CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-15937
https://notcve.org/view.php?id=CVE-2020-15937
An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack (XSS) via the IPS and WAF logs dashboard. Una vulnerabilidad de neutralización inapropiada de la entrada en FortiGate versiones 6.2.x por debajo de 6.2.5 y versiones 6.4.x por debajo de 6.4.1, puede permitir a un atacante remoto llevar a cabo un ataque de tipo cross site scripting (XSS) almacenado por medio del panel de registros de IPS y WAF • https://fortiguard.com/advisory/FG-IR-20-068 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 36EXPL: 0CVE-2020-12818
https://notcve.org/view.php?id=CVE-2020-12818
An insufficient logging vulnerability in FortiGate before 6.4.1 may allow the traffic from an unauthenticated attacker to Fortinet owned IP addresses to go unnoticed. Una vulnerabilidad de registro insuficiente en FortiGate versiones anteriores a 6.4.1, puede permitir que el tráfico de un atacante no autenticado hacia direcciones IP propiedad de Fortinet pase desapercibido. • https://fortiguard.com/advisory/FG-IR-20-033 https://www.fortiguard.com/psirt/FG-IR-20-033 •
CVSS: 9.8EPSS: 2%CPEs: 3EXPL: 0CVE-2020-12812 – Fortinet FortiOS SSL VPN Improper Authentication Vulnerability
https://notcve.org/view.php?id=CVE-2020-12812
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username. Una vulnerabilidad de autenticación inapropiada en SSL VPN en FortiOS versiones 6.4.0, 6.2.0 a 6.2.3, 6.0.9 y posteriores, puede resultar en que un usuario sea capaz de iniciar sesión con éxito sin que sea requerido el segundo factor de autenticación (FortiToken) si cambiaron el caso de su nombre de usuario Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username. • https://fortiguard.com/psirt/FG-IR-19-283 • CWE-178: Improper Handling of Case Sensitivity CWE-287: Improper Authentication •