
CVE-2024-23671
https://notcve.org/view.php?id=CVE-2024-23671
09 Apr 2024 — A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiSandbox version 4.4.0 through 4.4.3 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted HTTP requests. Una limitación inadecuada de un nombre de ruta a un directorio restringido ("path traversal") en Fortinet FortiSandbox versión 4.4.0 a 4.4.3 y 4.2.0 a 4.2.6 y 4.0.0 a 4.0.4 permite a un atacante ejecutar código no autorizado o comandos a través d... • https://fortiguard.com/psirt/FG-IR-23-454 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVE-2023-47541
https://notcve.org/view.php?id=CVE-2023-47541
09 Apr 2024 — An improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiSandbox version 4.4.0 through 4.4.2 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.5 and 3.2.0 through 3.2.4 and 3.1.0 through 3.1.5 and 3.0.0 through 3.0.7 and 2.5.0 through 2.5.2 and 2.4.0 through 2.4.1 and 2.3.0 through 2.3.3 and 2.2.0 through 2.2.2 and 2.1.0 through 2.1.3 and 2.0.0 through 2.0.3 allows attacker to execute unauthorized code or commands via CLI. Una limitación inadecuada de un nombre de ruta ... • https://fortiguard.com/psirt/FG-IR-23-416 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVE-2023-45590
https://notcve.org/view.php?id=CVE-2023-45590
09 Apr 2024 — An improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 through 7.0.4 allows attacker to execute unauthorized code or commands via tricking a FortiClientLinux user into visiting a malicious website Un control inadecuado de la generación de código ("inyección de código") en Fortinet FortiClientLinux versión 7.2.0, 7.0.6 a 7.0.10 y 7.0.3 a 7.0.4 permite a un atacante ejecutar código o comandos no autorizados engañando a un usuario... • https://fortiguard.com/psirt/FG-IR-23-087 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVE-2024-23662
https://notcve.org/view.php?id=CVE-2024-23662
09 Apr 2024 — An exposure of sensitive information to an unauthorized actor in Fortinet FortiOS at least version at least 7.4.0 through 7.4.1 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.15 and 6.4.0 through 6.4.15 allows attacker to information disclosure via HTTP requests. La exposición de información confidencial a un actor no autorizado en Fortinet FortiOS al menos en la versión 7.4.0 a 7.4.1 y 7.2.0 a 7.2.5 y 7.0.0 a 7.0.15 y 6.4.0 a 6.4.15 permite al atacante a la divulgación de información a través de solicitudes... • https://fortiguard.com/psirt/FG-IR-23-224 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVE-2023-47534
https://notcve.org/view.php?id=CVE-2023-47534
12 Mar 2024 — A improper neutralization of formula elements in a csv file in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.10, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8 allows attacker to execute unauthorized code or commands via specially crafted packets. Una neutralización inadecuada de elementos de fórmula en un archivo csv en Fortinet FortiClientEMS versión 7.2.0 hasta 7.2.2, 7.0.0 hasta 7.0.10, 6.4.0 hasta 6.4.9, 6.2.0 hasta 6.2.9, 6.0.0 hasta 6.0.8 permite al atacante ej... • https://fortiguard.com/psirt/FG-IR-23-390 • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •

CVE-2023-46717
https://notcve.org/view.php?id=CVE-2023-46717
12 Mar 2024 — An improper authentication vulnerability [CWE-287] in FortiOS versions 7.4.1 and below, versions 7.2.6 and below, and versions 7.0.12 and below when configured with FortiAuthenticator in HA may allow a readonly user to gain read-write access via successive login attempts. Una vulnerabilidad de autenticación incorrecta [CWE-287] en las versiones 7.4.1 y anteriores de FortiOS, las versiones 7.2.6 y siguientes y las versiones 7.0.12 y siguientes cuando se configura con FortiAuthenticator en HA puede permitir q... • https://fortiguard.com/psirt/FG-IR-23-424 • CWE-287: Improper Authentication •

CVE-2023-48788 – Fortinet FortiClient EMS SQL Injection Vulnerability
https://notcve.org/view.php?id=CVE-2023-48788
12 Mar 2024 — A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets. Una neutralización inadecuada de elementos especiales utilizados en un comando sql ("inyección sql") en Fortinet FortiClientEMS versión 7.2.0 a 7.2.2, FortiClientEMS 7.0.1 a 7.0.10 permite a un atacante ejecutar código o comandos no autorizados ... • https://packetstorm.news/files/id/178230 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVE-2023-42789
https://notcve.org/view.php?id=CVE-2023-42789
12 Mar 2024 — A out-of-bounds write in Fortinet FortiOS 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13 allows attacker to execute unauthorized code or commands via specially crafted HTTP requests. Una escritura fuera de límites en Fortinet FortiOS 7.4.0 a 7.4.1, 7.2.0 a 7.2.5, 7.0.0 a 7.0.12, 6.4.0 a 6.4.14, 6.2.0 a 6.2.15, FortiProxy 7.4.0, 7.2.0 a 7.2.6, 7.0.0 a 7.0.12, 2.0.0 a ... • https://github.com/jhonnybonny/CVE-2023-42789 • CWE-787: Out-of-bounds Write •

CVE-2024-23112
https://notcve.org/view.php?id=CVE-2024-23112
12 Mar 2024 — An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.1 through 7.0.13, 6.4.7 through 6.4.14, and FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 SSL-VPN may allow an authenticated attacker to gain access to another user’s bookmark via URL manipulation. Una omisión de autorización a través de una vulnerabilidad de clave controlada por el usuario [CWE-639] en FortiOS versión 7.4.0 a 7.4.1,... • https://github.com/zgimszhd61/CVE-2024-23112 • CWE-639: Authorization Bypass Through User-Controlled Key •

CVE-2023-42790
https://notcve.org/view.php?id=CVE-2023-42790
12 Mar 2024 — A stack-based buffer overflow in Fortinet FortiOS 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13 allows attacker to execute unauthorized code or commands via specially crafted HTTP requests. Un desbordamiento de búfer en la región stack de la memoria en Fortinet FortiOS 7.4.0 a 7.4.1, 7.2.0 a 7.2.5, 7.0.0 a 7.0.12, 6.4.0 a 6.4.14, 6.2.0 a 6.2.15, FortiProxy 7.4.0, 7.... • https://fortiguard.com/psirt/FG-IR-23-328 • CWE-121: Stack-based Buffer Overflow •