CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2024-31490
https://notcve.org/view.php?id=CVE-2024-31490
An exposure of sensitive information to an unauthorized actor in Fortinet FortiSandbox version 4.4.0 through 4.4.4 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.5 and 3.2.2 through 3.2.4 and 3.1.5 allows attacker to information disclosure via HTTP get requests. Una exposición de información confidencial a un actor no autorizado en Fortinet FortiSandbox versión 4.4.0 a 4.4.4 y 4.2.0 a 4.2.6 y 4.0.0 a 4.0.5 y 3.2.2 a 3.2.4 y 3.1.5 permite a un atacante divulgar información a través de solicitudes de obtención HTTP. • https://fortiguard.com/psirt/FG-IR-24-051 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.7EPSS: 0%CPEs: 5EXPL: 0CVE-2023-47540
https://notcve.org/view.php?id=CVE-2023-47540
An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSandbox version 4.4.0 through 4.4.2 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.5 and 3.2.0 through 3.2.4 and 3.0.5 through 3.0.7 may allows attacker to execute unauthorized code or commands via CLI. Una neutralización inadecuada de elementos especiales utilizados en un comando del sistema operativo ('inyección de comando del sistema operativo') en Fortinet FortiSandbox versión 4.4.0 a 4.4.2 y 4.2.0 a 4.2.6 y 4.0.0 a 4.0.5 y 3.2.0 a través 3.2.4 y 3.0.5 a 3.0.7 pueden permitir a un atacante ejecutar código o comandos no autorizados a través de CLI. • https://fortiguard.com/psirt/FG-IR-23-411 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.9EPSS: 0%CPEs: 8EXPL: 0CVE-2024-31487
https://notcve.org/view.php?id=CVE-2024-31487
A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiSandbox version 4.4.0 through 4.4.4 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.5 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.0 through 3.0.7 and 2.5.0 through 2.5.2 and 2.4.0 through 2.4.1 may allows attacker to information disclosure via crafted http requests. Una limitación inadecuada de un nombre de ruta a un directorio restringido ("path traversal") en Fortinet FortiSandbox versión 4.4.0 a 4.4.4 y 4.2.0 a 4.2.6 y 4.0.0 a 4.0.5 y 3.2.0 a 3.2. 4 y 3.1.0 a 3.1.5 y 3.0.0 a 3.0.7 y 2.5.0 a 2.5.2 y 2.4.0 a 2.4.1 pueden permitir al atacante la divulgación de información a través de solicitudes http manipuladas. • https://fortiguard.com/psirt/FG-IR-24-060 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.7EPSS: 0%CPEs: 12EXPL: 0CVE-2023-47541
https://notcve.org/view.php?id=CVE-2023-47541
An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiSandbox version 4.4.0 through 4.4.2 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.5 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.0 through 3.0.7 and 2.5.0 through 2.5.2 and 2.4.0 through 2.4.1 and 2.3.0 through 2.3.3 and 2.2.0 through 2.2.2 and 2.1.0 through 2.1.3 and 2.0.0 through 2.0.3 allows attacker to execute unauthorized code or commands via CLI. Una limitación inadecuada de un nombre de ruta a un directorio restringido ("path traversal") en Fortinet FortiSandbox versión 4.4.0 a 4.4.2 y 4.2.0 a 4.2.6 y 4.0.0 a 4.0.5 y 3.2.0 a 3.2. 4 y 3.1.0 a 3.1.5 y 3.0.0 a 3.0.7 y 2.5.0 a 2.5.2 y 2.4.0 a 2.4.1 y 2.3.0 a 2.3.3 y 2.2.0 a 2.2.2 y 2.1.0 a 2.1.3 y 2.0.0 a 2.0.3 permiten a un atacante ejecutar código o comandos no autorizados a través de CLI. • https://fortiguard.com/psirt/FG-IR-23-416 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.4EPSS: 0%CPEs: 8EXPL: 0CVE-2023-41844
https://notcve.org/view.php?id=CVE-2023-41844
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSandbox version 4.4.1 and 4.4.0 and 4.2.0 through 4.2.5 and 4.0.0 through 4.0.3 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.0 through 3.0.4 allows attacker to execute unauthorized code or commands via crafted HTTP requests in capture traffic endpoint. Una neutralización inadecuada de la entrada durante la generación de la página web ("cross-site scripting") en Fortinet FortiSandbox versión 4.4.1 y 4.4.0 y 4.2.0 a 4.2.5 y 4.0.0 a 4.0.3 y 3.2.0 a 3.2 .4 y 3.1.0 a 3.1.5 y 3.0.0 a 3.0.4 permiten a un atacante ejecutar código o comandos no autorizados a través de solicitudes HTTP manipuladas en el endpoint de captura de tráfico. • https://fortiguard.com/psirt/FG-IR-23-214 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •