CVSS: 4.7EPSS: 0%CPEs: 99EXPL: 0CVE-2022-23439
https://notcve.org/view.php?id=CVE-2022-23439
22 Jan 2025 — A externally controlled reference to a resource in another sphere in Fortinet FortiManager before version 7.4.3, FortiMail before version 7.0.3, FortiAnalyzer before version 7.4.3, FortiVoice version 7.0.0, 7.0.1 and before 6.4.8, FortiProxy before version 7.0.4, FortiRecorder version 6.4.0 through 6.4.2 and before 6.0.10, FortiAuthenticator version 6.4.0 through 6.4.1 and before 6.3.3, FortiNDR version 7.2.0 before 7.1.0, FortiWLC before version 8.6.4, FortiPortal before version 6.0.9, FortiOS version 7.2.... • https://fortiguard.com/psirt/FG-IR-21-254 • CWE-610: Externally Controlled Reference to a Resource in Another Sphere •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2024-48885
https://notcve.org/view.php?id=CVE-2024-48885
16 Jan 2025 — A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiRecorder versions 7.2.0 through 7.2.1, 7.0.0 through 7.0.4, FortiWeb versions 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.10, 6.4.0 through 6.4.3, FortiVoice versions 7.0.0 through 7.0.4, 6.4.0 through 6.4.9, 6.0.0 through 6.0.12 allows attacker to escalate privilege via specially crafted packets. • https://fortiguard.fortinet.com/psirt/FG-IR-24-259 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2023-37931
https://notcve.org/view.php?id=CVE-2023-37931
14 Jan 2025 — An improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-88] in FortiVoice Entreprise version 7.0.0 through 7.0.1 and before 6.4.8 allows an authenticated attacker to perform a blind sql injection attack via sending crafted HTTP or HTTPS requests • https://fortiguard.com/psirt/FG-IR-23-220 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.7EPSS: 0%CPEs: 3EXPL: 0CVE-2024-40587
https://notcve.org/view.php?id=CVE-2024-40587
14 Jan 2025 — An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiVoice version 7.0.0 through 7.0.4 and before 6.4.9 allows an authenticated privileged attacker to execute unauthorized code or commands via crafted CLI requests. • https://fortiguard.fortinet.com/psirt/FG-IR-24-304 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-40720
https://notcve.org/view.php?id=CVE-2023-40720
14 May 2024 — An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiVoiceEntreprise version 7.0.0 through 7.0.1 and before 6.4.8 allows an authenticated attacker to read the SIP configuration of other users via crafted HTTP or HTTPS requests. Una omisión de autorización a través de una vulnerabilidad de clave controlada por el usuario [CWE-639] en FortiVoiceEntreprise versión 7.0.0 a 7.0.1 y anteriores a 6.4.8 permite a un atacante autenticado leer la configuración SIP de otros usuarios a tr... • https://fortiguard.com/psirt/FG-IR-23-282 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-37932
https://notcve.org/view.php?id=CVE-2023-37932
10 Jan 2024 — An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in FortiVoiceEntreprise version 7.0.0 and before 6.4.7 allows an authenticated attacker to read arbitrary files from the system via sending crafted HTTP or HTTPS requests Una vulnerabilidad de limitación inadecuada de un nombre de ruta a un directorio restringido ("Path traversal") [CWE-22] en FortiVoiceEntreprise versión 7.0.0 y anteriores a 6.4.7 permite a un atacante autenticado leer archivos arbitrar... • https://fortiguard.com/psirt/FG-IR-23-219 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •