CVSS: 9.1EPSS: 0%CPEs: 3EXPL: 0CVE-2022-39954
https://notcve.org/view.php?id=CVE-2022-39954
An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC version 9.1.0 through 9.1.8, FortiNAC version 8.8.0 through 8.8.11, FortiNAC version 8.7.0 through 8.7.6, FortiNAC version 8.6.0 through 8.6.5, FortiNAC version 8.5.0 through 8.5.4, FortiNAC version 8.3.7 allows attacker to read arbitrary files or trigger a denial of service via specifically crafted XML documents. • https://fortiguard.com/psirt/FG-IR-22-304 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2022-40678
https://notcve.org/view.php?id=CVE-2022-40678
An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow a local attacker with database access to recover user passwords. • https://fortiguard.com/psirt/FG-IR-22-265 • CWE-522: Insufficiently Protected Credentials •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2022-38376
https://notcve.org/view.php?id=CVE-2022-38376
Multiple improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilities [CWE-79] in Fortinet FortiNAC portal UI before 9.4.1 allows an attacker to perform an XSS attack via crafted HTTP requests. • https://fortiguard.com/psirt/FG-IR-22-273 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2022-26117
https://notcve.org/view.php?id=CVE-2022-26117
An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.3 and below may allow an authenticated attacker to access the MySQL databases via the CLI. Una vulnerabilidad de contraseña vacía en el archivo de configuración [CWE-258] en FortiNAC versiones 8.3.7 y anteriores, 8.5.2 y anteriores, 8.5.4, 8.6.0, 8.6.5 y anteriores, 8.7.6 y anteriores, 8.8.11 y anteriores, 9.1.5 y anteriores, 9.2.3 y anteriores puede permitir a un atacante autenticado acceder a las bases de datos MySQL por medio de la CLI • https://fortiguard.com/psirt/FG-IR-22-058 https://github.com/orangecertcc/security-research/security/advisories/GHSA-r259-5p5p-2q47 • CWE-521: Weak Password Requirements •
CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2022-26116
https://notcve.org/view.php?id=CVE-2022-26116
Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.2 and below may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters. Múltiples neutralizaciones inapropiadas de elementos especiales usados en comandos SQL ("Inyección SQL") vulnerabilidad [CWE-89] en FortiNAC versiones: 8.3.7 y anteriores, 8.5.2 y anteriores, 8.5.4, 8.6.0, 8.6.5 y anteriores, 8.7.6 y anteriores, 8.8.11 y anteriores, 9.1.5 y anteriores, 9.2.2 y anteriores, pueden permitir a un atacante autenticado ejecutar código o comandos no autorizados por medio de parámetros de cadenas específicamente diseñados • https://fortiguard.com/psirt/FG-IR-22-062 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •