CVSS: 6.4EPSS: 0%CPEs: 3EXPL: 0CVE-2022-38376
https://notcve.org/view.php?id=CVE-2022-38376
16 Feb 2023 — Multiple improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilities [CWE-79] in Fortinet FortiNAC portal UI before 9.4.1 allows an attacker to perform an XSS attack via crafted HTTP requests. Multiple improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilities [CWE-79] in Fortinet FortiNAC portal UI before 9.4.1 allows an attacker to perform an XSS attack via crafted HTTP requests. • https://fortiguard.com/psirt/FG-IR-22-273 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 0CVE-2022-38375
https://notcve.org/view.php?id=CVE-2022-38375
16 Feb 2023 — An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests. • https://fortiguard.com/psirt/FG-IR-22-329 • CWE-285: Improper Authorization •
CVSS: 9.0EPSS: 0%CPEs: 9EXPL: 0CVE-2022-26117
https://notcve.org/view.php?id=CVE-2022-26117
18 Jul 2022 — An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI. Una vulnerabilidad de contraseña vacía en el archivo de configuración [CWE-258] en FortiNAC versiones 8.3.7 y anteriores, 8.5.2 y anteriores, 8.5.4, 8.6.0, 8.6.5 y anteriores, 8.7.6 y anteriores, 8.8.11 y anteriores,... • https://fortiguard.com/psirt/FG-IR-22-058 • CWE-521: Weak Password Requirements •
CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2022-26116
https://notcve.org/view.php?id=CVE-2022-26116
11 May 2022 — Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.2 and below may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters. Múltiples neutralizaciones inapropiadas de elementos especiales usados en comandos SQL ("Inyección SQL") vulnerabilidad [C... • https://fortiguard.com/psirt/FG-IR-22-062 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2021-43065
https://notcve.org/view.php?id=CVE-2021-43065
09 Dec 2021 — A incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version 9.1.3 and below, version 8.8.9 and below allows attacker to gain higher privileges via the access to sensitive system data. Una asignación incorrecta de permisos para recursos críticos en Fortinet FortiNAC versión 9.2.0, versión 9.1.3 y anteriores, versión 8.8.9 y anteriores, permite al atacante conseguir mayores privilegios por medio del acceso a datos confidenciales del sistema • https://fortiguard.com/advisory/FG-IR-21-178 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 0CVE-2021-41021
https://notcve.org/view.php?id=CVE-2021-41021
08 Dec 2021 — A privilege escalation vulnerability in FortiNAC versions 8.8.8 and below and 9.1.2 and below may allow an admin user to escalate the privileges to root via the sudo command. Una vulnerabilidad de escalada de privilegios en FortiNAC versiones 8.8.8 y anteriores y 9.1.2 y anteriores, puede permitir a un usuario administrador escalar los privilegios a root por medio del comando sudo • https://fortiguard.com/advisory/FG-IR-21-182 •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24011
https://notcve.org/view.php?id=CVE-2021-24011
10 May 2021 — A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges. Una vulnerabilidad de escalada de privilegios en FortiNAC versiones por debajo de 8.8.2, puede permitir a un usuario administrador escalar privilegios a root al abusar de los privilegios de sudo • https://fortiguard.com/advisory/FG-IR-20-038 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12816
https://notcve.org/view.php?id=CVE-2020-12816
24 Sep 2020 — An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the UserID of Admin Users. Una vulnerabilidad de neutralización inapropiada de la entrada en FortiNAC versiones anteriores a 8.7.2, puede permitir a un atacante autenticado remoto llevar a cabo un ataque de tipo cross site scripting (XSS) almacenado por medio de un UserID de Usuarios Administradores. • https://fortiguard.com/advisory/FG-IR-20-002 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-5594
https://notcve.org/view.php?id=CVE-2019-5594
23 Aug 2019 — An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI. Una neutralización inadecuada de la entrada durante la generación de páginas web ("Cross-site Scripting") en Fortinet FortiNAC 8.3.0 a 8.3.6 y 8.5.0 admin webUI puede permitir que un atacante no autenticado realice un ataque XSS reflejado a través del campo d... • https://fortiguard.com/advisory/FG-IR-19-140 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •