10 results (0.003 seconds)

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0

An authorization bypass through user-controlled key vulnerability [CWE-639] in Fortinet FortiPortal version 7.0.0 through 7.0.3 allows an authenticated attacker to interact with ressources of other organizations via HTTP or HTTPS requests. • https://fortiguard.fortinet.com/psirt/FG-IR-23-448 • CWE-639: Authorization Bypass Through User-Controlled Key •

CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0

An authorization bypass through user-controlled key in Fortinet FortiPortal version 7.2.0, and versions 7.0.0 through 7.0.6 allows attacker to view unauthorized resources via HTTP or HTTPS requests. • https://fortiguard.fortinet.com/psirt/FG-IR-24-011 • CWE-639: Authorization Bypass Through User-Controlled Key •

CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0

A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiPortal versions 7.0.0 through 7.0.6 and version 7.2.0 allows privileged user to obtain unauthorized information via the report download functionality. Una neutralización inadecuada de elementos especiales utilizados en un comando sql ("inyección sql") en las versiones 7.0.0 a 7.0.6 y 7.2.0 de Fortinet FortiPortal permite a un usuario privilegiado obtener información no autorizada a través de la funcionalidad de descarga de informes. • https://fortiguard.fortinet.com/psirt/FG-IR-24-128 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0

A Use Of Less Trusted Source [CWE-348] vulnerability in Fortinet FortiPortal version 7.0.0 through 7.0.6 and version 7.2.0 through 7.2.1 allows an unauthenticated attack to bypass IP protection through crafted HTTP or HTTPS packets. Una vulnerabilidad de uso de fuente menos confiable [CWE-348] en Fortinet FortiPortal versión 7.0.0 a 7.0.6 y versión 7.2.0 a 7.2.1 permite que un ataque no autenticado evite la protección IP a través de paquetes HTTP o HTTPS manipulados. • https://fortiguard.com/psirt/FG-IR-24-021 • CWE-348: Use of Less Trusted Source •

CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0

An improper authorization vulnerability [CWE-285] in FortiPortal version 7.2.0, and versions 7.0.6 and below reports may allow a user to download other organizations reports via modification in the request payload. Una vulnerabilidad de autorización inadecuada [CWE-285] en los informes de FortiPortal versión 7.2.0 y versiones 7.0.6 e inferiores puede permitir a un usuario descargar informes de otras organizaciones mediante modificaciones en el payload de la solicitud. • https://fortiguard.com/psirt/FG-IR-24-016 • CWE-285: Improper Authorization •