Page 2 of 55 results (0.003 seconds)

CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 1

Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, 6.4 all versions may allow an unauthenticated remote attacker to achieve arbitrary code execution via specifically crafted HTTP requests. • https://github.com/3ndorph1n/CVE-2021-42756 https://fortiguard.com/psirt/FG-IR-21-186 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •

CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0

A condition for session fixation vulnerability [CWE-384] in the session management of FortiWeb versions 6.4 all versions, 6.3.0 through 6.3.16, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 through 6.0.7, 5.9.0 through 5.9.1 may allow a remote, unauthenticated attacker to infer the session identifier of other users and possibly usurp their session. • https://fortiguard.com/psirt/FG-IR-21-214 • CWE-384: Session Fixation •

CVSS: 5.3EPSS: 0%CPEs: 9EXPL: 0

A path traversal vulnerability [CWE-23] in the API of FortiWeb 7.0.0 through 7.0.1, 6.3.0 through 6.3.19, 6.4 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions may allow an authenticated attacker to retrieve specific parts of files from the underlying file system via specially crafted web requests. • https://fortiguard.com/psirt/FG-IR-22-146 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-23: Relative Path Traversal •

CVSS: 4.3EPSS: 0%CPEs: 8EXPL: 0

An improper verification of cryptographic signature vulnerability [CWE-347] in FortiWeb 6.4 all versions, 6.3.16 and below, 6.2 all versions, 6.1 all versions, 6.0 all versions; FortiOS 7.0.3 and below, 6.4.8 and below, 6.2 all versions, 6.0 all versions; FortiSwitch 7.0.3 and below, 6.4.10 and below, 6.2 all versions, 6.0 all versions; FortiProxy 7.0.1 and below, 2.0.7 and below, 1.2 all versions, 1.1 all versions, 1.0 all versions may allow an attacker to decrypt portions of the administrative session management cookie if able to intercept the latter. • https://fortiguard.com/psirt/FG-IR-21-126 • CWE-347: Improper Verification of Cryptographic Signature •

CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests. Una neutralización inapropiada de los elementos especiales usados en un comando os ("inyección de comando os") en Fortinet FortiWeb versión 6.4.1 y anteriores, 6.3.15 y anteriores permite a un atacante ejecutar código o comandos no autorizados por medio de peticiones HTTP diseñadas • https://fortiguard.com/advisory/FG-IR-21-166 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •