Vulnerabilities > Fortinet > Medium

DATE CVE VULNERABILITY TITLE RISK
2022-11-02 CVE-2022-39945 Authorization Bypass Through User-Controlled Key vulnerability in Fortinet Fortimail
An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references (IDOR).
network
low complexity
fortinet CWE-639
6.5
2022-11-02 CVE-2022-39949 Unspecified vulnerability in Fortinet Fortiedr
An improper control of a resource through its lifetime vulnerability [CWE-664] in FortiEDR CollectorWindows 4.0.0 through 4.1, 5.0.0 through 5.0.3.751, 5.1.0 may allow a privileged user to terminate the FortiEDR processes with special tools and bypass the EDR protection.
local
low complexity
fortinet
5.5
2022-11-02 CVE-2022-39950 Cross-site Scripting vulnerability in Fortinet Fortianalyzer and Fortimanager
An improper neutralization of input during web page generation vulnerability [CWE-79] exists in FortiManager and FortiAnalyzer 6.0.0 all versions, 6.2.0 all versions, 6.4.0 through 6.4.8, and 7.0.0 through 7.0.4.
network
low complexity
fortinet CWE-79
5.4
2022-11-02 CVE-2022-42473 Missing Authentication for Critical Function vulnerability in Fortinet Fortisoar
A missing authentication for a critical function vulnerability in Fortinet FortiSOAR 6.4.0 - 6.4.4 and 7.0.0 - 7.0.3 and 7.2.0 allows an attacker to disclose information via logging into the database using a privileged account without a password.
local
low complexity
fortinet CWE-306
5.5
2022-10-10 CVE-2022-26121 Exposure of Resource to Wrong Sphere vulnerability in Fortinet Fortianalyzer and Fortimanager
An exposure of resource to wrong sphere vulnerability [CWE-668] in FortiAnalyzer and FortiManager GUI 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11, 5.6.0 through 5.6.11 may allow an unauthenticated and remote attacker to access report template images via referencing the name in the URL path.
network
low complexity
fortinet CWE-668
5.3
2022-09-06 CVE-2022-29062 Path Traversal vulnerability in Fortinet Fortisoar
Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to write to the underlying filesystem with nginx permissions via crafted HTTP requests.
network
low complexity
fortinet CWE-22
6.5
2022-09-06 CVE-2021-43076 Improper Privilege Management vulnerability in Fortinet Fortiadc
An improper privilege management vulnerability [CWE-269] in FortiADC versions 6.2.1 and below, 6.1.5 and below, 6.0.4 and below, 5.4.5 and below and 5.3.7 and below may allow a remote authenticated attacker with restricted user profile to modify the system files using the shell access.
network
low complexity
fortinet CWE-269
6.5
2022-09-06 CVE-2021-43080 Cross-site Scripting vulnerability in Fortinet Fortios
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.2.0, version 6.4.0 through 6.4.9, version 7.0.0 through 7.0.5 may allow an authenticated attacker to perform a stored cross site scripting (XSS) attack through the URI parameter via the Threat Feed IP address section of the Security Fabric External connectors.
network
low complexity
fortinet CWE-79
5.4
2022-09-06 CVE-2022-26114 Cross-site Scripting vulnerability in Fortinet Fortimail
An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated attacker to trigger a cross-site scripting (XSS) attack via sending specially crafted mail messages.
network
low complexity
fortinet CWE-79
6.1
2022-08-03 CVE-2022-23442 Unspecified vulnerability in Fortinet Fortios
An improper access control vulnerability [CWE-284] in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.0.0 through 7.0.5 may allow an authenticated attacker with a restricted user profile to gather the checksum information about the other VDOMs via CLI commands.
network
low complexity
fortinet
4.3