CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2023-41675
https://notcve.org/view.php?id=CVE-2023-41675
10 Oct 2023 — A use after free vulnerability [CWE-416] in FortiOS version 7.2.0 through 7.2.4 and version 7.0.0 through 7.0.10 and FortiProxy version 7.2.0 through 7.2.2 and version 7.0.0 through 7.0.8 may allow an unauthenticated remote attacker to crash the WAD process via multiple crafted packets reaching proxy policies or firewall policies with proxy mode alongside SSL deep packet inspection. Una vulnerabilidad de use-after-free [CWE-416] en FortiOS versión 7.2.0 a 7.2.4 y versión 7.0.0 a 7.0.10 y FortiProxy versión ... • https://fortiguard.com/psirt/FG-IR-23-184 • CWE-416: Use After Free •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-41841
https://notcve.org/view.php?id=CVE-2023-41841
10 Oct 2023 — An improper authorization vulnerability in Fortinet FortiOS 7.0.0 - 7.0.11 and 7.2.0 - 7.2.4 allows an attacker belonging to the prof-admin profile to perform elevated actions. Una vulnerabilidad de autorización inadecuada en Fortinet FortiOS 7.0.0 - 7.0.11 y 7.2.0 - 7.2.4 permite que un atacante que pertenece al perfil prof-admin realice acciones elevadas. • https://fortiguard.com/psirt/FG-IR-23-318 • CWE-285: Improper Authorization •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-40718
https://notcve.org/view.php?id=CVE-2023-40718
10 Oct 2023 — A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packets. Un conflicto de interpretación en las versiones 7.321, 7.166 y 6.158 de Fortinet IPS Engine permite a un atacante evadir las funciones de IPS a través de paquetes TCP manipulados. • https://fortiguard.com/psirt/FG-IR-23-090 • CWE-436: Interpretation Conflict •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-36555
https://notcve.org/view.php?id=CVE-2023-36555
10 Oct 2023 — An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components. Una neutralización inadecuada de etiquetas html relacionadas con scripts en una página web (xss básico) en Fortinet FortiOS 7.2.0 - 7.2.4 permite a un atacante ejecutar código o comandos no autorizados a través de los componentes SAML y Security Fabric. • https://fortiguard.com/psirt/FG-IR-23-104 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2023-33301
https://notcve.org/view.php?id=CVE-2023-33301
10 Oct 2023 — An improper access control vulnerability in Fortinet FortiOS 7.2.0 - 7.2.4 and 7.4.0 allows an attacker to access a restricted resource from a non trusted host. Una vulnerabilidad de control de acceso inadecuado en Fortinet FortiOS 7.2.0 - 7.2.4 y 7.4.0 permite a un atacante acceder a un recurso restringido desde un host no confiable. • https://fortiguard.com/psirt/FG-IR-23-139 • CWE-284: Improper Access Control •
CVSS: 8.0EPSS: 0%CPEs: 6EXPL: 0CVE-2023-29183
https://notcve.org/view.php?id=CVE-2023-29183
13 Sep 2023 — An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 and FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14 GUI may allow an authenticated attacker to trigger malicious JavaScript code execution via crafted guest management setting. Una neutralización inadecuada de la entrada durante la vulnerabilidad de generación de páginas web ('Cross-Site Scripting'... • https://fortiguard.com/psirt/FG-IR-23-106 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 6EXPL: 0CVE-2023-33308
https://notcve.org/view.php?id=CVE-2023-33308
26 Jul 2023 — A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0 through 7.2.2 allows a remote unauthenticated attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alongside deep or full packet inspection. • https://fortiguard.com/psirt/FG-IR-23-183 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28001
https://notcve.org/view.php?id=CVE-2023-28001
11 Jul 2023 — An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing the session of a deleted user in the REST API. • https://fortiguard.com/psirt/FG-IR-23-028 • CWE-613: Insufficient Session Expiration •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-33307
https://notcve.org/view.php?id=CVE-2023-33307
16 Jun 2023 — A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to denial of sslvpn service via specifically crafted request in network parameter. • https://exchange.xforce.ibmcloud.com/vulnerabilities/258201 • CWE-476: NULL Pointer Dereference •
CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 0CVE-2023-33306
https://notcve.org/view.php?id=CVE-2023-33306
16 Jun 2023 — A null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11 and before 6.4.13, FortiProxy before 7.2.4 and before 7.0.10 allows attacker to denial of sslvpn service via specifically crafted request in bookmark parameter. • https://fortiguard.com/psirt/FG-IR-23-015 • CWE-476: NULL Pointer Dereference •