CVSS: 4.7EPSS: 0%CPEs: 99EXPL: 0CVE-2022-23439
https://notcve.org/view.php?id=CVE-2022-23439
22 Jan 2025 — A externally controlled reference to a resource in another sphere in Fortinet FortiManager before version 7.4.3, FortiMail before version 7.0.3, FortiAnalyzer before version 7.4.3, FortiVoice version 7.0.0, 7.0.1 and before 6.4.8, FortiProxy before version 7.0.4, FortiRecorder version 6.4.0 through 6.4.2 and before 6.0.10, FortiAuthenticator version 6.4.0 through 6.4.1 and before 6.3.3, FortiNDR version 7.2.0 before 7.1.0, FortiWLC before version 8.6.4, FortiPortal before version 6.0.9, FortiOS version 7.2.... • https://fortiguard.com/psirt/FG-IR-21-254 • CWE-610: Externally Controlled Reference to a Resource in Another Sphere •
CVSS: 8.6EPSS: 0%CPEs: 24EXPL: 0CVE-2022-26122
https://notcve.org/view.php?id=CVE-2022-26122
02 Nov 2022 — An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and version 6.4.274 and below may allow an attacker to bypass the AV engine via manipulating MIME attachment with junk and pad characters in base64. Una verificación insuficiente de la vulnerabilidad de autenticidad de datos [CWE-345] en los motores FortiClient, FortiMail y FortiOS AV versión 6.2.168 e inferiores y la versión 6.4.274 e inferiores puede permitir... • https://fortiguard.com/psirt/FG-IR-22-074 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-26114
https://notcve.org/view.php?id=CVE-2022-26114
06 Sep 2022 — An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated attacker to trigger a cross-site scripting (XSS) attack via sending specially crafted mail messages. Una vulnerabilidad de neutralización inapropiada de la entrada durante la generación de la página web [CWE-79] en el Webmail de FortiMail versiones anteriores a 7.2.0 puede permitir a un atacante no autenticado desencadenar un ataque de tipo cross-site sc... • https://fortiguard.com/psirt/FG-IR-21-045 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2021-32586
https://notcve.org/view.php?id=CVE-2021-32586
01 Mar 2022 — An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unauthenticated attacker to alter the environment of the underlying script interpreter via specifically crafted HTTP requests. Una vulnerabilidad de comprobación de entrada inapropiada en las instalaciones CGI del servidor web de FortiMail versiones anteriores a 7.0.1, puede permitir a un atacante no autenticado alterar el entorno del intérprete de scripts subyacente por medio de peticiones HTT... • https://fortiguard.com/psirt/FG-IR-21-008 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2021-36166
https://notcve.org/view.php?id=CVE-2021-36166
01 Mar 2022 — An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication token by means of the observation of certain system's properties. Una vulnerabilidad de autenticación inapropiada en FortiMail versiones anteriores a 7.0.1, puede permitir a un atacante remoto adivinar eficazmente el token de autenticación de una cuenta administrativa mediante la observación de determinadas propiedades del sistema. • https://fortiguard.com/psirt/FG-IR-21-028 • CWE-330: Use of Insufficiently Random Values •
CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 0CVE-2020-15933
https://notcve.org/view.php?id=CVE-2020-15933
05 Jan 2022 — A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and below FortiMail versions 6.4.1 and 6.4.0 allows attacker to obtain potentially sensitive software-version information via client-side resources inspection. Una exposición de información confidencial a un actor no autorizado en Fortinet FortiMail versiones 6.0.9 y anteriores, FortiMail versiones 6.2.4 y anteriores FortiMail versiones 6.4.1 y 6.4.0, permite a un atacante co... • https://fortiguard.com/psirt/FG-IR-20-105 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 22EXPL: 0CVE-2021-32591
https://notcve.org/view.php?id=CVE-2021-32591
08 Dec 2021 — A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier may allow an attacker in possession of the password store to compromise the confidentiality of the encrypted secrets. Una vulnerabilidad de pasos criptográficos faltantes en la función que cifra las credenciales LDAP y RADIUS de los usuarios en FortiSandbox versiones anteriores a 4.0.1, FortiWeb v... • https://fortiguard.com/advisory/FG-IR-20-222 •
CVSS: 6.7EPSS: 0%CPEs: 30EXPL: 0CVE-2021-42757
https://notcve.org/view.php?id=CVE-2021-42757
08 Dec 2021 — A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments. Un desbordamiento de búfer [CWE-121] en la biblioteca del cliente TFTP de FortiOS versiones anteriores a 6.4.7 y FortiOS versiones 7.0.0 hasta 7.0.2, puede permitir a un atacante local autenticado lograr una ejecución de código arbitrario por medio de argumentos de línea de c... • https://fortiguard.com/advisory/FG-IR-21-173 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-24013
https://notcve.org/view.php?id=CVE-2021-24013
12 Jul 2021 — Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via specifically crafted web requests. Múltiples vulnerabilidades de Salto de ruta en el Webmail de FortiMail versiones anteriores a 6.4.4, pueden permitir a un usuario normal conseguir acceso no autorizado a archivos y datos por medio de peticiones web específicamente diseñadas • https://fortiguard.com/advisory/FG-IR-21-014 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-24015
https://notcve.org/view.php?id=CVE-2021-24015
12 Jul 2021 — An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an authenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. Una vulnerabilidad de neutralización inapropiada de los elementos especiales usados en un Comando del Sistema Operativo en la interfaz administrativa de FortiMail versiones anteriores a 6.4.4 puede permitir a un atacante autenticado ejecutar comandos no autoriza... • https://fortiguard.com/advisory/FG-IR-21-021 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •