Vulnerabilities > Fortinet > High

DATE CVE VULNERABILITY TITLE RISK
2023-02-16 CVE-2022-40675 Unspecified vulnerability in Fortinet Fortinac and Fortinac-F
Some cryptographic issues in Fortinet FortiNAC versions 9.4.0 through 9.4.1, 9.2.0 through 9.2.7, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an attacker to decrypt and forge protocol communication messages.
network
high complexity
fortinet
7.4
2023-02-16 CVE-2022-40677 Argument Injection or Modification vulnerability in Fortinet Fortinac
A improper neutralization of argument delimiters in a command ('argument injection') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 allows attacker to execute unauthorized code or commands via specially crafted input parameters.
network
low complexity
fortinet CWE-88
8.8
2023-02-16 CVE-2022-40678 Insufficiently Protected Credentials vulnerability in Fortinet Fortinac
An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow a local attacker with database access to recover user passwords.
local
low complexity
fortinet CWE-522
7.8
2023-02-16 CVE-2022-40683 Double Free vulnerability in Fortinet Fortiweb 7.0.0/7.0.1/7.0.2
A double free in Fortinet FortiWeb version 7.0.0 through 7.0.3 may allows attacker to execute unauthorized code or commands via specially crafted commands
local
low complexity
fortinet CWE-415
7.8
2023-02-16 CVE-2022-41335 Path Traversal vulnerability in Fortinet Fortios, Fortiproxy and Fortiswitchmanager
A relative path traversal vulnerability [CWE-23] in Fortinet FortiOS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8 and before 6.4.10, FortiProxy version 7.2.0 through 7.2.1, 7.0.0 through 7.0.7 and before 2.0.10, FortiSwitchManager 7.2.0 and before 7.0.0 allows an authenticated attacker to read and write files on the underlying Linux system via crafted HTTP requests.
network
low complexity
fortinet CWE-22
8.1
2023-02-16 CVE-2023-23779 OS Command Injection vulnerability in Fortinet Fortiweb
Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests.
network
low complexity
fortinet CWE-78
8.8
2023-02-16 CVE-2023-23780 Out-of-bounds Write vulnerability in Fortinet Fortiweb
A stack-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, Fortinet FortiWeb version 6.3.6 through 6.3.19, Fortinet FortiWeb 6.4 all versions allows attacker to escalation of privilege via specifically crafted HTTP requests.
network
low complexity
fortinet CWE-787
8.8
2023-02-16 CVE-2023-23781 Out-of-bounds Write vulnerability in Fortinet Fortiweb
A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb version 7.0.1 and below, 6.4 all versions, version 6.3.19 and below SAML server configuration may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted XML files.
network
low complexity
fortinet CWE-787
8.8
2023-02-16 CVE-2023-23782 Out-of-bounds Write vulnerability in Fortinet Fortiweb
A heap-based buffer overflow in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb version 6.3.0 through 6.3.19, FortiWeb 6.4 all versions, FortiWeb 6.2 all versions, FortiWeb 6.1 all versions allows attacker to escalation of privilege via specifically crafted arguments to existing commands.
local
low complexity
fortinet CWE-787
7.8
2023-02-16 CVE-2023-23783 Use of Externally-Controlled Format String vulnerability in Fortinet Fortiweb
A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0 through 7.0.1, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted command arguments.
local
low complexity
fortinet CWE-134
7.8