CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-44251
https://notcve.org/view.php?id=CVE-2023-44251
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in Fortinet FortiWAN version 5.2.0 through 5.2.1 and version 5.1.1. through 5.1.2 may allow an authenticated attacker to read and delete arbitrary file of the system via crafted HTTP or HTTPs requests. Una limitación inadecuada de un nombre de ruta a una vulnerabilidad de directorio restringido ("path traversal") [CWE-22] en Fortinet FortiWAN versión 5.2.0 a 5.2.1 y versión 5.1.1. hasta 5.1.2 puede permitir que un atacante autenticado lea y elimine archivos arbitrarios del sistema a través de solicitudes HTTP o HTTP manipuladas. • https://fortiguard.com/psirt/FG-IR-23-265 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-44252
https://notcve.org/view.php?id=CVE-2023-44252
An improper authentication vulnerability [CWE-287] in Fortinet FortiWAN version 5.2.0 through 5.2.1 and version 5.1.1 through 5.1.2 may allow an authenticated attacker to escalate his privileges via HTTP or HTTPs requests with crafted JWT token values. Una vulnerabilidad de autenticación incorrecta [CWE-287] en Fortinet FortiWAN versión 5.2.0 a 5.2.1 y versión 5.1.1 a 5.1.2 puede permitir que un atacante autenticado escale sus privilegios a través de solicitudes HTTP o HTTPs con valores de token JWT manipulados. • https://fortiguard.com/psirt/FG-IR-23-061 • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 0%CPEs: 14EXPL: 0CVE-2022-33869
https://notcve.org/view.php?id=CVE-2022-33869
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiWAN 4.0.0 through 4.5.9 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands. • https://fortiguard.com/psirt/FG-IR-22-157 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-26113
https://notcve.org/view.php?id=CVE-2021-26113
A use of a one-way hash with a predictable salt vulnerability [CWE-760] in FortiWAN before 4.5.9 may allow an attacker who has previously come in possession of the password file to potentially guess passwords therein stored. El uso de un hash unidireccional con una vulnerabilidad salt predecible [CWE-760] en FortiWAN versiones anteriores a 4.5.9, puede permitir a un atacante que haya entrado previamente en posesión del archivo de contraseñas adivinar potencialmente las contraseñas allí almacenadas • https://fortiguard.com/psirt/FG-IR-21-064 • CWE-916: Use of Password Hash With Insufficient Computational Effort •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2021-32585
https://notcve.org/view.php?id=CVE-2021-32585
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiWAN before 4.5.9 may allow an attacker to perform a stored cross-site scripting attack via specifically crafted HTTP requests. Una neutralización inapropiada de la entrada durante la generación de páginas web [CWE-79] en FortiWAN versiones anteriores a 4.5.9 puede permitir a un atacante llevar a cabo un ataque de tipo cross-site scripting almacenado por medio de peticiones HTTP especialmente diseñadas • https://fortiguard.com/psirt/FG-IR-21-078 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •