Fortinet Fortios (Fortinet) - vulnerabilities (CVEs)

47 CVEs, 0 in the last 30 days, 4 known versions, newest CVE from 2022-11-02. Vendor: Fortinet.

CVEs of Fortinet Fortios

• CVE-2022-38380 - CVSS 4.3 (medium), 2022-11-02: An improper access control [CWE-284] vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticated read-only user…
• CVE-2022-35842 - CVSS 7.5 (high), 2022-11-02: An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiOS SSL-VPN versions 7.2.0, versions 7.0.0 through 7.0.6 and…
• CVE-2022-30307 - CVSS 8.1 (high), 2022-11-02: A key management error vulnerability [CWE-320] affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below may allow an…
• CVE-2022-29055 - CVSS 7.5 (high), 2022-10-18: A access of uninitialized pointer in Fortinet FortiOS version 7.2.0, 7.0.0 through 7.0.5, 6.4.0 through 6.4.8, 6.2.0 through 6.2.10, 6.0.x, FortiProxy version…
• CVE-2022-40684 - CVSS 9.8 (critical), 2022-10-18: An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy…
• CVE-2021-44171 - CVSS 9 (critical), 2022-10-10: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiOS version 6.0.0 through 6.0.14, FortiOS version…
• CVE-2022-29053 - CVSS 3.3 (low), 2022-09-06: A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the keytab files in FortiOS version 7.2.0, 7.0.0 through 7.0.5 and below…
• CVE-2022-27491 - CVSS 7.5 (high), 2022-09-06: A improper verification of source of a communication channel in Fortinet FortiOS with IPS engine version 7.201 through 7.214, 7.001 through 7.113, 6.001…
• CVE-2021-43080 - CVSS 5.4 (medium), 2022-09-06: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.2.0, version 6.4.0 through 6.4.9, version 7.0.0…
• CVE-2022-23442 - CVSS 4.3 (medium), 2022-08-03: An improper access control vulnerability [CWE-284] in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.0.0 through 7.0.5 may allow an…
• CVE-2022-23438 - CVSS 6.1 (medium), 2022-07-18: An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in FortiOS version 7.0.5 and prior and 6.4.9…
• CVE-2022-22306 - CVSS 5.4 (medium), 2022-05-24: An improper certificate validation vulnerability [CWE-295] in FortiOS 6.0.0 through 6.0.14, 6.2.0 through 6.2.10, 6.4.0 through 6.4.8, 7.0.0 may allow a…
• CVE-2021-43206 - CVSS 4.3 (medium), 2022-05-04: A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.x, 6.0.x and FortiProxy…
• CVE-2021-41032 - CVSS 6.3 (medium), 2022-05-04: An improper access control vulnerability [CWE-284] in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attacker with a…
• CVE-2020-15936 - CVSS 4.5 (medium), 2022-03-01: A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version 6.0.11 and below, version 5.6.13 and below allows…
• CVE-2021-26092 - CVSS 6.1 (medium), 2022-02-24: Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0…
• CVE-2021-44168 - CVSS 7.8 (high), 2022-01-04: A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated…
• CVE-2021-36169 - CVSS 6 (medium), 2021-12-13: A Hidden Functionality in Fortinet FortiOS 7.x before 7.0.1, FortiOS 6.4.x before 6.4.7 allows attacker to Execute unauthorized code or commands via specific…
• CVE-2021-36173 - CVSS 8.8 (high), 2021-12-08: A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, and…
• CVE-2021-26108 - CVSS 7.5 (high), 2021-12-08: A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS before 7.0.1 may allow an attacker to retrieve the key by reverse engineering.
• CVE-2021-41024 - CVSS 7.5 (high), 2021-12-08: A relative path traversal [CWE-23] vulnerabiltiy in FortiOS versions 7.0.0 and 7.0.1 and FortiProxy verison 7.0.0 may allow an unauthenticated, unauthorized…
• CVE-2021-26109 - CVSS 9.8 (critical), 2021-12-08: An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt…
• CVE-2021-26103 - CVSS 8.8 (high), 2021-12-08: An insufficient verification of data authenticity vulnerability (CWE-345) in the user interface of FortiProxy verison 2.0.3 and below, 1.2.11 and below and…
• CVE-2021-26110 - CVSS 7.8 (high), 2021-12-08: An improper access control vulnerability [CWE-284] in FortiOS autod daemon 7.0.0, 6.4.6 and below, 6.2.9 and below, 6.0.12 and below and FortiProxy 2.0.1 and…
