Vulnerabilities > Fortinet > Fortimail > Medium

DATE CVE VULNERABILITY TITLE RISK
2021-12-08 CVE-2021-42757 Out-of-bounds Write vulnerability in Fortinet products
A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments.
local
low complexity
fortinet CWE-787
6.7
2021-07-12 CVE-2021-24013 Path Traversal vulnerability in Fortinet Fortimail
Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via specifically crafted web requests.
network
low complexity
fortinet CWE-22
6.5
2021-07-12 CVE-2021-26099 Unspecified vulnerability in Fortinet Fortimail
Missing cryptographic steps in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an attacker who comes in possession of the encrypted master keys to compromise their confidentiality by observing a few invariant properties of the ciphertext.
network
low complexity
fortinet
4.9
2020-01-23 CVE-2019-15707 Unspecified vulnerability in Fortinet Fortimail
An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they should not be authorized for.
network
low complexity
fortinet
4.9
2017-10-26 CVE-2017-7732 Cross-site Scripting vulnerability in Fortinet Fortimail
A reflected Cross-Site Scripting (XSS) vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9 customized pre-authentication webmail login page allows attacker to inject arbitrary web script or HTML via crafted HTTP requests.
network
low complexity
fortinet CWE-79
6.1
2017-04-12 CVE-2017-3125 Cross-site Scripting vulnerability in Fortinet Fortimail
An unauthenticated XSS vulnerability with FortiMail 5.0.0 - 5.2.9 and 5.3.0 - 5.3.8 could allow an attacker to execute arbitrary scripts in the security context of the browser of a victim logged in FortiMail, assuming the victim is social engineered into clicking an URL crafted by the attacker.
network
low complexity
fortinet CWE-79
6.1