Vulnerabilities > Fortinet > Fortiwan
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-12-13 | CVE-2023-44251 | Path Traversal vulnerability in Fortinet Fortiwan ** UNSUPPORTED WHEN ASSIGNED **A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in Fortinet FortiWAN version 5.2.0 through 5.2.1 and version 5.1.1. | 8.8 |
| 2023-12-13 | CVE-2023-44252 | Improper Authentication vulnerability in Fortinet Fortiwan ** UNSUPPORTED WHEN ASSIGNED **An improper authentication vulnerability [CWE-287] in Fortinet FortiWAN version 5.2.0 through 5.2.1 and version 5.1.1 through 5.1.2 may allow an authenticated attacker to escalate his privileges via HTTP or HTTPs requests with crafted JWT token values. | 8.8 |
| 2023-02-16 | CVE-2022-33869 | OS Command Injection vulnerability in Fortinet Fortiwan An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiWAN 4.0.0 through 4.5.9 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands. | 8.8 |
| 2022-04-06 | CVE-2021-26113 | Use of Password Hash With Insufficient Computational Effort vulnerability in Fortinet Fortiwan 4.2.4 A use of a one-way hash with a predictable salt vulnerability [CWE-760] in FortiWAN before 4.5.9 may allow an attacker who has previously come in possession of the password file to potentially guess passwords therein stored. | 5.0 |
| 2022-04-06 | CVE-2021-32585 | Cross-site Scripting vulnerability in Fortinet Fortiwan 4.2.4 An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiWAN before 4.5.9 may allow an attacker to perform a stored cross-site scripting attack via specifically crafted HTTP requests. | 4.3 |
| 2022-04-06 | CVE-2021-24009 | OS Command Injection vulnerability in Fortinet Fortiwan 4.2.4 Multiple improper neutralization of special elements used in an OS command vulnerabilities (CWE-78) in the Web GUI of FortiWAN before 4.5.9 may allow an authenticated attacker to execute arbitrary commands on the underlying system's shell via specifically crafted HTTP requests. | 9.0 |
| 2022-04-06 | CVE-2021-26112 | Out-of-bounds Write vulnerability in Fortinet Fortiwan 4.2.4 Multiple stack-based buffer overflow vulnerabilities [CWE-121] both in network daemons and in the command line interpreter of FortiWAN before 4.5.9 may allow an unauthenticated attacker to potentially corrupt control data in memory and execute arbitrary code via specifically crafted requests. | 7.5 |
| 2022-04-06 | CVE-2021-26114 | SQL Injection vulnerability in Fortinet Fortiwan 4.2.4 Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiWAN before 4.5.9 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. | 7.5 |
| 2022-04-06 | CVE-2021-32593 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Fortinet Fortiwan 4.2.4 A use of a broken or risky cryptographic algorithm vulnerability [CWE-327] in the Dynamic Tunnel Protocol of FortiWAN before 4.5.9 may allow an unauthenticated remote attacker to decrypt and forge protocol communication messages. | 6.4 |
| 2016-09-21 | CVE-2016-4969 | Cross-site Scripting vulnerability in Fortinet Fortiwan Cross-site scripting (XSS) vulnerability in Fortinet FortiWan (formerly AscernLink) before 4.2.5 allows remote attackers to inject arbitrary web script or HTML via the IP parameter to script/statistics/getconn.php. | 4.3 |