111 results (0.013 seconds)

CVSS: 4.7EPSS: 0%CPEs: 99EXPL: 0

CVE-2022-23439

https://notcve.org/view.php?id=CVE-2022-23439

22 Jan 2025 — A externally controlled reference to a resource in another sphere in Fortinet FortiManager before version 7.4.3, FortiMail before version 7.0.3, FortiAnalyzer before version 7.4.3, FortiVoice version 7.0.0, 7.0.1 and before 6.4.8, FortiProxy before version 7.0.4, FortiRecorder version 6.4.0 through 6.4.2 and before 6.0.10, FortiAuthenticator version 6.4.0 through 6.4.1 and before 6.3.3, FortiNDR version 7.2.0 before 7.1.0, FortiWLC before version 8.6.4, FortiPortal before version 6.0.9, FortiOS version 7.2.... • https://fortiguard.com/psirt/FG-IR-21-254 • CWE-610: Externally Controlled Reference to a Resource in Another Sphere •

CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0

CVE-2024-36504

https://notcve.org/view.php?id=CVE-2024-36504

14 Jan 2025 — An out-of-bounds read vulnerability [CWE-125] in FortiOS SSLVPN web portal versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, 7.0 all verisons, and 6.4 all versions may allow an authenticated attacker to perform a denial of service on the SSLVPN web portal via a specially crafted URL. • https://fortiguard.fortinet.com/psirt/FG-IR-23-473 • CWE-125: Out-of-bounds Read •

CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0

CVE-2024-46666

https://notcve.org/view.php?id=CVE-2024-46666

14 Jan 2025 — An allocation of resources without limits or throttling [CWE-770] vulnerability in FortiOS versions 7.6.0, versions 7.4.4 through 7.4.0, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow a remote unauthenticated attacker to prevent access to the GUI via specially crafted requests directed at specific endpoints. • https://fortiguard.fortinet.com/psirt/FG-IR-24-250 • CWE-770: Allocation of Resources Without Limits or Throttling •

CVSS: 9.0EPSS: 0%CPEs: 8EXPL: 0

CVE-2024-48886

https://notcve.org/view.php?id=CVE-2024-48886

14 Jan 2025 — A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.17, 2.0.0 through 2.0.14, FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiManager Cloud versions 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3 allows attacker to execute unauthorized code or commands via a brute-force attack. • https://fortiguard.fortinet.com/psirt/FG-IR-24-221 • CWE-1390: Weak Authentication •

CVSS: 7.8EPSS: 0%CPEs: 14EXPL: 0

CVE-2024-48884

https://notcve.org/view.php?id=CVE-2024-48884

14 Jan 2025 — A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiOS versions 7.6.0, 7.4.0 through 7.4.4, 7.2.5 through 7.2.9, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy 7.4.0 through 7.4.5, 7.2.0 through 7.2.11, 7.0.0 through 7.0.18, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiManager Cloud versions 7.4.1 through 7.4.3, FortiRecorder versions 7.2.0 throu... • https://fortiguard.fortinet.com/psirt/FG-IR-24-259 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0

CVE-2024-46668

https://notcve.org/view.php?id=CVE-2024-46668

14 Jan 2025 — An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiOS versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, versions 7.0.0 through 7.0.15, and versions 6.4.0 through 6.4.15 may allow an unauthenticated remote user to consume all system memory via multiple large file uploads. • https://fortiguard.fortinet.com/psirt/FG-IR-24-219 • CWE-770: Allocation of Resources Without Limits or Throttling •

CVSS: 5.0EPSS: 0%CPEs: 8EXPL: 0

CVE-2023-46715

https://notcve.org/view.php?id=CVE-2023-46715

14 Jan 2025 — An origin validation error [CWE-346] vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and version 7.2.6 and below allows an authenticated IPSec VPN user with dynamic IP addressing to send (but not receive) packets spoofing the IP of another user via crafted network packets. • https://fortiguard.com/psirt/FG-IR-23-407 • CWE-346: Origin Validation Error •

CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 0

CVE-2023-42786

https://notcve.org/view.php?id=CVE-2023-42786

14 Jan 2025 — A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all versions allows attacker to trigger a denial of service via a crafted http request. • https://fortiguard.fortinet.com/psirt/FG-IR-23-293 • CWE-476: NULL Pointer Dereference •

CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 0

CVE-2023-42785

https://notcve.org/view.php?id=CVE-2023-42785

14 Jan 2025 — A null pointer dereference in FortiOS versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, 7.0 all versions, 6.4 all versions , 6.2 all versions and 6.0 all versions allows attacker to trigger a denial of service via a crafted http request. • https://fortiguard.fortinet.com/psirt/FG-IR-23-293 • CWE-476: NULL Pointer Dereference •

CVSS: 10.0EPSS: 2%CPEs: 3EXPL: 6

CVE-2024-55591 – Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

https://notcve.org/view.php?id=CVE-2024-55591

14 Jan 2025 — An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module. An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows... • https://github.com/watchtowrlabs/fortios-auth-bypass-check-CVE-2024-55591 • CWE-288: Authentication Bypass Using an Alternate Path or Channel •