# Fortinet FortiOS.

Every CVE that names Fortinet FortiOS among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Fortinet FortiOS: A improper verification of source of a communication channel in Fortinet FortiOS with IPS…](https://agentprime.io/advisories/CVE-2022-27491.md)
  `CVE-2022-27491` · CVE record: Fortinet Fortinet FortiOS · CVSS 6.8 Medium · Not analysed yet · Published 6 Sept 2022
- [An improper access control vulnerability \[CWE-284\] in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.0.0 through 7.0.5 may allow an authenticated attacker with a restricted user pro…](https://agentprime.io/advisories/CVE-2022-23442.md)
  `CVE-2022-23442` · CVE record: Fortinet Fortinet FortiOS · CVSS 4.3 Medium · Not analysed yet · Published 3 Aug 2022
- [An improper neutralization of input during web page generation ('Cross-site Scripting') \[CWE-79\] vulnerability in FortiOS version 7.0.5 and prior and 6.4.9 and prior may allow an unauthenticated remo…](https://agentprime.io/advisories/CVE-2022-23438.md)
  `CVE-2022-23438` · CVE record: Fortinet Fortinet FortiOS · CVSS 4.7 Medium · Not analysed yet · Published 18 Jul 2022
- [An improper certificate validation vulnerability \[CWE-295\] in FortiOS 6.0.0 through 6.0.14, 6.2.0 through 6.2.10, 6.4.0 through 6.4.8, 7.0.0 may allow a network adjacent and unauthenticated attacker…](https://agentprime.io/advisories/CVE-2022-22306.md)
  `CVE-2022-22306` · CVE record: Fortinet Fortinet FortiOS · CVSS 5.4 Medium · Not analysed yet · Published 24 May 2022
- [An improper access control vulnerability \[CWE-284\] in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attacker with a restricted user profile to gather sensitive infor…](https://agentprime.io/advisories/CVE-2021-41032.md)
  `CVE-2021-41032` · CVE record: Fortinet Fortinet FortiOS · CVSS 6.3 Medium · Not analysed yet · Published 4 May 2022
- [A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version 6.0.11 and below, version 5.6.13 and below allows attacker to disclose sensitive informatio…](https://agentprime.io/advisories/CVE-2020-15936.md)
  `CVE-2020-15936` · CVE record: Fortinet Fortinet FortiOS · CVSS 2.6 Low · Not analysed yet · Published 1 Mar 2022
- [Download of code without integrity check in Fortinet FortiOS](https://agentprime.io/advisories/CVE-2021-44168.md)
  `CVE-2021-44168` · CVE record: Fortinet Fortinet FortiOS · CVSS 3.3 Low · Critical (KEV) · In CISA KEV · Not analysed yet · Published 4 Jan 2022 · Tags: CWE-494
- [Fortinet FortiOS: A Hidden Functionality in Fortinet FortiOS 7.x before 7.0.1…](https://agentprime.io/advisories/CVE-2021-36169.md)
  `CVE-2021-36169` · CVE record: Fortinet Fortinet FortiOS · CVSS 4.2 Medium · Not analysed yet · Published 13 Dec 2021
- [A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, and 6.0.0 through 6.0.13 may allow an attacker…](https://agentprime.io/advisories/CVE-2021-36173.md)
  `CVE-2021-36173` · CVE record: Fortinet Fortinet FortiOS · CVSS 8.0 High · Not analysed yet · Published 8 Dec 2021
- [An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt control data on the heap via specifically cr…](https://agentprime.io/advisories/CVE-2021-26109.md)
  `CVE-2021-26109` · CVE record: Fortinet Fortinet FortiOS · CVSS 8.1 High · Not analysed yet · Published 8 Dec 2021
- [A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS before 7.0.1 may allow an attacker to retrieve the key by reverse engineering.](https://agentprime.io/advisories/CVE-2021-26108.md)
  `CVE-2021-26108` · CVE record: Fortinet Fortinet FortiOS · CVSS 7.5 High · Not analysed yet · Published 8 Dec 2021
- [A relative path traversal \[CWE-23\] vulnerabiltiy in FortiOS versions 7.0.0 and 7.0.1 and FortiProxy verison 7.0.0 may allow an unauthenticated, unauthorized attacker to inject path traversal characte…](https://agentprime.io/advisories/CVE-2021-41024.md)
  `CVE-2021-41024` · CVE record: Fortinet Fortinet FortiOS · CVSS 7.5 High · Not analysed yet · Published 8 Dec 2021
- [An insufficient verification of data authenticity vulnerability (CWE-345) in the user interface of FortiProxy verison 2.0.3 and below, 1.2.11 and below and FortiGate verison 7.0.0, 6.4.6 and below, 6…](https://agentprime.io/advisories/CVE-2021-26103.md)
  `CVE-2021-26103` · CVE record: Fortinet Fortinet FortiOS · CVSS 6.3 Medium · Not analysed yet · Published 8 Dec 2021
- [Buffer overflow in Fortinet FortiOS and others](https://agentprime.io/advisories/CVE-2021-42757.md)
  `CVE-2021-42757` · CVE record: Fortinet FortiOS and 4 more · CVSS 6.3 Medium · Not analysed yet · Published 8 Dec 2021 · Tags: Memory corruption
- [An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS CLI 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, 6.0.x and 5.6.x may allow a local and authenticated user as…](https://agentprime.io/advisories/CVE-2021-32600.md)
  `CVE-2021-32600` · CVE record: Fortinet Fortinet FortiOS · CVSS 5.0 Medium · Not analysed yet · Published 17 Nov 2021
- [An improper validation of certificate with host mismatch \[CWE-297\] vulnerability in FortiOS versions 6.4.6 and below may allow the connection to a malicious LDAP server via options in GUI, leading to…](https://agentprime.io/advisories/CVE-2021-41019.md)
  `CVE-2021-41019` · CVE record: Fortinet Fortinet FortiOS · CVSS 3.5 Low · Not analysed yet · Published 2 Nov 2021
- [A buffer underwrite vulnerability in the firmware verification routine of FortiOS before 7.0.1 may allow an attacker located in the adjacent network to potentially execute arbitrary code via a specif…](https://agentprime.io/advisories/CVE-2021-24018.md)
  `CVE-2021-24018` · CVE record: Fortinet Fortinet FortiOS · CVSS 4.3 Medium · Not analysed yet · Published 4 Aug 2021
- [An improper following of a certificate's chain of trust vulnerability in FortiGate versions 6.4.0 to 6.4.4 may allow an LDAP user to connect to SSLVPN with any certificate that is signed by a trusted…](https://agentprime.io/advisories/CVE-2021-24012.md)
  `CVE-2021-24012` · CVE record: Fortinet Fortinet FortiOS · CVSS 6.5 Medium · Not analysed yet · Published 2 Jun 2021
- [When traffic other than HTTP/S (eg: SSH traffic, etc...) traverses the FortiGate in version below 6.2.5 and below 6.4.2 on port 80/443, it is not redirected to the transparent proxy policy for proces…](https://agentprime.io/advisories/CVE-2020-15938.md)
  `CVE-2020-15938` · CVE record: Fortinet Fortinet FortiOS · CVSS 4.0 Medium · Not analysed yet · Published 4 Mar 2021
- [An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack (XSS) via th…](https://agentprime.io/advisories/CVE-2020-15937.md)
  `CVE-2020-15937` · CVE record: Fortinet Fortinet FortiOS · CVSS 4.7 Medium · Not analysed yet · Published 3 Mar 2021
- [An insufficient logging vulnerability in FortiGate before 6.4.1 may allow the traffic from an unauthenticated attacker to Fortinet owned IP addresses to go unnoticed.](https://agentprime.io/advisories/CVE-2020-12818.md)
  `CVE-2020-12818` · CVE record: Fortinet Fortinet FortiOS · No CVSS score · Not analysed yet · Published 24 Sept 2020
- [Missing authentication in Fortinet FortiOS](https://agentprime.io/advisories/CVE-2019-5591.md)
  `CVE-2019-5591` · CVE record: Fortinet Fortinet FortiOS · CVSS 6.5 Medium · Critical (KEV) · In CISA KEV, ransomware · EPSS 0.19 · Not analysed yet · Published 14 Aug 2020 · Tags: Authentication bypass
- [Improper authentication in Fortinet FortiOS](https://agentprime.io/advisories/CVE-2020-12812.md)
  `CVE-2020-12812` · CVE record: Fortinet FortiOS · CVSS 7.5 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 0.45 · Not analysed yet · Published 24 Jul 2020 · Tags: Authentication bypass
- [An external control of system vulnerability in FortiOS may allow an authenticated, regular user to change the routing settings of the device via connecting to the ZebOS component.](https://agentprime.io/advisories/CVE-2018-13371.md)
  `CVE-2018-13371` · CVE record: Fortinet FortiOS · No CVSS score · Not analysed yet · Published 2 Apr 2020
- [An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may allow an attacker to perform an URL redirect attack via a specifically crafted re…](https://agentprime.io/advisories/CVE-2019-6696.md)
  `CVE-2019-6696` · CVE record: Fortinet Fortinet FortiOS · No CVSS score · Not analysed yet · Published 15 Mar 2020
- [Fortinet FortiOS: Improper permission or value checking in the CLI console may allow a non-privileged user…](https://agentprime.io/advisories/CVE-2019-5593.md)
  `CVE-2019-5593` · CVE record: Fortinet FortiOS · No CVSS score · Not analysed yet · Published 23 Jan 2020
- [Fortinet FortiClient for Windows: Use of a hardcoded cryptographic key in the FortiGuard services communication protocol…](https://agentprime.io/advisories/CVE-2018-9195.md)
  `CVE-2018-9195` · CVE record: Fortinet FortiClient for Windows and 2 more · No CVSS score · Not analysed yet · Published 21 Nov 2019
- [Fortinet FortiOS: An Insufficient Entropy in PRNG vulnerability in Fortinet FortiOS 6.2.1, 6.2.0…](https://agentprime.io/advisories/CVE-2019-15703.md)
  `CVE-2019-15703` · CVE record: Fortinet Fortinet FortiOS · No CVSS score · Not analysed yet · Published 24 Oct 2019
- [Fortinet FortiOS: An information exposure vulnerability in FortiOS 6.2.3…](https://agentprime.io/advisories/CVE-2018-13367.md)
  `CVE-2018-13367` · CVE record: Fortinet FortiOS · No CVSS score · Not analysed yet · Published 23 Aug 2019
- [Fortinet FortiOS: A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4…](https://agentprime.io/advisories/CVE-2019-5588.md)
  `CVE-2019-5588` · CVE record: Fortinet Fortinet FortiOS · No CVSS score · Not analysed yet · Published 4 Jun 2019
- [Fortinet FortiOS: A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10…](https://agentprime.io/advisories/CVE-2019-5586.md)
  `CVE-2019-5586` · CVE record: Fortinet Fortinet FortiOS · No CVSS score · Not analysed yet · Published 4 Jun 2019
- [Fortinet FortiOS: Lack of root file system integrity checking in Fortinet FortiOS VM application images all…](https://agentprime.io/advisories/CVE-2019-5587.md)
  `CVE-2019-5587` · CVE record: Fortinet Fortinet FortiOS · No CVSS score · Not analysed yet · Published 4 Jun 2019
- [Fortinet FortiOS: A Host Header Redirection vulnerability in Fortinet FortiOS all versions below 6.0.5…](https://agentprime.io/advisories/CVE-2018-13384.md)
  `CVE-2018-13384` · CVE record: Fortinet Fortinet FortiOS · No CVSS score · Not analysed yet · Published 4 Jun 2019
- [Fortinet FortiOS: An Information Exposure vulnerability in Fortinet FortiOS 6.0.1, 5.6.5 and below…](https://agentprime.io/advisories/CVE-2018-13365.md)
  `CVE-2018-13365` · CVE record: Fortinet Fortinet FortiOS · No CVSS score · Not analysed yet · Published 29 May 2019
- [Fortinet FortiOS: An information disclosure vulnerability in Fortinet FortiOS 6.0.1…](https://agentprime.io/advisories/CVE-2018-13366.md)
  `CVE-2018-13366` · CVE record: Fortinet Fortinet FortiOS · No CVSS score · Not analysed yet · Published 9 Apr 2019
- [Fortinet FortiOS: A privilege escalation vulnerability in Fortinet FortiOS 6.0.0 to 6.0.6, 5.6.0 to 5.6.10…](https://agentprime.io/advisories/CVE-2017-17544.md)
  `CVE-2017-17544` · CVE record: Fortinet FortiOS · No CVSS score · Not analysed yet · Published 9 Apr 2019
- [Fortinet FortiOS: An information disclosure vulnerability in Fortinet FortiOS 6.0.0 and below versions…](https://agentprime.io/advisories/CVE-2018-9185.md)
  `CVE-2018-9185` · CVE record: Fortinet Fortinet FortiOS · No CVSS score · Not analysed yet · Published 5 Jul 2018
- [Fortinet FortiOS: A Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 and 5.6.0…](https://agentprime.io/advisories/CVE-2017-7733.md)
  `CVE-2017-7733` · CVE record: Fortinet Fortinet FortiOS · No CVSS score · Not analysed yet · Published 27 Oct 2017
- [Fortinet FortiOS: A Denial of Service (DoS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 allows an…](https://agentprime.io/advisories/CVE-2017-14182.md)
  `CVE-2017-14182` · CVE record: Fortinet Fortinet FortiOS · No CVSS score · Not analysed yet · Published 27 Oct 2017
- [Fortinet FortiOS: A stored XSS (Cross-Site-Scripting) vulnerability in Fortinet FortiOS allows attackers to…](https://agentprime.io/advisories/CVE-2017-3128.md)
  `CVE-2017-3128` · CVE record: Fortinet Fortinet FortiOS · No CVSS score · Not analysed yet · Published 23 May 2017
- [Fortinet FortiOS: A read-only administrator on Fortinet devices with FortiOS 5.2.x before 5.2.10 GA and…](https://agentprime.io/advisories/CVE-2016-7542.md)
  `CVE-2016-7542` · CVE record: Fortinet FortiOS · No CVSS score · Not analysed yet · Published 30 Mar 2017
- [Fortinet FortiOS: Long lived sessions in Fortinet FortiGate devices with FortiOS 5.x before 5.4.0 could…](https://agentprime.io/advisories/CVE-2016-7541.md)
  `CVE-2016-7541` · CVE record: Fortinet FortiOS · No CVSS score · Not analysed yet · Published 30 Mar 2017

Newest: <https://agentprime.io/advisories/technology/fortinet-fortios.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=fortinet-fortios&cursor=WyIyMDIyLTA5LTA2VDE1OjEwOjE5LjAwMDAwMFoiLCJDVkUtMjAyMi0yOTA1MyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/fortinet-fortios/?cursor=WyIyMDIyLTA5LTA2VDE1OjEwOjE5LjAwMDAwMFoiLCJDVkUtMjAyMi0yOTA1MyJd>. Everything for agents: <https://agentprime.io/llms.txt>.