CVSS: 8.6EPSS: 0%CPEs: 24EXPL: 0CVE-2022-26122
https://notcve.org/view.php?id=CVE-2022-26122
02 Nov 2022 — An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and version 6.4.274 and below may allow an attacker to bypass the AV engine via manipulating MIME attachment with junk and pad characters in base64. Una verificación insuficiente de la vulnerabilidad de autenticidad de datos [CWE-345] en los motores FortiClient, FortiMail y FortiOS AV versión 6.2.168 e inferiores y la versión 6.4.274 e inferiores puede permitir... • https://fortiguard.com/psirt/FG-IR-22-074 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 7.7EPSS: 0%CPEs: 5EXPL: 0CVE-2022-39945
https://notcve.org/view.php?id=CVE-2022-39945
02 Nov 2022 — An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references (IDOR). Una vulnerabilidad de control de acceso inadecuado [CWE-284] en FortiMail 7.2.0, 7.0.0 a 7.0.3, 6.4 todas las versiones, 6.2 todas las versiones, 6.0 todas las versiones puede permitir que un usuario admini... • https://fortiguard.com/psirt/FG-IR-22-066 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-26114
https://notcve.org/view.php?id=CVE-2022-26114
06 Sep 2022 — An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated attacker to trigger a cross-site scripting (XSS) attack via sending specially crafted mail messages. Una vulnerabilidad de neutralización inapropiada de la entrada durante la generación de la página web [CWE-79] en el Webmail de FortiMail versiones anteriores a 7.2.0 puede permitir a un atacante no autenticado desencadenar un ataque de tipo cross-site sc... • https://fortiguard.com/psirt/FG-IR-21-045 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 20EXPL: 0CVE-2022-22299
https://notcve.org/view.php?id=CVE-2022-22299
05 Aug 2022 — A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy version 1.0.0 through 1.0.7, FortiProxy version 1.1.0 through 1.1.6, FortiProxy version 1.2.0 through 1.2.13, FortiProxy version 2.0.0 through 2.0.7, FortiProxy version 7.0.0 through 7.0.1, FortiOS version 6.0.0 through 6.0.14, FortiOS version 6.2.0 through 6.2.10, FortiOS version 6.4.0 through 6.4.8, FortiOS v... • https://fortiguard.com/psirt/FG-IR-21-235 • CWE-134: Use of Externally-Controlled Format String •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2021-32586
https://notcve.org/view.php?id=CVE-2021-32586
01 Mar 2022 — An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unauthenticated attacker to alter the environment of the underlying script interpreter via specifically crafted HTTP requests. Una vulnerabilidad de comprobación de entrada inapropiada en las instalaciones CGI del servidor web de FortiMail versiones anteriores a 7.0.1, puede permitir a un atacante no autenticado alterar el entorno del intérprete de scripts subyacente por medio de peticiones HTT... • https://fortiguard.com/psirt/FG-IR-21-008 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2021-36166
https://notcve.org/view.php?id=CVE-2021-36166
01 Mar 2022 — An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication token by means of the observation of certain system's properties. Una vulnerabilidad de autenticación inapropiada en FortiMail versiones anteriores a 7.0.1, puede permitir a un atacante remoto adivinar eficazmente el token de autenticación de una cuenta administrativa mediante la observación de determinadas propiedades del sistema. • https://fortiguard.com/psirt/FG-IR-21-028 • CWE-330: Use of Insufficiently Random Values •
CVSS: 6.1EPSS: 51%CPEs: 3EXPL: 3CVE-2021-43062 – Fortinet Fortimail 7.0.1 - Reflected Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-43062
02 Feb 2022 — A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the FortiGuard URI protection service. Una neutralización inapropiada de la entrada durante la generación de la página web ("cross-site scripting") en Fortinet FortiMail versiones 7.0.1 y 7.0.0, versiones 6.4.5 y ... • https://packetstorm.news/files/id/166055 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 0CVE-2020-15933
https://notcve.org/view.php?id=CVE-2020-15933
05 Jan 2022 — A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and below FortiMail versions 6.4.1 and 6.4.0 allows attacker to obtain potentially sensitive software-version information via client-side resources inspection. Una exposición de información confidencial a un actor no autorizado en Fortinet FortiMail versiones 6.0.9 y anteriores, FortiMail versiones 6.2.4 y anteriores FortiMail versiones 6.4.1 y 6.4.0, permite a un atacante co... • https://fortiguard.com/psirt/FG-IR-20-105 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 22EXPL: 0CVE-2021-32591
https://notcve.org/view.php?id=CVE-2021-32591
08 Dec 2021 — A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier may allow an attacker in possession of the password store to compromise the confidentiality of the encrypted secrets. Una vulnerabilidad de pasos criptográficos faltantes en la función que cifra las credenciales LDAP y RADIUS de los usuarios en FortiSandbox versiones anteriores a 4.0.1, FortiWeb v... • https://fortiguard.com/advisory/FG-IR-20-222 •
CVSS: 6.7EPSS: 0%CPEs: 30EXPL: 0CVE-2021-42757
https://notcve.org/view.php?id=CVE-2021-42757
08 Dec 2021 — A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments. Un desbordamiento de búfer [CWE-121] en la biblioteca del cliente TFTP de FortiOS versiones anteriores a 6.4.7 y FortiOS versiones 7.0.0 hasta 7.0.2, puede permitir a un atacante local autenticado lograr una ejecución de código arbitrario por medio de argumentos de línea de c... • https://fortiguard.com/advisory/FG-IR-21-173 • CWE-787: Out-of-bounds Write •