• CVE-2021-32600 - CVSS 5 (medium), 2021-11-17: An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS CLI 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, 6.0.x and 5.6.x…
• CVE-2021-41019 - CVSS 6.5 (medium), 2021-11-02: An improper validation of certificate with host mismatch [CWE-297] vulnerability in FortiOS versions 6.4.6 and below may allow the connection to a malicious…
• CVE-2021-24018 - CVSS 8.8 (high), 2021-08-04: A buffer underwrite vulnerability in the firmware verification routine of FortiOS before 7.0.1 may allow an attacker located in the adjacent network to…
• CVE-2021-24012 - CVSS 7.3 (high), 2021-06-02: An improper following of a certificate's chain of trust vulnerability in FortiGate versions 6.4.0 to 6.4.4 may allow an LDAP user to connect to SSLVPN with…
• CVE-2020-15938 - CVSS 7.5 (high), 2021-03-04: When traffic other than HTTP/S (eg: SSH traffic, etc...) traverses the FortiGate in version below 6.2.5 and below 6.4.2 on port 80/443, it is not redirected…
• CVE-2020-15937 - CVSS 6.1 (medium), 2021-03-03: An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored…
• CVE-2020-12818 - CVSS 5.3 (medium), 2020-09-24: An insufficient logging vulnerability in FortiGate before 6.4.1 may allow the traffic from an unauthenticated attacker to Fortinet owned IP addresses to go…
• CVE-2019-5591 - CVSS 6.5 (medium), 2020-08-14: A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating…
• CVE-2019-6696 - CVSS 6.1 (medium), 2020-03-15: An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may allow an attacker to perform an URL…
• CVE-2019-15703 - CVSS 7.5 (high), 2019-10-24: An Insufficient Entropy in PRNG vulnerability in Fortinet FortiOS 6.2.1, 6.2.0, 6.0.8 and below for device not enable hardware TRNG token and models not…
• CVE-2019-5588 - CVSS 6.1 (medium), 2019-06-04: A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized…
• CVE-2019-5587 - CVSS 6.5 (medium), 2019-06-04: Lack of root file system integrity checking in Fortinet FortiOS VM application images all versions below 6.0.5 may allow attacker to implant malicious…
• CVE-2019-5586 - CVSS 6.1 (medium), 2019-06-04: A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10, 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to…
• CVE-2018-13384 - CVSS 6.1 (medium), 2019-06-04: A Host Header Redirection vulnerability in Fortinet FortiOS all versions below 6.0.5 under SSL VPN web portal allows a remote attacker to potentially poison…
• CVE-2018-13382 - CVSS 9.1 (critical), 2019-06-04: An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to…
• CVE-2018-13379 - CVSS 9.8 (critical), 2019-06-04: An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and…
• CVE-2018-13365 - CVSS 5.3 (medium), 2019-05-29: An Information Exposure vulnerability in Fortinet FortiOS 6.0.1, 5.6.5 and below, allow attackers to learn private IP as well as the hostname of FortiGate via…
• CVE-2018-13366 - CVSS 5.3 (medium), 2019-04-09: An information disclosure vulnerability in Fortinet FortiOS 6.0.1, 5.6.7 and below allows attacker to reveals serial number of FortiGate via hostname field…
• CVE-2018-13374 - CVSS 4.3 (medium), 2019-01-22: A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP…
• CVE-2018-9185 - CVSS 8.1 (high), 2018-07-05: An information disclosure vulnerability in Fortinet FortiOS 6.0.0 and below versions reveals user's web portal login credentials in a Javascript file sent to…
• CVE-2017-7733 - CVSS 6.1 (medium), 2017-10-27: A Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 and 5.6.0 allows a remote unauthenticated attacker to execute arbitrary…
• CVE-2017-14182 - CVSS 6.5 (medium), 2017-10-27: A Denial of Service (DoS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 allows an authenticated user to cause the web GUI to be temporarily unresponsive,…
• CVE-2017-3128 - CVSS 4.8 (medium), 2017-05-23: A stored XSS (Cross-Site-Scripting) vulnerability in Fortinet FortiOS allows attackers to execute unauthorized code or commands via the policy global-label…