CVSS: 10.0EPSS: 90%CPEs: 25EXPL: 10CVE-2023-27997 – Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2023-27997
13 Jun 2023 — A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests. Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability whic... • https://github.com/rio128128/CVE-2023-27997-POC • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 93%CPEs: 40EXPL: 9CVE-2022-42475 – Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2022-42475
02 Jan 2023 — A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. Una vulnerabilidad de desbordamiento de búfer de almacenamiento dinámico [CWE-122] en FortiOS SSL-VPN 7.2.0 a 7.2.2, 7.0.0 a 7.0.8, 6.4.0 a 6.4.10, 6.2.0 a ... • https://github.com/0xhaggis/CVE-2022-42475 • CWE-197: Numeric Truncation Error CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 18EXPL: 0CVE-2021-36173
https://notcve.org/view.php?id=CVE-2021-36173
08 Dec 2021 — A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, and 6.0.0 through 6.0.13 may allow an attacker to execute arbitrary code via specially crafted installation images. Un desbordamiento de búfer en la región heap de la memoria en la función firmware signature verification de FortiOS versiones 7.0.1, 7.0.0, 6.4.0 hasta 6.4.6, 6.2.0 hasta 6.2.9 y 6.0.0 hasta 6.0.13, puede permitir a un atacante ejecutar código... • https://fortiguard.com/advisory/FG-IR-21-115 • CWE-787: Out-of-bounds Write •
CVSS: 5.3EPSS: 0%CPEs: 36EXPL: 0CVE-2020-12818
https://notcve.org/view.php?id=CVE-2020-12818
24 Sep 2020 — An insufficient logging vulnerability in FortiGate before 6.4.1 may allow the traffic from an unauthenticated attacker to Fortinet owned IP addresses to go unnoticed. Una vulnerabilidad de registro insuficiente en FortiGate versiones anteriores a 6.4.1, puede permitir que el tráfico de un atacante no autenticado hacia direcciones IP propiedad de Fortinet pase desapercibido. • https://fortiguard.com/advisory/FG-IR-20-033 •
CVSS: 8.8EPSS: 0%CPEs: 33EXPL: 3CVE-2013-1414 – Fortigate Firewalls - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2013-1414
28 Jun 2013 — Multiple cross-site request forgery (CSRF) vulnerabilities in Fortinet FortiOS on FortiGate firewall devices before 4.3.13 and 5.x before 5.0.2 allow remote attackers to hijack the authentication of administrators for requests that modify (1) settings or (2) policies, or (3) restart the device via a rebootme action to system/maintenance/shutdown. Múltiples vulnerabilidades de falsificación de peticiones en sitios cruzados (CSRF) en Fortinet FortiOS en el dispositivo firewall FortiGate anteriores a v4.3.13 y... • https://packetstorm.news/files/id/122216 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.4EPSS: 0%CPEs: 29EXPL: 0CVE-2012-4948
https://notcve.org/view.php?id=CVE-2012-4948
14 Nov 2012 — The default configuration of Fortinet Fortigate UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Fortinet_CA_SSLProxy certificate in a list of trusted root certification authorities. La configuración predeterminada de Fortinet FortiGate UTM utiliza el mismo certificado de la autoridad de certificación (CA) y la misma clav... • http://osvdb.org/87048 • CWE-295: Improper Certificate Validation •
CVSS: 9.1EPSS: 1%CPEs: 1EXPL: 2CVE-2008-7161 – Fortinet Fortigate - CRLF Characters URL Filtering Bypass
https://notcve.org/view.php?id=CVE-2008-7161
04 Sep 2009 — Fortinet FortiGuard Fortinet FortiGate-1000 3.00 build 040075,070111 allows remote attackers to bypass URL filtering via fragmented GET or POST requests that use HTTP/1.0 without the Host header. NOTE: this issue might be related to CVE-2005-3058. Fortinet FortiGuard Fortinet FortiGate-1000 v3.00 build 040075,070111 permite a atacantes remotos evitar el filtrado URL a través de una petición GET o POST fragmentada que utiliza HTTP/1.0 sin la cabecera Host. Nota: este caso podría estar relacionado con CVE-200... • https://www.exploit-db.com/exploits/31026 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 1%CPEs: 3EXPL: 0CVE-2005-3057
https://notcve.org/view.php?id=CVE-2005-3057
31 Dec 2005 — The FTP component in FortiGate 2.8 running FortiOS 2.8MR10 and v3beta, and other versions before 3.0 MR1, allows remote attackers to bypass the Fortinet FTP anti-virus engine by sending a STOR command and uploading a file before the FTP server response has been sent, as demonstrated using LFTP. • http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/042139.html •
CVSS: 7.5EPSS: 5%CPEs: 3EXPL: 1CVE-2005-3058 – Fortinet Fortigate 2.x/3.0 - URL Filtering Bypass
https://notcve.org/view.php?id=CVE-2005-3058
31 Dec 2005 — Interpretation conflict in Fortinet FortiGate 2.8, running FortiOS 2.8MR10 and v3beta, allows remote attackers to bypass the URL blocker via an (1) HTTP request terminated with a line feed (LF) and not carriage return line feed (CRLF) or (2) HTTP request with no Host field, which is still processed by most web servers without violating RFC2616. • https://www.exploit-db.com/exploits/27203 • CWE-264: Permissions, Privileges, and Access Controls •