CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2022-40678
https://notcve.org/view.php?id=CVE-2022-40678
An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow a local attacker with database access to recover user passwords. • https://fortiguard.com/psirt/FG-IR-22-265 • CWE-522: Insufficiently Protected Credentials •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2022-38376
https://notcve.org/view.php?id=CVE-2022-38376
Multiple improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilities [CWE-79] in Fortinet FortiNAC portal UI before 9.4.1 allows an attacker to perform an XSS attack via crafted HTTP requests. • https://fortiguard.com/psirt/FG-IR-22-273 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2022-26117
https://notcve.org/view.php?id=CVE-2022-26117
An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI. Una vulnerabilidad de contraseña vacía en el archivo de configuración [CWE-258] en FortiNAC versiones 8.3.7 y anteriores, 8.5.2 y anteriores, 8.5.4, 8.6.0, 8.6.5 y anteriores, 8.7.6 y anteriores, 8.8.11 y anteriores, 9.1.5 y anteriores, 9.2.3 y anteriores puede permitir a un atacante autenticado acceder a las bases de datos MySQL por medio de la CLI • https://fortiguard.com/psirt/FG-IR-22-058 https://github.com/orangecertcc/security-research/security/advisories/GHSA-r259-5p5p-2q47 • CWE-521: Weak Password Requirements •
CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2022-26116
https://notcve.org/view.php?id=CVE-2022-26116
Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.2 and below may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters. Múltiples neutralizaciones inapropiadas de elementos especiales usados en comandos SQL ("Inyección SQL") vulnerabilidad [CWE-89] en FortiNAC versiones: 8.3.7 y anteriores, 8.5.2 y anteriores, 8.5.4, 8.6.0, 8.6.5 y anteriores, 8.7.6 y anteriores, 8.8.11 y anteriores, 9.1.5 y anteriores, 9.2.2 y anteriores, pueden permitir a un atacante autenticado ejecutar código o comandos no autorizados por medio de parámetros de cadenas específicamente diseñados • https://fortiguard.com/psirt/FG-IR-22-062 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24011
https://notcve.org/view.php?id=CVE-2021-24011
A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges. Una vulnerabilidad de escalada de privilegios en FortiNAC versiones por debajo de 8.8.2, puede permitir a un usuario administrador escalar privilegios a root al abusar de los privilegios de sudo • https://fortiguard.com/advisory/FG-IR-20-038 •