CVSS: 10.0EPSS: 0%CPEs: 9EXPL: 0CVE-2022-38381
https://notcve.org/view.php?id=CVE-2022-38381
02 Nov 2022 — An improper handling of malformed request vulnerability [CWE-228] exists in FortiADC 5.0 all versions, 6.0.0 all versions, 6.1.0 all versions, 6.2.0 through 6.2.3, and 7.0.0 through 7.0.2. This may allow a remote attacker without privileges to bypass some Web Application Firewall (WAF) protection such as the SQL Injection and XSS filters via a malformed HTTP request. Existe un manejo inadecuado de la vulnerabilidad de solicitud con formato incorrecto [CWE-228] en FortiADC 5.0 todas las versiones, 6.0.0 toda... • https://fortiguard.com/psirt/FG-IR-22-234 •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 2CVE-2022-38374
https://notcve.org/view.php?id=CVE-2022-38374
02 Nov 2022 — A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiADC 7.0.0 - 7.0.2 and 6.2.0 - 6.2.4 allows an attacker to execute unauthorized code or commands via the URL and User fields observed in the traffic and event logviews. Una neutralización inadecuada de la entrada durante la generación de la página web ("cross-site scripting") en Fortinet FortiADC 7.0.0 - 7.0.2 y 6.2.0 - 6.2.4 permite a un atacante ejecutar código o comandos no autorizados a través de la UR... • https://github.com/azhurtanov/CVE-2022-38374 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2022-26120
https://notcve.org/view.php?id=CVE-2022-26120
18 Jul 2022 — Multiple improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerabilities [CWE-89] in FortiADC management interface 7.0.0 through 7.0.1, 5.0.0 through 6.2.2 may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. Múltiples vulnerabilidades de neutralización inapropiada de elementos especiales usados en un comando SQL ("Inyección SQL") [CWE-89] en la interfaz de administración de FortiADC versiones 7.0.0 hasta 7.... • https://fortiguard.com/psirt/FG-IR-22-051 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •