5.3.1

DATE	CVE	VULNERABILITY TITLE	RISK
2023-11-14	CVE-2023-36553	Unspecified vulnerability in Fortinet Fortisiem A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 5.4.0 and 5.3.0 through 5.3.3 and 5.2.5 through 5.2.8 and 5.2.1 through 5.2.2 and 5.1.0 through 5.1.3 and 5.0.0 through 5.0.1 and 4.10.0 and 4.9.0 and 4.7.2 allows attacker to execute unauthorized code or commands via crafted API requests. network low complexity fortinet critical	9.8
2023-11-14	CVE-2023-45585	Unspecified vulnerability in Fortinet Fortisiem An insertion of sensitive information into log file vulnerability [CWE-532] in FortiSIEM version 7.0.0, version 6.7.6 and below, version 6.6.3 and below, version 6.5.1 and below, version 6.4.2 and below, version 6.3.3 and below, version 6.2.1 and below, version 6.1.2 and below, version 5.4.0, version 5.3.3 and below may allow an authenticated user to view an encrypted ElasticSearch password via debug log files generated when FortiSIEM is configured with ElasticSearch Event Storage. local low complexity fortinet	3.3
2023-06-13	CVE-2022-42478	Improper Restriction of Excessive Authentication Attempts vulnerability in Fortinet Fortisiem An Improper Restriction of Excessive Authentication Attempts [CWE-307] in FortiSIEM below 7.0.0 may allow a non-privileged user with access to several endpoints to brute force attack these endpoints. network low complexity fortinet CWE-307	8.8
2023-06-13	CVE-2022-43949	Use of a Broken or Risky Cryptographic Algorithm vulnerability in Fortinet Fortisiem A use of a broken or risky cryptographic algorithm [CWE-327] in Fortinet FortiSIEM before 6.7.1 allows a remote unauthenticated attacker to perform brute force attacks on GUI endpoints via taking advantage of outdated hashing methods. network low complexity fortinet CWE-327	7.5
2023-06-13	CVE-2023-26204	Insufficiently Protected Credentials vulnerability in Fortinet Fortisiem A plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions may allow an attacker able to access user DB content to impersonate any admin user on the device GUI. network low complexity fortinet CWE-522 critical	9.8
2022-11-02	CVE-2022-26119	Use of Hard-coded Credentials vulnerability in Fortinet Fortisiem A improper authentication vulnerability in Fortinet FortiSIEM before 6.5.0 allows a local attacker with CLI access to perform operations on the Glassfish server directly via a hardcoded password. local low complexity fortinet CWE-798	7.8