | High | 8.8 | 2021-08-05 | A server-side request forgery (SSRF) (CWE-918) vulnerability in FortiManager and FortiAnalyser GUI 7.0.0, 6.4.5 and below, 6.2.7 and below, 6.0.11 and below, 5… |
CVE-2021-32598 | Medium | 4.3 | 2021-08-05 | An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability In FortiManager and FortiAnalyzer GUI 7.0.0, 6.4.6 and b… |
CVE-2021-24014 | Medium | 5.4 | 2021-08-04 | Multiple instances of improper neutralization of input during web page generation vulnerabilities in FortiSandbox before 4.0.0 may allow an unauthenticated att… |
CVE-2021-22124 | High | 7.5 | 2021-08-04 | An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0… |
CVE-2021-26096 | Medium | 6.4 | 2021-08-04 | Multiple instances of heap-based buffer overflow in the command shell of FortiSandbox before 4.0.0 may allow an authenticated attacker to manipulate memory and… |
CVE-2021-32596 | Medium | 6.0 | 2021-08-04 | A use of one-way hash with a predictable salt vulnerability in the password storing mechanism of FortiPortal 6.0.0 through 6.04 may allow an attacker already i… |
CVE-2021-26097 | High | 8.8 | 2021-08-04 | An improper neutralization of special elements used in an OS Command vulnerability in FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through… |
CVE-2020-29011 | High | 8.8 | 2021-08-04 | Instances of SQL Injection vulnerabilities in the checksum search and MTA-quarantine modules of FortiSandbox 3.2.0 through 3.2.2, and 3.1.0 through 3.1.4 may a… |
CVE-2021-36168 | Medium | 6.5 | 2021-08-04 | A Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Fortinet FortiPortal 6.x before 6.0.5, FortiPortal 5.3.x before 5.3.6 and a… |
CVE-2021-24018 | Medium | 4.3 | 2021-08-04 | A buffer underwrite vulnerability in the firmware verification routine of FortiOS before 7.0.1 may allow an attacker located in the adjacent network to potenti… |
CVE-2021-24010 | High | 8.1 | 2021-08-04 | Improper limitation of a pathname to a restricted directory vulnerabilities in FortiSandbox 3.2.0 through 3.2.2, and 3.1.0 through 3.1.4 may allow an authentic… |
CVE-2021-32594 | Medium | 5.4 | 2021-08-04 | An unrestricted file upload vulnerability in the web interface of FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earl… |
CVE-2021-32590 | Critical | 9.9 | 2021-08-04 | Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 thro… |
CVE-2021-26098 | Medium | 5.3 | 2021-08-04 | An instance of small space of random values in the RPC API of FortiSandbox before 4.0.0 may allow an attacker in possession of a few information pieces about t… |
CVE-2021-26095 | High | 7.5 | 2021-07-20 | The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption co… |
CVE-2021-24022 | Medium | 6.7 | 2021-07-20 | A buffer overflow vulnerability in FortiAnalyzer CLI 6.4.5 and below, 6.2.7 and below, 6.0.x and FortiManager CLI 6.4.5 and below, 6.2.7 and below, 6.0.x may a… |
CVE-2021-22125 | Medium | 6.3 | 2021-07-20 | An instance of improper neutralization of special elements in the sniffer module of FortiSandbox before 3.2.2 may allow an authenticated administrator to execu… |
CVE-2021-26088 | High | 7.1 | 2021-07-12 | An improper authentication vulnerability in FSSO Collector version 5.0.295 and below may allow an unauthenticated user to bypass a FSSO firewall policy and acc… |
CVE-2021-24015 | High | 7.2 | 2021-07-12 | An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an authe… |
CVE-2021-24013 | High | 8.8 | 2021-07-12 | Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via s… |
CVE-2021-26090 | Medium | 5.3 | 2021-07-12 | A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an una… |
CVE-2021-26089 | Medium | 6.7 | 2021-07-12 | An improper symlink following in FortiClient for Mac 6.4.3 and below may allow an non-privileged user to execute arbitrary privileged shell commands during ins… |
CVE-2021-26099 | Medium | 4.4 | 2021-07-12 | Missing cryptographic steps in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an attacker who comes in possession of the encrypted m… |
CVE-2021-26106 | High | 7.8 | 2021-07-09 | An improper neutralization of special elements used in an OS Command vulnerability in FortiAP's console 6.4.1 through 6.4.5 and 6.2.4 through 6.2.5 may allow a… |
CVE-2021-26100 | Medium | 5.9 | 2021-07-09 | A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an unauthenticated attacker who intercepts the encryp… |
CVE-2021-24020 | High | 7.5 | 2021-07-09 | A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthen… |
CVE-2021-24007 | Critical | 9.8 | 2021-07-09 | Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to execut… |
CVE-2021-22129 | High | 8.8 | 2021-07-09 | Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated att… |
CVE-2020-29014 | Medium | 6.3 | 2021-07-09 | A concurrent execution using shared resource with improper synchronization ('race condition') in the command shell of FortiSandbox before 3.2.2 may allow an au… |
CVE-2021-24005 | Medium | 4.0 | 2021-07-06 | Usage of hard-coded cryptographic keys to encrypt configuration files and debug logs in FortiAuthenticator versions before 6.3.0 may allow an attacker with acc… |
