CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-32587
https://notcve.org/view.php?id=CVE-2021-32587
06 Aug 2021 — An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below may allow a remote and authenticated attacker with restricted user profile to retrieve the list of administrative users of other ADOMs and their related configuration. Una vulnerabilidad de control de acceso inapropiado en la interfaz GUI de FortiManager y FortiAnalyzer versiones 7.0.0, 6.4.5 e inferiores, 6.2.8 e inferiores, 6.0.11 e inferiores... • https://fortiguard.com/advisory/FG-IR-21-059 •
CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 0CVE-2021-32597
https://notcve.org/view.php?id=CVE-2021-32597
06 Aug 2021 — Multiple improper neutralization of input during web page generation (CWE-79) in FortiManager and FortiAnalyzer versions 7.0.0, 6.4.5 and below, 6.2.7 and below user interface, may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack (XSS) by injecting malicious payload in GET parameters. Una neutralización inapropiada de la entrada durante la generación de la página web (CWE-79) en FortiManager y FortiAnalyzer versiones 7.0.0, 6.4.5 y por debajo, 6.2.7 y por debajo de la in... • https://fortiguard.com/advisory/FG-IR-21-054 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2021-32603
https://notcve.org/view.php?id=CVE-2021-32603
05 Aug 2021 — A server-side request forgery (SSRF) (CWE-918) vulnerability in FortiManager and FortiAnalyser GUI 7.0.0, 6.4.5 and below, 6.2.7 and below, 6.0.11 and below, 5.6.11 and below may allow a remote and authenticated attacker to access unauthorized files and services on the system via specifically crafted web requests. Una vulnerabilidad de tipo server-side request forgery (SSRF) (CWE-918) en FortiManager y FortiAnalyser GUI versiones 7.0.0, versiones 6.4.5 y por debajo, versiones 6.2.7 y por debajo, versiones 6... • https://fortiguard.com/advisory/FG-IR-21-050 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-32598
https://notcve.org/view.php?id=CVE-2021-32598
05 Aug 2021 — An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability In FortiManager and FortiAnalyzer GUI 7.0.0, 6.4.6 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below may allow an authenticated and remote attacker to perform an HTTP request splitting attack which gives attackers control of the remaining headers and body of the response. Una vulnerabilidad de neutralización inapropiada de las secuencias CRLF en los encabezados HTTP ("HTTP Response Splitting")... • https://fortiguard.com/advisory/FG-IR-21-063 • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 6.7EPSS: 0%CPEs: 4EXPL: 0CVE-2021-24022
https://notcve.org/view.php?id=CVE-2021-24022
20 Jul 2021 — A buffer overflow vulnerability in FortiAnalyzer CLI 6.4.5 and below, 6.2.7 and below, 6.0.x and FortiManager CLI 6.4.5 and below, 6.2.7 and below, 6.0.x may allow an authenticated, local attacker to perform a Denial of Service attack by running the `diagnose system geoip-city` command with a large ip value. Una vulnerabilidad de desbordamiento de búfer en FortiAnalyzer CLI versiones 6.4.5 y posteriores, versiones 6.2.7 y posteriores, versiones 6.0.x y FortiManager CLI versiones 6.4.5 y posteriores, 6.2.7 y... • https://fortiguard.com/advisory/FG-IR-20-194 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2020-9289
https://notcve.org/view.php?id=CVE-2020-9289
16 Jun 2020 — Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and below may allow an attacker with access to the CLI configuration or the CLI backup file to decrypt the sensitive data, via knowledge of the hard-coded key. Un uso de una clave criptográfica embebida para cifrar datos de contraseña en la configuración de la CLI en FortiManager versiones 6.2.3 y posteriores, FortiAnalyzer versiones 6.2.3 y posteriores puede permitir a un... • https://github.com/synacktiv/CVE-2020-9289 • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2019-17657
https://notcve.org/view.php?id=CVE-2019-17657
07 Apr 2020 — An Uncontrolled Resource Consumption vulnerability in Fortinet FortiSwitch below 3.6.11, 6.0.6 and 6.2.2, FortiAnalyzer below 6.2.3, FortiManager below 6.2.3 and FortiAP-S/W2 below 6.2.2 may allow an attacker to cause admin webUI denial of service (DoS) via handling special crafted HTTP requests/responses in pieces slowly, as demonstrated by Slow HTTP DoS Attacks. Una vulnerabilidad de Consumo No Controlado de Recursos en Fortinet FortiSwitch por debajo de las versiones 3.6.11, 6.0.6 y 6.2.2, FortiAnalyzer ... • https://fortiguard.com/psirt/FG-IR-19-013 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-17654
https://notcve.org/view.php?id=CVE-2019-17654
15 Mar 2020 — An Insufficient Verification of Data Authenticity vulnerability in FortiManager 6.2.1, 6.2.0, 6.0.6 and below may allow an unauthenticated attacker to perform a Cross-Site WebSocket Hijacking (CSWSH) attack. Una vulnerabilidad de Verificación Insuficiente de la Autenticidad de Datos en FortiManager versiones 6.2.1, 6.2.0, 6.0.6 y por debajo, puede permitir a un atacante no autenticado llevar a cabo un ataque de tipo Cross-Site WebSocket Hijacking (CSWSH). • https://fortiguard.com/psirt/FG-IR-19-191 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2019-6695
https://notcve.org/view.php?id=CVE-2019-6695
23 Aug 2019 — Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-party programs by recreating the image through specific methods. La falta de comprobación de integridad del sistema de archivos raíz en las imágenes de la aplicación Fortinet FortiManager VM de 6.2.0, 6.0.6 y posteriores puede permitir que un atacante implante programas de terceros al recrear la imagen a través de métodos específicos. • https://fortiguard.com/advisory/FG-IR-19-017 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1353
https://notcve.org/view.php?id=CVE-2018-1353
05 Sep 2018 — An information disclosure vulnerability in Fortinet FortiManager 6.0.1 and below versions allows a standard user with adom assignment read the interface settings of vdoms unrelated to the assigned adom. Una vulnerabilidad de divulgación de información en Fortinet FortiManager en versiones 6.0.1 y anteriores permite que un usuario estándar con un assignment adom lea las opciones de interfaz de vdoms que no están relacionadas con el adom asignado. • https://fortiguard.com/advisory/FG-IR-18-016 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •