CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-48791
https://notcve.org/view.php?id=CVE-2023-48791
An improper neutralization of special elements used in a command ('Command Injection') vulnerability [CWE-77] in FortiPortal version 7.2.0, version 7.0.6 and below may allow a remote authenticated attacker with at least R/W permission to execute unauthorized commands via specifically crafted arguments in the Schedule System Backup page field. Una neutralización inadecuada de elementos especiales utilizados en una vulnerabilidad de comando ('Inyección de comando') [CWE-77] en FortiPortal versión 7.2.0, versión 7.0.6 y anteriores puede permitir que un atacante remoto autenticado con al menos permiso R/W ejecute comandos no autorizados a través de argumentos específicamente manipulados en el campo de la página Programar Copia de Seguridad del Sistema. • https://fortiguard.com/psirt/FG-IR-23-425 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 15EXPL: 0CVE-2022-27490
https://notcve.org/view.php?id=CVE-2022-27490
A exposure of sensitive information to an unauthorized actor in Fortinet FortiManager version 6.0.0 through 6.0.4, FortiAnalyzer version 6.0.0 through 6.0.4, FortiPortal version 6.0.0 through 6.0.9, 5.3.0 through 5.3.8, 5.2.x, 5.1.0, 5.0.x, 4.2.x, 4.1.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.x, 6.0.x allows an attacker which has obtained access to a restricted administrative account to obtain sensitive information via `diagnose debug` commands. • https://fortiguard.com/psirt/FG-IR-18-232 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-43954
https://notcve.org/view.php?id=CVE-2022-43954
An insertion of sensitive information into log file vulnerability [CWE-532] in the FortiPortal management interface 7.0.0 through 7.0.2 may allow a remote authenticated attacker to read other devices' passwords in the audit log page. • https://fortiguard.com/psirt/FG-IR-22-430 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-41336
https://notcve.org/view.php?id=CVE-2022-41336
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiPortal versions 6.0.0 through 6.0.11 and all versions of 5.3, 5.2, 5.1, 5.0 management interface may allow a remote authenticated attacker to perform a stored cross site scripting (XSS) attack via sending request with specially crafted columnindex parameter. • https://fortiguard.com/psirt/FG-IR-22-313 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 1CVE-2021-26104
https://notcve.org/view.php?id=CVE-2021-26104
Multiple OS command injection (CWE-78) vulnerabilities in the command line interface of FortiManager 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, FortiAnalyzer 6.2.7 and below, 6.4.5 and below and all versions of 6.2.x, 6.0.x and 5.6.x, and FortiPortal 5.2.5 and below, 5.3.5 and below and 6.0.4 and below may allow a local authenticated and unprivileged user to execute arbitrary shell commands as root via specifically crafted CLI command parameters. Múltiples vulnerabilidades de inyección de comandos en el Sistema Operativo (CWE-78) en la interfaz de línea de comandos de FortiManager versiones 6.2.7 y anteriores, 6.4.5 y anteriores y todas las versiones de 6.2.x, 6.0.x y 5.6.x, FortiAnalyzer versiones 6.2.7 y anteriores, 6.4.5 y anteriores y todas las versiones de 6. 2.x, 6.0.x y 5.6.x, y FortiPortal versiones 5.2.5 y anteriores, 5.3.5 y anteriores y 6.0.4 y anteriores, pueden permitir a un usuario local autenticado no privilegiado ejecutar comandos shell arbitrarios como root por medio de parámetros de comando CLI específicamente diseñados • https://fortiguard.com/advisory/FG-IR-21-037 https://github.com/orangecertcc/security-research/security/advisories/GHSA-f73m-fvj3-m2pm • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •