CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2021-26103
https://notcve.org/view.php?id=CVE-2021-26103
08 Dec 2021 — An insufficient verification of data authenticity vulnerability (CWE-345) in the user interface of FortiProxy verison 2.0.3 and below, 1.2.11 and below and FortiGate verison 7.0.0, 6.4.6 and below, 6.2.9 and below of SSL VPN portal may allow a remote, unauthenticated attacker to conduct a cross-site request forgery (CSRF) attack . Only SSL VPN in web mode or full mode are impacted by this vulnerability. Una vulnerabilidad de verificación insuficiente de la autenticidad de los datos (CWE-345) en la interfaz ... • https://fortiguard.com/advisory/FG-IR-20-158 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 6.7EPSS: 0%CPEs: 30EXPL: 0CVE-2021-42757
https://notcve.org/view.php?id=CVE-2021-42757
08 Dec 2021 — A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments. Un desbordamiento de búfer [CWE-121] en la biblioteca del cliente TFTP de FortiOS versiones anteriores a 6.4.7 y FortiOS versiones 7.0.0 hasta 7.0.2, puede permitir a un atacante local autenticado lograr una ejecución de código arbitrario por medio de argumentos de línea de c... • https://fortiguard.com/advisory/FG-IR-21-173 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2021-26110
https://notcve.org/view.php?id=CVE-2021-26110
08 Dec 2021 — An improper access control vulnerability [CWE-284] in FortiOS autod daemon 7.0.0, 6.4.6 and below, 6.2.9 and below, 6.0.12 and below and FortiProxy 2.0.1 and below, 1.2.9 and below may allow an authenticated low-privileged attacker to escalate their privileges to super_admin via a specific crafted configuration of fabric automation CLI script and auto-script features. Una vulnerabilidad de control de acceso inapropiado [CWE-284] en el demonio autod de FortiOS versiones 7.0.0, 6.4.6 y anteriores, 6.2.9 y ant... • https://fortiguard.com/advisory/FG-IR-20-131 •
CVSS: 5.0EPSS: 0%CPEs: 5EXPL: 0CVE-2021-32600
https://notcve.org/view.php?id=CVE-2021-32600
17 Nov 2021 — An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS CLI 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, 6.0.x and 5.6.x may allow a local and authenticated user assigned to a specific VDOM to retrieve other VDOMs information such as the admin account list and the network interface list. Una vulnerabilidad de exposición de información confidencial a un actor no autorizado en FortiOS CLI versiones 7.0.0, 6.4.0 a 6.4.6, 6.2.0 a 6.2.9, 6.0.x y 5.6.x, puede permitir a un usuar... • https://fortiguard.com/advisory/FG-IR-20-243 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41019
https://notcve.org/view.php?id=CVE-2021-41019
02 Nov 2021 — An improper validation of certificate with host mismatch [CWE-297] vulnerability in FortiOS versions 6.4.6 and below may allow the connection to a malicious LDAP server via options in GUI, leading to disclosure of sensitive information, such as AD credentials. Una vulnerabilidad de comprobación inapropiada de certificado con desajuste de host [CWE-297] en FortiOS versiones 6.4.6 y por debajo, de puede permitir la conexión a un servidor LDAP malicioso por medio de las opciones de la interfaz gráfica de usuar... • https://fortiguard.com/advisory/FG-IR-21-074 • CWE-295: Improper Certificate Validation •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-24018
https://notcve.org/view.php?id=CVE-2021-24018
04 Aug 2021 — A buffer underwrite vulnerability in the firmware verification routine of FortiOS before 7.0.1 may allow an attacker located in the adjacent network to potentially execute arbitrary code via a specifically crafted firmware image. Una vulnerabilidad de subescritura del búfer en la rutina de verificación del firmware de FortiOS versiones anteriores a 7.0.1, puede permitir a un atacante ubicado en la red adyacente ejecutar potencialmente código arbitrario por medio de una imagen de firmware específicamente dis... • https://fortiguard.com/advisory/FG-IR-21-046 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24012
https://notcve.org/view.php?id=CVE-2021-24012
02 Jun 2021 — An improper following of a certificate's chain of trust vulnerability in FortiGate versions 6.4.0 to 6.4.4 may allow an LDAP user to connect to SSLVPN with any certificate that is signed by a trusted Certificate Authority. Una vulnerabilidad de seguimiento impropio de la cadena de confianza de un certificado FortiGate versiones 6.4.0 hasta 6.4.4, puede permitir a un usuario de LDAP conectarse a SSLVPN con cualquier certificado que esté firmado por una Autoridad de Certificación confiable • https://fortiguard.com/advisory/FG-IR-21-018 • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-15938
https://notcve.org/view.php?id=CVE-2020-15938
04 Mar 2021 — When traffic other than HTTP/S (eg: SSH traffic, etc...) traverses the FortiGate in version below 6.2.5 and below 6.4.2 on port 80/443, it is not redirected to the transparent proxy policy for processing, as it doesn't have a valid HTTP header. Cuando el tráfico que no es HTTP/S (por ejemplo: tráfico SSH, etc.) atraviesa el FortiGate en versiones inferiores a 6.2.5 y por debajo de 6.4.2 en el puerto 80/443, no se redirecciona hacia la política de proxy transparente para su procesamiento, ya que no presenta ... • https://fortiguard.com/advisory/FG-IR-20-172 •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-15937
https://notcve.org/view.php?id=CVE-2020-15937
03 Mar 2021 — An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack (XSS) via the IPS and WAF logs dashboard. Una vulnerabilidad de neutralización inapropiada de la entrada en FortiGate versiones 6.2.x por debajo de 6.2.5 y versiones 6.4.x por debajo de 6.4.1, puede permitir a un atacante remoto llevar a cabo un ataque de tipo cross site scripting (XSS) almacenado por medio del panel de reg... • https://fortiguard.com/advisory/FG-IR-20-068 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 36EXPL: 0CVE-2020-12818
https://notcve.org/view.php?id=CVE-2020-12818
24 Sep 2020 — An insufficient logging vulnerability in FortiGate before 6.4.1 may allow the traffic from an unauthenticated attacker to Fortinet owned IP addresses to go unnoticed. Una vulnerabilidad de registro insuficiente en FortiGate versiones anteriores a 6.4.1, puede permitir que el tráfico de un atacante no autenticado hacia direcciones IP propiedad de Fortinet pase desapercibido. • https://fortiguard.com/advisory/FG-IR-20-033 •