CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 0CVE-2024-31488
https://notcve.org/view.php?id=CVE-2024-31488
14 May 2024 — An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 7.2.0 through 7.2.3 may allow a remote authenticated attacker to perform stored and reflected cross site scripting (XSS) attack via crafted HTTP requests. Una neutralización inadecuada de entradas durante la vulnerabilidad de generación de páginas web [CWE-79] en FortiNAC versión 9.4.0 a 9.4.4, 9.... • https://fortiguard.com/psirt/FG-IR-24-040 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-26206
https://notcve.org/view.php?id=CVE-2023-26206
15 Feb 2024 — An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9.1.0 - 9.1.10 and 7.2.0 allows an attacker to execute unauthorized code or commands via the name fields observed in the policy audit logs. Una neutralización inadecuada de la entrada durante la generación de la página web ('cross-site scripting') en Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9.1.0 - 9.1.10 y 7.2.0 permite a un atacante para ejecutar código o comand... • https://fortiguard.com/psirt/FG-IR-23-063 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 12EXPL: 0CVE-2023-33299
https://notcve.org/view.php?id=CVE-2023-33299
23 Jun 2023 — A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed. • https://fortiguard.com/psirt/FG-IR-23-074 • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2022-26116
https://notcve.org/view.php?id=CVE-2022-26116
11 May 2022 — Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.2 and below may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters. Múltiples neutralizaciones inapropiadas de elementos especiales usados en comandos SQL ("Inyección SQL") vulnerabilidad [C... • https://fortiguard.com/psirt/FG-IR-22-062 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2021-24011
https://notcve.org/view.php?id=CVE-2021-24011
10 May 2021 — A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges. Una vulnerabilidad de escalada de privilegios en FortiNAC versiones por debajo de 8.8.2, puede permitir a un usuario administrador escalar privilegios a root al abusar de los privilegios de sudo • https://fortiguard.com/advisory/FG-IR-20-038 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12816
https://notcve.org/view.php?id=CVE-2020-12816
24 Sep 2020 — An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the UserID of Admin Users. Una vulnerabilidad de neutralización inapropiada de la entrada en FortiNAC versiones anteriores a 8.7.2, puede permitir a un atacante autenticado remoto llevar a cabo un ataque de tipo cross site scripting (XSS) almacenado por medio de un UserID de Usuarios Administradores. • https://fortiguard.com/advisory/FG-IR-20-002 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •