Vulnerabilities > Fortinet > Medium

DATE CVE VULNERABILITY TITLE RISK
2021-04-12 CVE-2019-17656 Out-of-bounds Write vulnerability in Fortinet Fortios
A Stack-based Buffer Overflow vulnerability in the HTTPD daemon of FortiOS 6.0.10 and below, 6.2.2 and below and FortiProxy 1.0.x, 1.1.x, 1.2.9 and below, 2.0.0 and below may allow an authenticated remote attacker to crash the service by sending a malformed PUT request to the server.
network
low complexity
fortinet CWE-787
6.5
2021-03-04 CVE-2021-22128 Unspecified vulnerability in Fortinet Fortiproxy
An improper access control vulnerability in FortiProxy SSL VPN portal 2.0.0, 1.2.9 and below versions may allow an authenticated, remote attacker to access internal service such as the ZebOS Shell on the FortiProxy appliance through the Quick Connection functionality.
network
low complexity
fortinet
4.3
2021-03-03 CVE-2020-15937 Cross-site Scripting vulnerability in Fortinet Fortios
An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack (XSS) via the IPS and WAF logs dashboard.
network
low complexity
fortinet CWE-79
6.1
2021-02-08 CVE-2021-22122 Cross-site Scripting vulnerability in Fortinet Fortiweb
An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to perform a reflected cross site scripting attack (XSS) by injecting malicious payload in different vulnerable API end-points.
network
low complexity
fortinet CWE-79
6.1
2021-01-14 CVE-2020-29019 Out-of-bounds Write vulnerability in Fortinet Fortiweb
A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow a remote, unauthenticated attacker to crash the httpd daemon thread by sending a request with a crafted cookie header.
network
low complexity
fortinet CWE-787
5.3
2020-10-21 CVE-2020-6648 Cleartext Storage of Sensitive Information vulnerability in Fortinet Fortios and Fortiproxy
A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an authenticated attacker to obtain sensitive information such as users passwords by connecting to FortiGate CLI and executing the "diag sys ha checksum show" command.
network
low complexity
fortinet CWE-312
6.5
2020-09-24 CVE-2020-12815 Cross-site Scripting vulnerability in Fortinet Fortianalyzer and Fortitester
An improper neutralization of input vulnerability in FortiTester before 3.9.0 may allow a remote authenticated attacker to inject script related HTML tags via IPv4/IPv6 address fields.
network
low complexity
fortinet CWE-79
5.4
2020-09-24 CVE-2020-12811 Cross-site Scripting vulnerability in Fortinet Fortianalyzer and Fortimanager
An improper neutralization of script-related HTML tags in a web page in FortiManager 6.2.0, 6.2.1, 6.2.2, and 6.2.3and FortiAnalyzer 6.2.0, 6.2.1, 6.2.2, and 6.2.3 may allow an attacker to execute a cross site scripting (XSS) via the Identify Provider name field.
network
low complexity
fortinet CWE-79
6.1
2020-09-24 CVE-2020-12818 Unspecified vulnerability in Fortinet Fortios
An insufficient logging vulnerability in FortiGate before 6.4.1 may allow the traffic from an unauthenticated attacker to Fortinet owned IP addresses to go unnoticed.
network
low complexity
fortinet
5.3
2020-09-24 CVE-2020-12816 Cross-site Scripting vulnerability in Fortinet Fortinac
An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the UserID of Admin Users.
network
low complexity
fortinet CWE-79
6.1