CVSS: 7.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-25611
https://notcve.org/view.php?id=CVE-2023-25611
07 Mar 2023 — A improper neutralization of formula elements in a CSV file vulnerability in Fortinet FortiAnalyzer 6.4.0 - 6.4.9, 7.0.0 - 7.0.5, and 7.2.0 - 7.2.1 allows local attacker to execute unauthorized code or commands via inserting spreadsheet formulas in macro names. • https://fortiguard.com/psirt/FG-IR-22-488 • CWE-1236: Improper Neutralization of Formula Elements in a CSV File •
CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 0CVE-2022-30304
https://notcve.org/view.php?id=CVE-2022-30304
16 Feb 2023 — An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8 may allow a remote unauthenticated attacker to perform a stored cross site scripting (XSS) attack via the URL parameter observed in the FortiWeb attack event logview in FortiAnalyzer. • https://fortiguard.com/psirt/FG-IR-22-166 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 0CVE-2022-38377
https://notcve.org/view.php?id=CVE-2022-38377
25 Nov 2022 — An improper access control vulnerability [CWE-284] in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11 and FortiAnalyzer 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.0 through 6.0.12 may allow a remote and authenticated admin user assigned to a specific ADOM to access other ADOMs information such as device information and dashboard information. Una vulnerabilidad de control de acceso inadecuado [CWE-284] en FortiManager 7.2... • https://fortiguard.com/psirt/FG-IR-20-143 • CWE-284: Improper Access Control •
CVSS: 8.0EPSS: 0%CPEs: 6EXPL: 0CVE-2022-39950
https://notcve.org/view.php?id=CVE-2022-39950
02 Nov 2022 — An improper neutralization of input during web page generation vulnerability [CWE-79] exists in FortiManager and FortiAnalyzer 6.0.0 all versions, 6.2.0 all versions, 6.4.0 through 6.4.8, and 7.0.0 through 7.0.4. Report templates may allow a low privilege level attacker to perform an XSS attack via posting a crafted CKeditor "protected" comment as described in CVE-2020-9281. Existe una neutralización inadecuada de la entrada durante la vulnerabilidad de generación de páginas web [CWE-79] en FortiManager y F... • https://fortiguard.com/psirt/FG-IR-21-228 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 10EXPL: 0CVE-2022-26121
https://notcve.org/view.php?id=CVE-2022-26121
10 Oct 2022 — An exposure of resource to wrong sphere vulnerability [CWE-668] in FortiAnalyzer and FortiManager GUI 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11, 5.6.0 through 5.6.11 may allow an unauthenticated and remote attacker to access report template images via referencing the name in the URL path. Una vulnerabilidad de exposición de recursos a una esfera incorrecta [CWE-668] en FortiAnalyzer y FortiManager GUI versiones 7.0.0 hasta 7.0.3, 6.4.0 hasta 6.4.8, 6.2.0 hasta 6.2.9... • https://fortiguard.com/psirt/FG-IR-22-026 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 6.7EPSS: 0%CPEs: 8EXPL: 0CVE-2022-26118
https://notcve.org/view.php?id=CVE-2022-26118
18 Jul 2022 — A privilege chaining vulnerability [CWE-268] in FortiManager and FortiAnalyzer 6.0.x, 6.2.x, 6.4.0 through 6.4.7, 7.0.0 through 7.0.3 may allow a local and authenticated attacker with a restricted shell to escalate their privileges to root due to incorrect permissions of some folders and executable files on the system. Una vulnerabilidad de encadenamiento de privilegios [CWE-268] en FortiManager y FortiAnalyzer versiones 6.0.x, 6.2.x, 6.4.0 a 6.4.7, 7.0.0 a 7.0.3, puede permitir a un atacante local y autent... • https://fortiguard.com/psirt/FG-IR-21-056 • CWE-269: Improper Privilege Management •
CVSS: 8.3EPSS: 0%CPEs: 8EXPL: 0CVE-2022-27483
https://notcve.org/view.php?id=CVE-2022-27483
18 Jul 2022 — A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager version 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.x and 6.0.x and FortiAnalyzer version 7.0.0 through 7.0.3, version 6.4.0 through 6.4.7, 6.2.x and 6.0.x allows attacker to execute arbitrary shell code as `root` user via `diagnose system` CLI commands. Una neutralización inapropiada de elementos especiales usados en un comando os ("inyección de comando os") en Fortinet FortiManager versi... • https://fortiguard.com/psirt/FG-IR-22-049 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 0CVE-2022-22300
https://notcve.org/view.php?id=CVE-2022-22300
01 Mar 2022 — A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.11, FortiAnalyzer version 6.2.0 through 6.2.9, FortiAnalyzer version 6.4.0 through 6.4.7, FortiAnalyzer version 7.0.0 through 7 .0.2, FortiManager version 5.6.0 through 5.6.11, FortiManager version 6.0.0 through 6.0.11, FortiManager version 6.2.0 through 6.2.9, FortiManager version 6.4.0 through 6.4.7, FortiManager version 7.0.0 through 7.0.2 allows at... • https://fortiguard.com/psirt/FG-IR-21-255 • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 6.7EPSS: 0%CPEs: 30EXPL: 0CVE-2021-42757
https://notcve.org/view.php?id=CVE-2021-42757
08 Dec 2021 — A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments. Un desbordamiento de búfer [CWE-121] en la biblioteca del cliente TFTP de FortiOS versiones anteriores a 6.4.7 y FortiOS versiones 7.0.0 hasta 7.0.2, puede permitir a un atacante local autenticado lograr una ejecución de código arbitrario por medio de argumentos de línea de c... • https://fortiguard.com/advisory/FG-IR-21-173 • CWE-787: Out-of-bounds Write •
CVSS: 3.2EPSS: 0%CPEs: 4EXPL: 0CVE-2021-36170
https://notcve.org/view.php?id=CVE-2021-36170
06 Oct 2021 — An information disclosure vulnerability [CWE-200] in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below may allow an authenticated attacker to read the FortiCloud credentials which were used to activate the trial license in cleartext. Una vulnerabilidad de divulgación de información [CWE-200] en FortiAnalyzerVM y FortiManagerVM versiones 7.0.0 y 6.4.6 y por debajo, puede permitir a un atacante autenticado leer las credenciales de FortiCloud que fueron usadas para activar la licencia de pr... • https://fortiguard.com/advisory/FG-IR-21-112 • CWE-522: Insufficiently Protected Credentials •