Vulnerabilities > Fortinet > Fortiweb
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-12-08 | CVE-2021-41025 | Race Condition vulnerability in Fortinet Fortiweb Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 thorugh 6.0.7, including an instance of concurrent execution using shared resource with improper synchronization and one of authentication bypass by capture-replay, may allow a remote unauthenticated attacker to circumvent the authentication process and authenticate as a legitimate cluster peer. | 9.8 |
| 2021-12-08 | CVE-2021-36188 | Cross-site Scripting vulnerability in Fortinet Fortiweb A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted GET parameters in requests to login and error handlers | 6.1 |
| 2021-12-08 | CVE-2021-41013 | Incorrect Authorization vulnerability in Fortinet Fortiweb An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log & Report may allow an unauthorized and unauthenticated user to access the Log reports via their URLs. | 5.3 |
| 2021-12-08 | CVE-2021-36190 | Unspecified vulnerability in Fortinet Fortiweb A unintended proxy or intermediary ('confused deputy') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to access protected hosts via crafted HTTP requests. | 6.3 |
| 2021-12-08 | CVE-2021-43063 | Cross-site Scripting vulnerability in Fortinet Fortiweb A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the login webpage. | 6.1 |
| 2021-12-08 | CVE-2021-36191 | Open Redirect vulnerability in Fortinet Fortiweb A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to use the device as proxy via crafted GET parameters in requests to error handlers | 5.4 |
| 2021-12-08 | CVE-2021-41014 | Resource Exhaustion vulnerability in Fortinet Fortiweb A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to make the httpsd daemon unresponsive via huge HTTP packets | 7.5 |
| 2021-12-08 | CVE-2021-41015 | Cross-site Scripting vulnerability in Fortinet Fortiweb 6.4.0/6.4.1 A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to SAML login handler | 6.1 |
| 2021-12-08 | CVE-2021-41027 | Out-of-bounds Write vulnerability in Fortinet Fortiweb 6.4.0/6.4.1 A stack-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, allows an authenticated attacker to execute unauthorized code or commands via crafted certificates loaded into the device. | 7.8 |
| 2021-12-08 | CVE-2021-43064 | Open Redirect vulnerability in Fortinet Fortiweb A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to use the device as a proxy and reach external or protected hosts via redirection handlers. | 6.1 |