CVSS: 3.7EPSS: 0%CPEs: 7EXPL: 0CVE-2024-36511
https://notcve.org/view.php?id=CVE-2024-36511
10 Sep 2024 — An improperly implemented security check for standard vulnerability [CWE-358] in FortiADC Web Application Firewall (WAF) 7.4.0 through 7.4.4, 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions when cookie security policy is enabled may allow an attacker, under specific conditions, to retrieve the initial encrypted and signed cookie protected by the feature Una verificación de seguridad implementada incorrectamente para la vulnerabilidad estándar [CWE-3... • https://fortiguard.fortinet.com/psirt/FG-IR-22-256 • CWE-358: Improperly Implemented Security Check for Standard •
CVSS: 7.4EPSS: 0%CPEs: 5EXPL: 0CVE-2023-50178
https://notcve.org/view.php?id=CVE-2023-50178
09 Jul 2024 — An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2.0 through 7.2.3, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and various remote servers such as private SDN connectors and FortiToken Cloud. • https://fortiguard.fortinet.com/psirt/FG-IR-22-298 • CWE-295: Improper Certificate Validation •
CVSS: 6.8EPSS: 0%CPEs: 7EXPL: 0CVE-2023-50181
https://notcve.org/view.php?id=CVE-2023-50181
09 Jul 2024 — An improper access control vulnerability [CWE-284] in Fortinet FortiADC version 7.4.0 through 7.4.1 and before 7.2.4 allows a read only authenticated attacker to perform some write actions via crafted HTTP or HTTPS requests. • https://fortiguard.fortinet.com/psirt/FG-IR-23-469 • CWE-284: Improper Access Control •
CVSS: 5.9EPSS: 0%CPEs: 4EXPL: 0CVE-2023-50179
https://notcve.org/view.php?id=CVE-2023-50179
09 Jul 2024 — An improper certificate validation vulnerability [CWE-295] in FortiADC 7.4.0, 7.2 all versions, 7.1 all versions, 7.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and public SDN connectors. • https://fortiguard.fortinet.com/psirt/FG-IR-23-480 • CWE-295: Improper Certificate Validation •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-50180
https://notcve.org/view.php?id=CVE-2023-50180
14 May 2024 — An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiADC version 7.4.1 and below, version 7.2.3 and below, version 7.1.4 and below, version 7.0.5 and below, version 6.2.6 and below may allow a read-only admin to view data pertaining to other admins. Una exposición de información confidencial del sistema a una vulnerabilidad de esfera de control no autorizada [CWE-497] en FortiADC versión 7.4.1 e inferior, versión 7.2.3 e inferior, versión 7.1.4 e infe... • https://fortiguard.com/psirt/FG-IR-23-433 • CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere •
CVSS: 7.1EPSS: 0%CPEs: 9EXPL: 0CVE-2023-41673
https://notcve.org/view.php?id=CVE-2023-41673
13 Dec 2023 — An improper authorization vulnerability [CWE-285] in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to read or backup the full system configuration via HTTP or HTTPS requests. Una vulnerabilidad de autorización inadecuada [CWE-285] en Fortinet FortiADC versión 7.4.0 y anteriores a 7.2.2 puede permitir que un usuario con pocos privilegios lea o haga una copia de seguridad de la configuración completa del sistema a través de solicitudes HTTP o HTTPS. • https://fortiguard.com/psirt/FG-IR-23-270 • CWE-285: Improper Authorization •
CVSS: 9.4EPSS: 0%CPEs: 5EXPL: 0CVE-2023-25603
https://notcve.org/view.php?id=CVE-2023-25603
14 Nov 2023 — A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4.0 - 6.4.1 allow an unauthorized attacker to carry out privileged actions and retrieve sensitive information via crafted web requests. Una política permisiva entre dominios con vulnerabilidad de dominios que no son de confianza en Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 y 6.4.0 - 6.4.1 permite a un atacante no autorizado realizar acciones privilegiadas... • https://fortiguard.com/psirt/FG-IR-22-518 • CWE-942: Permissive Cross-domain Policy with Untrusted Domains •
CVSS: 6.7EPSS: 0%CPEs: 14EXPL: 0CVE-2023-29177
https://notcve.org/view.php?id=CVE-2023-29177
14 Nov 2023 — Multiple buffer copy without checking size of input ('classic buffer overflow') vulnerabilities [CWE-120] in FortiADC version 7.2.0 and before 7.1.2 & FortiDDoS-F version 6.5.0 and before 6.4.1 allows a privileged attacker to execute arbitrary code or commands via specifically crafted CLI requests. Las vulnerabilidades de copia de búfer múltiple sin verificar el tamaño de entrada ('desbordamiento del búfer clásico') [CWE-120] en FortiADC versión 7.2.0 y anteriores a 7.1.2 y FortiDDoS-F versión 6.5.0 y anter... • https://fortiguard.com/psirt/FG-IR-23-064 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 0CVE-2023-26205
https://notcve.org/view.php?id=CVE-2023-26205
14 Nov 2023 — An improper access control vulnerability [CWE-284] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6.1 all versions may allow an authenticated low-privileged attacker to escalate their privileges to super_admin via a specific crafted configuration of fabric automation CLI script. Una vulnerabilidad de control de acceso inadecuado [CWE-284] en la función de automatización FortiADC 7.1.0 a 7.1.2, 7.0 todas las versiones, 6.2 todas las versiones, 6.1 todas las versiones ... • https://fortiguard.com/psirt/FG-IR-22-292 • CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 0%CPEs: 18EXPL: 0CVE-2023-25607
https://notcve.org/view.php?id=CVE-2023-25607
10 Oct 2023 — An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78 ] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions, FortiAnalyzer 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions and FortiADC 7.1.0, 7.0.0 through 7.0.3, 6.2 all versions, 6.1 all versions, 6.0 all versions management interface may allow an authenticated attacker with at least ... • https://fortiguard.com/psirt/FG-IR-22-352 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •