CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 0CVE-2024-31488
https://notcve.org/view.php?id=CVE-2024-31488
An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 7.2.0 through 7.2.3 may allow a remote authenticated attacker to perform stored and reflected cross site scripting (XSS) attack via crafted HTTP requests. Una neutralización inadecuada de entradas durante la vulnerabilidad de generación de páginas web [CWE-79] en FortiNAC versión 9.4.0 a 9.4.4, 9.2.0 a 9.2.8, 9.1.0 a 9.1.10, 8.8.0 a 8.8.11, 8.7.0 a 8.7.6, 7.2.0 a 7.2.3 pueden permitir que un atacante remoto autenticado realice un ataque de Cross Site Scripting (XSS) almacenado y reflejado a través de solicitudes HTTP manipuladas. • https://fortiguard.com/psirt/FG-IR-24-040 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-26206
https://notcve.org/view.php?id=CVE-2023-26206
An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9.1.0 - 9.1.10 and 7.2.0 allows an attacker to execute unauthorized code or commands via the name fields observed in the policy audit logs. Una neutralización inadecuada de la entrada durante la generación de la página web ('cross-site scripting') en Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9.1.0 - 9.1.10 y 7.2.0 permite a un atacante para ejecutar código o comandos no autorizados a través de los campos de nombre observados en los registros de auditoría de políticas. • https://fortiguard.com/psirt/FG-IR-23-063 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 12EXPL: 0CVE-2023-33299
https://notcve.org/view.php?id=CVE-2023-33299
A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed. • https://fortiguard.com/psirt/FG-IR-23-074 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2023-22633
https://notcve.org/view.php?id=CVE-2023-22633
An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions 8.7.0 all versions may allow an unauthenticated attacker to perform a DoS attack on the device via client-secure renegotiation. • https://fortiguard.com/psirt/FG-IR-22-521 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.6EPSS: 0%CPEs: 9EXPL: 0CVE-2022-39946
https://notcve.org/view.php?id=CVE-2022-39946
An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8.6 all versions, 8.5 all versions may allow a remote attacker authenticated on the administrative interface to perform unauthorized jsp calls via crafted HTTP requests. • https://fortiguard.com/psirt/FG-IR-22-332 • CWE-284: Improper Access Control •