CVSS: 8.8EPSS: 0%CPEs: 14EXPL: 0CVE-2022-33869
https://notcve.org/view.php?id=CVE-2022-33869
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiWAN 4.0.0 through 4.5.9 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands. • https://fortiguard.com/psirt/FG-IR-22-157 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-26113
https://notcve.org/view.php?id=CVE-2021-26113
A use of a one-way hash with a predictable salt vulnerability [CWE-760] in FortiWAN before 4.5.9 may allow an attacker who has previously come in possession of the password file to potentially guess passwords therein stored. El uso de un hash unidireccional con una vulnerabilidad salt predecible [CWE-760] en FortiWAN versiones anteriores a 4.5.9, puede permitir a un atacante que haya entrado previamente en posesión del archivo de contraseñas adivinar potencialmente las contraseñas allí almacenadas • https://fortiguard.com/psirt/FG-IR-21-064 • CWE-916: Use of Password Hash With Insufficient Computational Effort •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2021-32585
https://notcve.org/view.php?id=CVE-2021-32585
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiWAN before 4.5.9 may allow an attacker to perform a stored cross-site scripting attack via specifically crafted HTTP requests. Una neutralización inapropiada de la entrada durante la generación de páginas web [CWE-79] en FortiWAN versiones anteriores a 4.5.9 puede permitir a un atacante llevar a cabo un ataque de tipo cross-site scripting almacenado por medio de peticiones HTTP especialmente diseñadas • https://fortiguard.com/psirt/FG-IR-21-078 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-32593
https://notcve.org/view.php?id=CVE-2021-32593
A use of a broken or risky cryptographic algorithm vulnerability [CWE-327] in the Dynamic Tunnel Protocol of FortiWAN before 4.5.9 may allow an unauthenticated remote attacker to decrypt and forge protocol communication messages. Un uso de una vulnerabilidad de algoritmo criptográfico rota o arriesgada [CWE-327] en el Protocolo de Túnel Dinámico de FortiWAN versiones anteriores a 4.5.9, puede permitir a un atacante remoto no autenticado descifrar y falsificar los mensajes de comunicación del protocolo • https://fortiguard.com/psirt/FG-IR-21-070 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24009
https://notcve.org/view.php?id=CVE-2021-24009
Multiple improper neutralization of special elements used in an OS command vulnerabilities (CWE-78) in the Web GUI of FortiWAN before 4.5.9 may allow an authenticated attacker to execute arbitrary commands on the underlying system's shell via specifically crafted HTTP requests. Una neutralización inapropiada de múltiples elementos especiales usados en un comando del Sistema Operativo (CWE-78) en la interfaz gráfica de usuario web de FortiWAN versiones anteriores a 4.5.9, puede permitir a un atacante autenticado ejecutar comandos arbitrarios en el shell del sistema subyacente por medio de peticiones HTTP específicamente diseñadas • https://fortiguard.com/psirt/FG-IR-21-060 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •