4.7.2

DATE	CVE	VULNERABILITY TITLE	RISK
2023-11-14	CVE-2023-36553	Unspecified vulnerability in Fortinet Fortisiem A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 5.4.0 and 5.3.0 through 5.3.3 and 5.2.5 through 5.2.8 and 5.2.1 through 5.2.2 and 5.1.0 through 5.1.3 and 5.0.0 through 5.0.1 and 4.10.0 and 4.9.0 and 4.7.2 allows attacker to execute unauthorized code or commands via crafted API requests. network low complexity fortinet critical	9.8
2020-01-28	CVE-2019-17651	Cross-site Scripting vulnerability in Fortinet Fortisiem An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Schedule in FortiSIEM version 5.2.5 and below may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack (XSS) by injecting malicious JavaScript code into the description field of a Device Maintenance schedule. network low complexity fortinet CWE-79	5.4
2020-01-07	CVE-2019-6700	Insufficiently Protected Credentials vulnerability in Fortinet Fortisiem An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated attacker to retrieve the external authentication password via the HTML source code. network low complexity fortinet CWE-522	6.5
2019-04-17	CVE-2018-13378	Information Exposure vulnerability in Fortinet Fortisiem An information disclosure vulnerability in Fortinet FortiSIEM 5.2.0 and below versions exposes the LDAP server plaintext password via the HTML source code. network low complexity fortinet CWE-200	7.2