CVSS: 6.4EPSS: 0%CPEs: 12EXPL: 0CVE-2024-35280
https://notcve.org/view.php?id=CVE-2024-35280
15 Jan 2025 — A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiDeceptor 3.x all versions, 4.x all versions, 5.0 all versions, 5.1 all versions, version 5.2.0, and version 5.3.0 may allow an attacker to perform a reflected cross-site scripting attack in the recovery endpoints Una neutralización incorrecta de la entrada durante la generación de páginas web ("cross-site scripting") en Fortinet FortiDeceptor 3.x todas las versiones, 4.x todas las versiones, 5.0 todas las... • https://fortiguard.fortinet.com/psirt/FG-IR-24-010 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 0CVE-2022-27487
https://notcve.org/view.php?id=CVE-2022-27487
11 Apr 2023 — A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0.0 through 4.0.2 and before 3.3.3 allows a remote authenticated attacker to perform unauthorized API calls via crafted HTTP or HTTPS requests. • https://fortiguard.com/psirt/FG-IR-22-056 • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 15EXPL: 0CVE-2022-30305
https://notcve.org/view.php?id=CVE-2022-30305
06 Dec 2022 — An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor versions 4.2.0, 4.1.0 through 4.1.1, 4.0.0 through 4.0.2, 3.3.0 through 3.3.3, 3.2.0 through 3.2.2,3.1.0 through 3.1.1 and 3.0.0 through 3.0.2 may allow a remote attacker to repeatedly enter incorrect credentials without causing a log entry, and with no limit on the number of failed authentication attempts. Una vulnerabilidad de registro insuficiente [CWE-778] en las v... • https://fortiguard.com/psirt/FG-IR-21-170 • CWE-307: Improper Restriction of Excessive Authentication Attempts CWE-778: Insufficient Logging •
CVSS: 8.0EPSS: 0%CPEs: 4EXPL: 0CVE-2022-38373
https://notcve.org/view.php?id=CVE-2022-38373
02 Nov 2022 — An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiDeceptor management interface 4.2.0, 4.1.0 through 4.1.1, 4.0.2 may allow an authenticated user to perform a cross site scripting (XSS) attack via sending requests with specially crafted lure resource ID. Una neutralización inadecuada de la vulnerabilidad de entrada durante la generación de páginas web [CWE-79] en la interfaz de administración de FortiDeceptor 4.2.0, 4.1.0 a 4.1.1, 4.0.2 puede permitir que un usuar... • https://fortiguard.com/psirt/FG-IR-22-331 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-30302
https://notcve.org/view.php?id=CVE-2022-30302
18 Jul 2022 — Multiple relative path traversal vulnerabilities [CWE-23] in FortiDeceptor management interface 1.0.0 through 3.2.x, 3.3.0 through 3.3.2, 4.0.0 through 4.0.1 may allow a remote and authenticated attacker to retrieve and delete arbitrary files from the underlying filesystem via specially crafted web requests. Múltiples vulnerabilidades de salto de ruta relativo [CWE-23] en la interfaz de administración de FortiDeceptor versiones 1.0.0 hasta 3.2.x, 3.3.0 hasta 3.3.2, 4.0.0 hasta 4.0.1, pueden permitir a un at... • https://fortiguard.com/psirt/FG-IR-21-213 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •