Advisories · Technology
Fortinet FortiMail.
Every CVE that names Fortinet FortiMail among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.7 High
SQL injection in Fortinet FortiMail
- Fortinet FortiMail
- SQL injection
- CVSS 9.8 CriticalCritical · KEV, CVSS 9+KEV
Path traversal in Fortinet FortiMail
- Fortinet FortiMail
- Path traversal
- CVSS 6.3 Medium
SQL injection in Fortinet FortiMail
- Fortinet FortiMail
- SQL injection
- CVSS 3.8 Low
Cleartext storage of sensitive information in Fortinet FortiVoice and others
- Fortinet FortiVoice
- Fortinet FortiMail
- Information disclosure
- CVSS 3.9 Low
CRLF injection in Fortinet FortiMail
- Fortinet FortiMail
- Other injection
- CVSS 4.2 Medium
Information disclosure in Fortinet FortiManager and others
- Fortinet FortiManager
- Fortinet FortiOS
- Information disclosure
- CVSS 4.2 Medium
Path traversal in Fortinet FortiCamera and others
- Fortinet FortiCamera
- Fortinet FortiNDR
- Path traversal
- CVSS 9.6 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
Stack-based buffer overflow in Fortinet FortiNDR and others
- Fortinet FortiNDR
- Fortinet FortiCamera
- Memory corruption
- CVSS 4.5 Medium
Buffer overflow in Fortinet FortiNDR and others
- Fortinet FortiNDR
- Fortinet FortiMail
- Memory corruption
- CVSS 6.9 Medium
Weak random number generator in Fortinet FortiMail
- Fortinet FortiMail
- Weak cryptography or TLS
- CVSS 9.0 CriticalCritical · CVSS 9+
Improper access control in Fortinet FortiMail
- Fortinet FortiMail
- Broken access control
- CVSS 6.5 Medium
Stack-based buffer overflow in Fortinet FortiMail
- Fortinet FortiMail
- Memory corruption
- CVSS 4.1 Medium
A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the `Host` header points to an arbitr…
- Fortinet FortiTester
- Fortinet FortiOS
- CWE-610
- CVSS 6.5 Medium
OS command injection in Fortinet FortiMail and others
- Fortinet FortiMail
- Fortinet FortiRecorder
- Command injection
- CVSS 7.5 High
Cross-site request forgery in Fortinet FortiVoice and others
- Fortinet FortiVoice
- Fortinet FortiRecorder
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
Improper authorization in Fortinet FortiMail
- Fortinet FortiMail
- Broken access control
- CVSS 5.3 Medium
Unlimited authentication attempts in Fortinet FortiMail
- Fortinet FortiMail
- Authentication bypass
- CVSS 3.4 Low
Cross-site scripting in Fortinet FortiMail
- Fortinet FortiMail
- Cross-site scripting (XSS)
- CVSS 8.6 High
Incorrect authorization in Fortinet FortiMail
- Fortinet FortiMail
- Broken access control
- CVSS 3.5 Low
Unlimited authentication attempts in Fortinet FortiMail
- Fortinet FortiMail
- Authentication bypass
- CVSS 5.4 Medium
An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a sp…
- Fortinet FortiMail
- CVSS 5.4 Medium
An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated attacker to trigger a cross-site scripting…
- Fortinet FortiMail
- CVSS 7.7 High
An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unauthenticated attacker to alter the environment of the underlying script interpret…
- Fortinet FortiMail
- CVSS 9.8 CriticalCritical · CVSS 9+
An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication token by means of the observation of ce…
- Fortinet FortiMail
- CVSS 6.3 Medium
Stack-based buffer overflow in Fortinet FortiFone and others
- Fortinet FortiFone
- Fortinet FortiADC
- Memory corruption
- CVSS 6.1 Medium
Fortinet FortiMail: A improper neutralization of input during web page generation ('cross-site scripting') in…
- Fortinet FortiMail
- CVSS 5.3 Medium
Fortinet FortiMail: A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail…
- Fortinet FortiMail
- CVSS 6.3 Medium
Buffer overflow in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiDDoS-F
- Memory corruption
- CVSS 7.5 High
The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may al…
- Fortinet FortiMail
- CVSS 8.8 High
Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via specifically crafted web requests.
- Fortinet FortiMail
- CVSS 7.2 High
An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an authenticated attacker to execute unauthorize…
- Fortinet FortiMail
- CVSS 5.3 Medium
A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote attacker to exhaust…
- Fortinet FortiMail
- CVSS 4.4 Medium
Missing cryptographic steps in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an attacker who comes in possession of the encrypted master keys to compromise their confident…
- Fortinet FortiMail
- CVSS 9.8 CriticalCritical · CVSS 9+
Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to execute unauthorized code or commands via spec…
- Fortinet FortiMail
- CVSS 8.8 High
Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated attacker with regular webmail access to tri…
- Fortinet FortiMail
- CVSS 5.9 Medium
A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an unauthenticated attacker who intercepts the encrypted messages to manipulate them in such…
- Fortinet FortiMail
- CVSS 7.5 High
A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed U…
- Fortinet FortiMail
-
Fortinet FortiMail: An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7…
- Fortinet FortiMail
- Fortinet FortiVoiceEnterprise
-
An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they should not be authoriz…
- Fortinet FortiMail
-
An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they should not be authorized for.
- Fortinet FortiMail
-
Fortinet FortiMail: An unauthenticated XSS vulnerability with FortiMail 5.0.0 - 5.2.9 and 5.3.0…
- Fortinet FortiMail