CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-41840
https://notcve.org/view.php?id=CVE-2023-41840
A untrusted search path vulnerability in Fortinet FortiClientWindows 7.0.9 allows an attacker to perform a DLL Hijack attack via a malicious OpenSSL engine library in the search path. Una vulnerabilidad de ruta de búsqueda no confiable en Fortinet FortiClientWindows 7.0.9 permite a un atacante realizar un ataque de DLL Hijack a través de una librería de motor OpenSSL malicioso en la ruta de búsqueda. • https://fortiguard.com/psirt/FG-IR-23-274 • CWE-426: Untrusted Search Path •
CVSS: 3.3EPSS: 0%CPEs: 13EXPL: 0CVE-2023-37939
https://notcve.org/view.php?id=CVE-2023-37939
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClient for Windows 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions, Linux 7.2.0, 7.0 all versions, 6.4 all versions, 6.2 all versions and Mac 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions, 6.2 all versions, may allow a local authenticated attacker with no Administrative privileges to retrieve the list of files or folders excluded from malware scanning. Una exposición de información confidencial a una vulnerabilidad de actor no autorizado [CWE-200] en FortiClient para Windows 7.2.0, 7.0 todas las versiones, 6.4 todas las versiones, 6.2 todas las versiones, Linux 7.2.0, 7.0 todas las versiones, 6.4 todas las versiones, 6.2 todas y Mac 7.2.0 a 7.2.1, 7.0 todas las versiones, 6.4 todas las versiones, 6.2 todas las versiones, pueden permitir que un atacante local autenticado sin privilegios administrativos recupere la lista de archivos o carpetas excluidas del análisis de malware. • https://fortiguard.com/psirt/FG-IR-22-235 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-44172
https://notcve.org/view.php?id=CVE-2021-44172
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClientEMS versions 7.0.0 through 7.0.4, 7.0.6 through 7.0.7, in all 6.4 and 6.2 version management interface may allow an unauthenticated attacker to gain information on environment variables such as the EMS installation path. Una vulnerabilidad de exposición de información sensible a un actor no autorizado [CWE-200] en FortiClientEMS versiones 7.0.0 a 7.0.4, 7.0.6 a 7.0.7, en todas las versiones de interfaz de administración 6.4 y 6.2 puede permitir que un atacante no autenticado obtenga información en variables de entorno como la ruta de instalación de EMS • https://fortiguard.com/psirt/FG-IR-21-244 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.0EPSS: 0%CPEs: 6EXPL: 0CVE-2022-33877
https://notcve.org/view.php?id=CVE-2022-33877
An incorrect default permission [CWE-276] vulnerability in FortiClient (Windows) versions 7.0.0 through 7.0.6 and 6.4.0 through 6.4.8 and FortiConverter (Windows) versions 6.2.0 through 6.2.1, 7.0.0 and all versions of 6.0.0 may allow a local authenticated attacker to tamper with files in the installation folder, if FortiClient or FortiConverter is installed in an insecure folder. • https://fortiguard.com/psirt/FG-IR-22-229 • CWE-276: Incorrect Default Permissions •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-43946 – Fortinet FortiClient VPN Improper Access Control Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-43946
Multiple vulnerabilities including an incorrect permission assignment for critical resource [CWE-732] vulnerability and a time-of-check time-of-use (TOCTOU) race condition [CWE-367] vulnerability in Fortinet FortiClientWindows before 7.0.7 allows attackers on the same file sharing network to execute commands via writing data into a windows pipe. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fortinet FortiClient VPN. Authentication is required to exploit this vulnerability. The specific flaw exists within the FortiClient Logging daemon. The product applies insufficient access controls to a sensitive pipe. A remote attacker can leverage this vulnerability to execute code in the context of SYSTEM. • https://fortiguard.com/psirt/FG-IR-22-429 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition CWE-732: Incorrect Permission Assignment for Critical Resource •