Page 3 of 14 results (0.003 seconds)

CVSS: 7.0EPSS: 0%CPEs: 3EXPL: 0

An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 through 7.0.4 may allow a local attacker to access confidential configuration files via a crafted http request. • https://fortiguard.com/psirt/FG-IR-22-460 • CWE-285: Improper Authorization •

CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0

A double free in Fortinet FortiWeb version 7.0.0 through 7.0.3 may allows attacker to execute unauthorized code or commands via specially crafted commands • https://fortiguard.com/psirt/FG-IR-22-348 • CWE-415: Double Free •

CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0

A relative path traversal in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to information disclosure via specially crafted web requests. • https://fortiguard.com/psirt/FG-IR-22-251 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-23: Relative Path Traversal •

CVSS: 5.4EPSS: 0%CPEs: 7EXPL: 0

An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.4.0 through 6.4.2, FortiWeb version 6.3.6 through 6.3.20 may allow an authenticated and remote attacker to inject arbitrary headers. • https://fortiguard.com/psirt/FG-IR-22-250 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') •