Filtered by vendor Fortinet Subscriptions
Total 835 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-22128 1 Fortinet 1 Fortiproxy 2024-11-21 7.1 High
An improper access control vulnerability in FortiProxy SSL VPN portal 2.0.0, 1.2.9 and below versions may allow an authenticated, remote attacker to access internal service such as the ZebOS Shell on the FortiProxy appliance through the Quick Connection functionality.
CVE-2021-22127 1 Fortinet 1 Forticlient 2024-11-21 7.1 High
An improper input validation vulnerability in FortiClient for Linux 6.4.x before 6.4.3, FortiClient for Linux 6.2.x before 6.2.9 may allow an unauthenticated attacker to execute arbitrary code on the host operating system as root via tricking the user into connecting to a network with a malicious name.
CVE-2021-22125 1 Fortinet 1 Fortisandbox 2024-11-21 6.3 Medium
An instance of improper neutralization of special elements in the sniffer module of FortiSandbox before 3.2.2 may allow an authenticated administrator to execute commands on the underlying system's shell via altering the content of its configuration file.
CVE-2021-22124 1 Fortinet 2 Fortiauthenticator, Fortisandbox 2024-11-21 7.5 High
An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, and 3.0.0 through 3.0.6; and FortiAuthenticator before 6.0.6 may allow an unauthenticated attacker to bring the device into an unresponsive state via specifically-crafted long request parameters.
CVE-2021-22123 1 Fortinet 1 Fortiweb 2024-11-21 7.6 High
An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated attacker to execute arbitrary commands on the system via the SAML server configuration page.
CVE-2021-22122 1 Fortinet 1 Fortiweb 2024-11-21 6.1 Medium
An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to perform a reflected cross site scripting attack (XSS) by injecting malicious payload in different vulnerable API end-points.
CVE-2020-9294 1 Fortinet 2 Fortimail, Fortivoice 2024-11-21 9.8 Critical
An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user interface.
CVE-2020-9292 1 Fortinet 1 Fortisiem Windows Agent 2024-11-21 9.8 Critical
An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the AoWinAgt executable service path.
CVE-2020-9291 1 Fortinet 1 Forticlient 2024-11-21 6.3 Medium
An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain elevated privileges via exhausting the pool of temporary file names combined with a symbolic link attack.
CVE-2020-9290 1 Fortinet 2 Forticlient, Forticlient Virtual Private Network 2024-11-21 7.8 High
An Unsafe Search Path vulnerability in FortiClient for Windows online installer 6.2.3 and below may allow a local attacker with control over the directory in which FortiClientOnlineInstaller.exe and FortiClientVPNOnlineInstaller.exe resides to execute arbitrary code on the system via uploading malicious Filter Library DLL files in that directory.
CVE-2020-9289 1 Fortinet 2 Fortianalyzer, Fortimanager 2024-11-21 7.5 High
Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and below may allow an attacker with access to the CLI configuration or the CLI backup file to decrypt the sensitive data, via knowledge of the hard-coded key.
CVE-2020-9288 1 Fortinet 1 Fortiwlc 2024-11-21 5.4 Medium
An improper neutralization of input vulnerability in FortiWLC 8.5.1 allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the ESS profile or the Radius Profile.
CVE-2020-9287 1 Fortinet 1 Forticlient Emergency Management Server 2024-11-21 7.8 High
An Unsafe Search Path vulnerability in FortiClient EMS online installer 6.2.1 and below may allow a local attacker with control over the directory in which FortiClientEMSOnlineInstaller.exe resides to execute arbitrary code on the system via uploading malicious Filter Library DLL files in that directory.
CVE-2020-9286 1 Fortinet 2 Fortiadc, Fortiadc Firmware 2024-11-21 6.5 Medium
An improper authorization vulnerability in FortiADC may allow a remote authenticated user with low privileges to perform certain actions such as rebooting the system.
CVE-2020-6649 1 Fortinet 1 Fortiisolator 2024-11-21 9.8 Critical
An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks)
CVE-2020-6648 1 Fortinet 2 Fortios, Fortiproxy 2024-11-21 5.3 Medium
A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an authenticated attacker to obtain sensitive information such as users passwords by connecting to FortiGate CLI and executing the "diag sys ha checksum show" command.
CVE-2020-6647 1 Fortinet 1 Fortiadc Firmware 2024-11-21 5.4 Medium
An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to perform a cross site scripting attack (XSS) via the name parameter.
CVE-2020-6646 1 Fortinet 1 Fortiweb 2024-11-21 5.4 Medium
An improper neutralization of input vulnerability in FortiWeb allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Disclaimer Description of a Replacement Message.
CVE-2020-6644 1 Fortinet 1 Fortideceptor 2024-11-21 8.1 High
An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks.
CVE-2020-6643 1 Fortinet 1 Fortiisolator 2024-11-21 5.4 Medium
An improper neutralization of input vulnerability in the URL Description in Fortinet FortiIsolator version 1.2.2 allows a remote authenticated attacker to perform a cross site scripting attack (XSS).