CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-32595
https://notcve.org/view.php?id=CVE-2021-32595
02 Nov 2021 — Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a denial of service via multiple HTTP requests. Múltiples vulnerabilidades de consumo de recursos no controlables en la interfaz web de FortiPortal versiones anteriores a 6.0.6, pueden permitir a un único usuario poco privilegiado inducir una denegación de servicio por medio de múltiples peticiones HTTP • https://fortiguard.com/advisory/FG-IR-21-096 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.1EPSS: 0%CPEs: 8EXPL: 0CVE-2021-36172
https://notcve.org/view.php?id=CVE-2021-36172
02 Nov 2021 — An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who controls the producer of XML reports consumed by FortiPortal to trigger a denial of service or read arbitrary files from the underlying file system by means of specifically crafted XML documents. Una vulnerabilidad de restricción inapropiada de referencias a entidades externas XML en el analizador de respuestas XML de FortiPortal versiones anteriores a 6... • https://fortiguard.com/advisory/FG-IR-21-104 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-36181
https://notcve.org/view.php?id=CVE-2021-36181
02 Nov 2021 — A concurrent execution using shared resource with improper Synchronization vulnerability ('Race Condition') in the customer database interface of FortiPortal before 6.0.6 may allow an authenticated, low-privilege user to bring the underlying database data into an inconsistent state via specific coordination of web requests. Una ejecución concurrente usando un recurso compartido con una vulnerabilidad de sincronización inapropiada ("Condición de carrera") en la interfaz de la base de datos de clientes de For... • https://fortiguard.com/advisory/FG-IR-21-102 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2021-32602
https://notcve.org/view.php?id=CVE-2021-32602
18 Aug 2021 — An improper neutralization of input during web page generation vulnerability (CWE-79) in FortiPortal GUI 6.0.4 and below, 5.3.6 and below, 5.2.6 and below, 5.1.2 and below, 5.0.3 and below, 4.2.2 and below, 4.1.2 and below, 4.0.4 and below may allow a remote and unauthenticated attacker to perform an XSS attack via sending a crafted request with an invalid lang parameter or with an invalid org.springframework.web.servlet.i18n.CookieLocaleResolver.LOCALE value. Una vulnerabilidad de neutralización inapropiad... • https://fortiguard.com/advisory/FG-IR-20-066 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 25%CPEs: 5EXPL: 0CVE-2021-32588
https://notcve.org/view.php?id=CVE-2021-32588
18 Aug 2021 — A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4 and below, versions 5.1.x and 5.0.x may allow a remote and unauthenticated attacker to execute unauthorized commands as root by uploading and deploying malicious web application archive files using the default hard-coded Tomcat Manager username and password. Una vulnerabilidad de uso de credenciales embebidas (CWE-798) en FortiPortal versiones 5.2.5 e inferiores, 5.3.5 e inferiores, 6.0.4 ... • https://fortiguard.com/advisory/FG-IR-21-077 • CWE-798: Use of Hard-coded Credentials •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-36168
https://notcve.org/view.php?id=CVE-2021-36168
04 Aug 2021 — A Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Fortinet FortiPortal 6.x before 6.0.5, FortiPortal 5.3.x before 5.3.6 and any FortiPortal before 6.2.5 allows authenticated attacker to disclosure information via crafted GET request with malicious parameter values. Una limitación inapropiada de un nombre de ruta a un directorio restringido ("Salto de Ruta") en Fortinet FortiPortal versiones 6.x anteriores a 6.0.5, FortiPortal versiones 5.3.x anteriores a 5.3.6 y cualquier F... • https://fortiguard.com/advisory/FG-IR-21-085 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.9EPSS: 0%CPEs: 9EXPL: 0CVE-2021-32590
https://notcve.org/view.php?id=CVE-2021-32590
04 Aug 2021 — Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may allow an attacker with regular user's privileges to execute arbitrary commands on the underlying SQL database via specifically crafted HTTP requests. Múltiples vulnerabilidades de neutralización inapropiada de elementos especiales usados en un comando SQL en FortiPortal versiones 6.0.0 hasta 6.0.4, versiones 5.3.0 ... • https://fortiguard.com/advisory/FG-IR-21-084 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 0%CPEs: 8EXPL: 0CVE-2021-32594
https://notcve.org/view.php?id=CVE-2021-32594
04 Aug 2021 — An unrestricted file upload vulnerability in the web interface of FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may allow a low-privileged user to potentially tamper with the underlying system's files via the upload of specifically crafted files. Una vulnerabilidad de carga de archivos no restringida en la interfaz web de FortiPortal versiones 6.0.0 hasta 6.0.4, versiones 5.3.0 hasta 5.3.5, versiones 5.2.0 hasta 5.2.5, y versiones 4.2.2 y anteriores puede p... • https://fortiguard.com/advisory/FG-IR-21-092 • CWE-434: Unrestricted Upload of File with Dangerous Type •