Filtered by vendor Fortinet Subscriptions
Filtered by product Fortiweb Subscriptions
Total 84 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-41017 1 Fortinet 1 Fortiweb 2024-11-21 8.8 High
Multiple heap-based buffer overflow vulnerabilities in some web API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow a remote authenticated attacker to execute arbitrary code or commands via specifically crafted HTTP requests.
CVE-2021-41015 1 Fortinet 1 Fortiweb 2024-11-21 6.1 Medium
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to SAML login handler
CVE-2021-41014 1 Fortinet 1 Fortiweb 2024-11-21 7.5 High
A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to make the httpsd daemon unresponsive via huge HTTP packets
CVE-2021-41013 1 Fortinet 1 Fortiweb 2024-11-21 5.3 Medium
An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log & Report may allow an unauthorized and unauthenticated user to access the Log reports via their URLs.
CVE-2021-36195 1 Fortinet 1 Fortiweb 2024-11-21 4.2 Medium
Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, and 6.1.0 through 6.1.2 may allow an authenticated attacker to execute arbitrary commands on the underlying system shell via specially crafted command arguments.
CVE-2021-36194 1 Fortinet 1 Fortiweb 2024-11-21 8.8 High
Multiple stack-based buffer overflows in the API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted requests.
CVE-2021-36193 1 Fortinet 1 Fortiweb 2024-11-21 6.7 Medium
Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted commands.
CVE-2021-36191 1 Fortinet 1 Fortiweb 2024-11-21 4.1 Medium
A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to use the device as proxy via crafted GET parameters in requests to error handlers
CVE-2021-36190 1 Fortinet 1 Fortiweb 2024-11-21 5.5 Medium
A unintended proxy or intermediary ('confused deputy') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to access protected hosts via crafted HTTP requests.
CVE-2021-36188 1 Fortinet 1 Fortiweb 2024-11-21 6.1 Medium
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted GET parameters in requests to login and error handlers
CVE-2021-36187 1 Fortinet 1 Fortiweb 2024-11-21 5.3 Medium
A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to cause a denial of service for webserver daemon via crafted HTTP requests
CVE-2021-36186 1 Fortinet 1 Fortiweb 2024-11-21 8.8 High
A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests
CVE-2021-36182 1 Fortinet 1 Fortiweb 2024-11-21 8.8 High
A Improper neutralization of special elements used in a command ('Command Injection') in Fortinet FortiWeb version 6.3.13 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests
CVE-2021-36180 1 Fortinet 1 Fortiweb 2024-11-21 8.1 High
Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests.
CVE-2021-36179 1 Fortinet 1 Fortiweb 2024-11-21 8 High
A stack-based buffer overflow in Fortinet FortiWeb version 6.3.14 and below, 6.2.4 and below allows attacker to execute unauthorized code or commands via crafted parameters in CLI command execution
CVE-2021-36175 1 Fortinet 1 Fortiweb 2024-11-21 4.1 Medium
An improper neutralization of input vulnerability [CWE-79] in FortiWebManager versions 6.2.3 and below, 6.0.2 and below may allow a remote authenticated attacker to inject malicious script/tags via the name/description/comments parameter of various sections of the device.
CVE-2021-32591 1 Fortinet 4 Fortiadc, Fortimail, Fortisandbox and 1 more 2024-11-21 5.3 Medium
A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier may allow an attacker in possession of the password store to compromise the confidentiality of the encrypted secrets.
CVE-2021-22123 1 Fortinet 1 Fortiweb 2024-11-21 7.6 High
An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated attacker to execute arbitrary commands on the system via the SAML server configuration page.
CVE-2021-22122 1 Fortinet 1 Fortiweb 2024-11-21 6.1 Medium
An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to perform a reflected cross site scripting attack (XSS) by injecting malicious payload in different vulnerable API end-points.
CVE-2020-6646 1 Fortinet 1 Fortiweb 2024-11-21 5.4 Medium
An improper neutralization of input vulnerability in FortiWeb allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Disclaimer Description of a Replacement Message.