Vulnerabilities > Fortinet > Critical
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-01-14 | CVE-2020-29015 | SQL Injection vulnerability in Fortinet Fortiweb A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sending a request with a crafted Authorization header containing a malicious SQL statement. | 9.8 |
| 2020-07-24 | CVE-2020-12812 | Improper Handling of Case Sensitivity vulnerability in Fortinet Fortios An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username. | 9.8 |
| 2020-06-04 | CVE-2020-9292 | Unquoted Search Path or Element vulnerability in Fortinet Fortisiem Windows Agent 3.0/3.1.2 An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the AoWinAgt executable service path. | 9.8 |
| 2020-04-27 | CVE-2020-9294 | Improper Authentication vulnerability in Fortinet Fortimail An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user interface. | 9.8 |
| 2020-03-12 | CVE-2019-17658 | Unquoted Search Path or Element vulnerability in Fortinet Forticlient An unquoted service path vulnerability in the FortiClient FortiTray component of FortiClientWindows v6.2.2 and prior allow an attacker to gain elevated privileges via the FortiClientConsole executable service path. | 9.8 |
| 2020-02-04 | CVE-2015-3613 | Improper Privilege Management vulnerability in Fortinet Fortimanager A vulnerability exists in in FortiManager 5.2.1 and earlier and 5.0.10 and earlier in the WebUI FTP backup page | 9.8 |
| 2020-01-23 | CVE-2019-16153 | Use of Hard-coded Credentials vulnerability in Fortinet Fortisiem A hard-coded password vulnerability in the Fortinet FortiSIEM database component version 5.2.5 and below may allow attackers to access the device database via the use of static credentials. | 9.8 |
| 2019-08-23 | CVE-2019-6695 | Insufficient Verification of Data Authenticity vulnerability in Fortinet Fortimanager 6.2.0 Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-party programs by recreating the image through specific methods. | 9.8 |
| 2019-08-23 | CVE-2019-6698 | Use of Hard-coded Credentials vulnerability in Fortinet Fortirecorder Firmware Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated attacker with knowledge of the aforementioned credentials and network access to FortiCameras to take control of those, provided they are managed by a FortiRecorder device. | 9.8 |
| 2019-07-08 | CVE-2019-13400 | Insufficiently Protected Credentials vulnerability in Fortinet Fcm-Mb40 Firmware 1.2.0.0 Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. | 9.8 |