CVSS: 7.8EPSS: 0%CPEs: 20EXPL: 0CVE-2022-22299
https://notcve.org/view.php?id=CVE-2022-22299
05 Aug 2022 — A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy version 1.0.0 through 1.0.7, FortiProxy version 1.1.0 through 1.1.6, FortiProxy version 1.2.0 through 1.2.13, FortiProxy version 2.0.0 through 2.0.7, FortiProxy version 7.0.0 through 7.0.1, FortiOS version 6.0.0 through 6.0.14, FortiOS version 6.2.0 through 6.2.10, FortiOS version 6.4.0 through 6.4.8, FortiOS v... • https://fortiguard.com/psirt/FG-IR-21-235 • CWE-134: Use of Externally-Controlled Format String •
CVSS: 4.3EPSS: 0%CPEs: 130EXPL: 0CVE-2021-42755
https://notcve.org/view.php?id=CVE-2021-42755
18 Jul 2022 — An integer overflow / wraparound vulnerability [CWE-190] in FortiSwitch 7.0.2 and below, 6.4.9 and below, 6.2.x, 6.0.x; FortiRecorder 6.4.2 and below, 6.0.10 and below; FortiOS 7.0.2 and below, 6.4.8 and below, 6.2.10 and below, 6.0.x; FortiProxy 7.0.0, 2.0.6 and below, 1.2.x, 1.1.x, 1.0.x; FortiVoiceEnterprise 6.4.3 and below, 6.0.10 and below dhcpd daemon may allow an unauthenticated and network adjacent attacker to crash the dhcpd deamon, resulting in potential denial of service. Una vulnerabilidad de de... • https://fortiguard.com/psirt/FG-IR-21-155 • CWE-190: Integer Overflow or Wraparound •
CVSS: 6.7EPSS: 0%CPEs: 8EXPL: 0CVE-2021-44170
https://notcve.org/view.php?id=CVE-2021-44170
18 Jul 2022 — A stack-based buffer overflow vulnerability [CWE-121] in the command line interpreter of FortiOS before 7.0.4 and FortiProxy before 2.0.8 may allow an authenticated attacker to execute unauthorized code or commands via specially crafted command line arguments. Una vulnerabilidad de desbordamiento de búfer en la región stack de la memoria [CWE-121] en el intérprete de línea de comandos de FortiOS versiones anteriores a 7.0.4 y FortiProxy versiones anteriores a 2.0.8, puede permitir a un atacante autenticado ... • https://fortiguard.com/psirt/FG-IR-21-179 • CWE-787: Out-of-bounds Write •
CVSS: 6.1EPSS: 0%CPEs: 9EXPL: 0CVE-2021-26092
https://notcve.org/view.php?id=CVE-2021-26092
24 Feb 2022 — Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; and FortiProxy 1.2.0 through 1.2.9, 2.0.0 through 2.0.1 may allow a remote unauthenticated attacker to perform a reflected Cross-site Scripting (XSS) attack by sending a request to the error page with malicious GET parameters. Un fallo en el saneo de la entrada en el portal web SSL VPN de FortiOS versiones 5.2.10 has... • https://fortiguard.com/psirt/FG-IR-20-199 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2021-26103
https://notcve.org/view.php?id=CVE-2021-26103
08 Dec 2021 — An insufficient verification of data authenticity vulnerability (CWE-345) in the user interface of FortiProxy verison 2.0.3 and below, 1.2.11 and below and FortiGate verison 7.0.0, 6.4.6 and below, 6.2.9 and below of SSL VPN portal may allow a remote, unauthenticated attacker to conduct a cross-site request forgery (CSRF) attack . Only SSL VPN in web mode or full mode are impacted by this vulnerability. Una vulnerabilidad de verificación insuficiente de la autenticidad de los datos (CWE-345) en la interfaz ... • https://fortiguard.com/advisory/FG-IR-20-158 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 6.7EPSS: 0%CPEs: 30EXPL: 0CVE-2021-42757
https://notcve.org/view.php?id=CVE-2021-42757
08 Dec 2021 — A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments. Un desbordamiento de búfer [CWE-121] en la biblioteca del cliente TFTP de FortiOS versiones anteriores a 6.4.7 y FortiOS versiones 7.0.0 hasta 7.0.2, puede permitir a un atacante local autenticado lograr una ejecución de código arbitrario por medio de argumentos de línea de c... • https://fortiguard.com/advisory/FG-IR-21-173 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2021-26110
https://notcve.org/view.php?id=CVE-2021-26110
08 Dec 2021 — An improper access control vulnerability [CWE-284] in FortiOS autod daemon 7.0.0, 6.4.6 and below, 6.2.9 and below, 6.0.12 and below and FortiProxy 2.0.1 and below, 1.2.9 and below may allow an authenticated low-privileged attacker to escalate their privileges to super_admin via a specific crafted configuration of fabric automation CLI script and auto-script features. Una vulnerabilidad de control de acceso inapropiado [CWE-284] en el demonio autod de FortiOS versiones 7.0.0, 6.4.6 y anteriores, 6.2.9 y ant... • https://fortiguard.com/advisory/FG-IR-20-131 •
CVSS: 6.7EPSS: 0%CPEs: 4EXPL: 0CVE-2021-22130
https://notcve.org/view.php?id=CVE-2021-22130
03 Jun 2021 — A stack-based buffer overflow vulnerability in FortiProxy physical appliance CLI 2.0.0 to 2.0.1, 1.2.0 to 1.2.9, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 may allow an authenticated, remote attacker to perform a Denial of Service attack by running the `diagnose sys cpuset` with a large cpuset mask value. Fortinet is not aware of any successful exploitation of this vulnerability that would lead to code execution. Una vulnerabilidad de desbordamiento de búfer en la región stack de la memoria en el FortiProxy physical ap... • https://fortiguard.com/advisory/FG-IR-21-006 • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 2%CPEs: 4EXPL: 0CVE-2019-17656
https://notcve.org/view.php?id=CVE-2019-17656
12 Apr 2021 — A Stack-based Buffer Overflow vulnerability in the HTTPD daemon of FortiOS 6.0.10 and below, 6.2.2 and below and FortiProxy 1.0.x, 1.1.x, 1.2.9 and below, 2.0.0 and below may allow an authenticated remote attacker to crash the service by sending a malformed PUT request to the server. Fortinet is not aware of any successful exploitation of this vulnerability that would lead to code execution. Una vulnerabilidad de desbordamiento de búfer en la región stack de la memoria en el demonio HTTPD de FortiOS version... • https://fortiguard.com/advisory/FG-IR-19-248 • CWE-787: Out-of-bounds Write •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-22128
https://notcve.org/view.php?id=CVE-2021-22128
04 Mar 2021 — An improper access control vulnerability in FortiProxy SSL VPN portal 2.0.0, 1.2.9 and below versions may allow an authenticated, remote attacker to access internal service such as the ZebOS Shell on the FortiProxy appliance through the Quick Connection functionality. Una vulnerabilidad de control de acceso inapropiado en el portal FortiProxy SSL VPN versiones 2.0.0, 1.2.9 y anteriores, puede permitir a un atacante remoto autenticado acceder a servicios internos como ZebOS Shell en el dispositivo FortiProxy... • https://fortiguard.com/advisory/FG-IR-20-235 •