CVE-2021-24023 | High | 7.8 | 2021-06-03 | An improper input validation in FortiAI v1.4.0 and earlier may allow an authenticated user to gain system shell access via a malicious payload in the "diagnose… |
CVE-2021-22130 | Medium | 6.7 | 2021-06-03 | A stack-based buffer overflow vulnerability in FortiProxy physical appliance CLI 2.0.0 to 2.0.1, 1.2.0 to 1.2.9, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 may allow an au… |
CVE-2021-24012 | Medium | 6.5 | 2021-06-02 | An improper following of a certificate's chain of trust vulnerability in FortiGate versions 6.4.0 to 6.4.4 may allow an LDAP user to connect to SSLVPN with any… |
CVE-2020-6641 | Medium | 4.3 | 2021-06-02 | Two authorization bypass through user-controlled key vulnerabilities in the Fortinet FortiPresence 2.1.0 administration interface may allow an attacker to gain… |
CVE-2021-26111 | Medium | 6.5 | 2021-06-01 | A missing release of memory after effective lifetime vulnerability in FortiSwitch 6.4.0 to 6.4.6, 6.2.0 to 6.2.6, 6.0.0 to 6.0.6, 3.6.11 and below may allow an… |
CVE-2021-22123 | High | 7.6 | 2021-06-01 | An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated… |
CVE-2021-24011 | Medium | 6.3 | 2021-05-10 | A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges. |
CVE-2021-24024 | Medium | 4.3 | 2021-04-12 | A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5.3.7 and below may… |
CVE-2020-15942 | Medium | 4.3 | 2021-04-12 | An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may al… |
CVE-2019-17656 | Medium | 5.4 | 2021-04-12 | A Stack-based Buffer Overflow vulnerability in the HTTPD daemon of FortiOS 6.0.10 and below, 6.2.2 and below and FortiProxy 1.0.x, 1.1.x, 1.2.9 and below, 2.0… |
CVE-2021-22128 | High | 7.1 | 2021-03-04 | An improper access control vulnerability in FortiProxy SSL VPN portal 2.0.0, 1.2.9 and below versions may allow an authenticated, remote attacker to access int… |
CVE-2020-15938 | Medium | 4.0 | 2021-03-04 | When traffic other than HTTP/S (eg: SSH traffic, etc...) traverses the FortiGate in version below 6.2.5 and below 6.4.2 on port 80/443, it is not redirected to… |
CVE-2020-15937 | Medium | 4.7 | 2021-03-03 | An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored… |
CVE-2021-22122 | Medium | 6.1 | 2021-02-08 | An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthentica… |
CVE-2020-6649 | Critical | 9.8 | 2021-02-08 | An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user se… |
CVE-2020-29019 | Medium | 5.3 | 2021-01-14 | A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow a remote, unauthenticated attacker to crash the… |
CVE-2020-29018 | High | 8.8 | 2021-01-14 | A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive… |
CVE-2020-29017 | High | 8.8 | 2021-01-14 | An OS command injection vulnerability in FortiDeceptor 3.1.0, 3.0.1, 3.0.0 may allow a remote authenticated attacker to execute arbitrary commands on the syste… |
CVE-2020-29016 | Critical | 9.8 | 2021-01-14 | A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.5 and version before 6.2.4 may allow an unauthenticated, remote attacker to overwrite… |
CVE-2020-29015 | Critical | 9.8 | 2021-01-14 | A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute a… |
CVE-2020-6648 | Medium | 5.3 | 2020-10-21 | A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earl… |
CVE-2020-12815 | Medium | 5.4 | 2020-09-24 | An improper neutralization of input vulnerability in FortiTester before 3.9.0 may allow a remote authenticated attacker to inject script related HTML tags via… |
CVE-2020-12811 | Medium | 6.1 | 2020-09-24 | An improper neutralization of script-related HTML tags in a web page in FortiManager 6.2.0, 6.2.1, 6.2.2, and 6.2.3and FortiAnalyzer 6.2.0, 6.2.1, 6.2.2, and 6… |
CVE-2020-12818 | Medium | 5.3 | 2020-09-24 | An insufficient logging vulnerability in FortiGate before 6.4.1 may allow the traffic from an unauthenticated attacker to Fortinet owned IP addresses to go unn… |
CVE-2020-12817 | High | 8.8 | 2020-09-24 | An improper neutralization of input vulnerability in FortiAnalyzer before 6.4.1 and 6.2.5 may allow a remote authenticated attacker to inject script related HT… |
CVE-2020-12816 | Medium | 6.1 | 2020-09-24 | An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authenticated attacker to perform a stored cross site scripting a… |
CVE-2019-5591 | Medium | 6.5 | 2020-08-14 | A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating t… |
CVE-2020-12812 | Critical | 9.8 | 2020-07-24 | An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully wi… |
CVE-2020-9288 | Medium | 5.4 | 2020-06-22 | An improper neutralization of input vulnerability in FortiWLC 8.5.1 allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS… |
CVE-2020-6644 | High | 8.1 | 2020-06-22 | An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user session IDs to gain admi… |
CVE-2020-9289 | High | 7.5 | 2020-06-16 | Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and below may allow an… |