Vulnerabilities > Fortinet > Fortisiem > 5.2.5

DATE CVE VULNERABILITY TITLE RISK
2023-11-14 CVE-2023-36553 Unspecified vulnerability in Fortinet Fortisiem
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 5.4.0 and 5.3.0 through 5.3.3 and 5.2.5 through 5.2.8 and 5.2.1 through 5.2.2 and 5.1.0 through 5.1.3 and 5.0.0 through 5.0.1 and 4.10.0 and 4.9.0 and 4.7.2 allows attacker to execute unauthorized code or commands via crafted API requests.
network
low complexity
fortinet
critical
9.8
2023-06-13 CVE-2022-42478 Improper Restriction of Excessive Authentication Attempts vulnerability in Fortinet Fortisiem
An Improper Restriction of Excessive Authentication Attempts [CWE-307] in FortiSIEM below 7.0.0 may allow a non-privileged user with access to several endpoints to brute force attack these endpoints.
network
low complexity
fortinet CWE-307
8.8
2022-11-02 CVE-2022-26119 Use of Hard-coded Credentials vulnerability in Fortinet Fortisiem
A improper authentication vulnerability in Fortinet FortiSIEM before 6.5.0 allows a local attacker with CLI access to perform operations on the Glassfish server directly via a hardcoded password.
local
low complexity
fortinet CWE-798
7.8
2020-03-12 CVE-2019-17653 Cross-Site Request Forgery (CSRF) vulnerability in Fortinet Fortisiem 5.2.5
A Cross-Site Request Forgery (CSRF) vulnerability in the user interface of Fortinet FortiSIEM 5.2.5 could allow a remote, unauthenticated attacker to perform arbitrary actions using an authenticated user's session by persuading the victim to follow a malicious link.
network
low complexity
fortinet CWE-352
8.8
2020-01-23 CVE-2019-16153 Use of Hard-coded Credentials vulnerability in Fortinet Fortisiem
A hard-coded password vulnerability in the Fortinet FortiSIEM database component version 5.2.5 and below may allow attackers to access the device database via the use of static credentials.
network
low complexity
fortinet CWE-798
critical
9.8