Advisories · Technology
Fortinet FortiOS.
Every CVE that names Fortinet FortiOS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.2 High
Insecure direct object reference in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Broken access control
- CVSS 7.7 High
Stack-based buffer overflow in Fortinet FortiProxy and others
- Fortinet FortiProxy
- Fortinet FortiOS
- Memory corruption
- CVSS 7.3 High
NULL pointer dereference in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Memory corruption
- CVSS 6.4 Medium
NULL pointer dereference in Fortinet FortiProxy and others
- Fortinet FortiProxy
- Fortinet FortiOS
- Memory corruption
- CVSS 8.3 High
Uncontrolled format string in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiPAM
- Memory corruption
- CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
Uncontrolled format string in Fortinet FortiSwitchManager and others
- Fortinet FortiSwitchManager
- Fortinet FortiOS
- Memory corruption
- CVSS 4.4 Medium
Improper certificate validation in Fortinet FortiOS
- Fortinet FortiOS
- Weak cryptography or TLS
- CVSS 9.6 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware
Out-of-bounds write in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Memory corruption
- CVSS 8.3 High
Improper privilege management in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Privilege escalation
- CVSS 2.8 Low
Improper access control in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Broken access control
- CVSS 8.3 High
Double free in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiPAM
- Memory corruption
- CVSS 7.0 High
Uncontrolled format string in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiPAM
- Memory corruption
- CVSS 5.8 Medium
Fortinet FortiOS: An improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0…
- Fortinet FortiOS
- Fortinet FortiProxy
- CWE-354
- CVSS 6.2 Medium
Fortinet FortiOS: A numeric truncation error vulnerability in Fortinet FortiOS 7.4.0…
- Fortinet FortiOS
- Fortinet FortiProxy
- CWE-197
- CVSS 6.5 Medium
Fortinet FortiOS: A use of GET request method with sensitive query strings vulnerability in Fortinet…
- Fortinet FortiOS
- CWE-598
- CVSS 4.8 Medium
Use after free in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Memory corruption
- CVSS 7.4 High
Improper authorization in Fortinet FortiOS
- Fortinet FortiOS
- Broken access control
- CVSS 3.9 Low
Cross-site scripting in Fortinet FortiOS
- Fortinet FortiOS
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Improper access control in Fortinet FortiOS
- Fortinet FortiOS
- Broken access control
- CVSS 7.3 High
Cross-site scripting in Fortinet FortiProxy and others
- Fortinet FortiProxy
- Fortinet FortiOS
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Stack-based buffer overflow in Fortinet FortiOS
- Fortinet FortiOS
- Memory corruption
- CVSS 9.8 CriticalCritical · CVSS 9+
Stack-based buffer overflow in Fortinet FortiProxy and others
- Fortinet FortiProxy
- Fortinet FortiOS
- Memory corruption
- CVSS 4.1 Medium
Insufficient session expiration in Fortinet FortiOS
- Fortinet FortiOS
- Authentication bypass
- CVSS 5.3 Medium
Cleartext storage of sensitive information in Fortinet FortiAuthenticator and others
- Fortinet FortiAuthenticator
- Fortinet FortiOS
- Information disclosure
- CVSS 6.4 Medium
NULL pointer dereference in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Memory corruption
- CVSS 6.2 Medium
NULL pointer dereference in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Memory corruption
- CVSS 4.9 Medium
Infinite loop in Fortinet FortiWeb and others
- Fortinet FortiWeb
- Fortinet FortiOS
- Denial of service
- CVSS 3.9 Low
Uninitialized pointer access in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Memory corruption
- CVSS 4.4 Medium
Improper certificate validation in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Weak cryptography or TLS
- CVSS 9.2 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware
Heap-based buffer overflow in Fortinet FortiOS-6K7K and others
- Fortinet FortiOS-6K7K
- Fortinet FortiProxy
- Memory corruption
- CVSS 3.3 Low
Sensitive information in log files in Fortinet FortiProxy and others
- Fortinet FortiProxy
- Fortinet FortiOS
- Information disclosure
- CVSS 6.3 Medium
Out-of-bounds write in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Memory corruption
- CVSS 6.3 Medium
Uncontrolled format string in Fortinet FortiProxy and others
- Fortinet FortiProxy
- Fortinet FortiOS
- Memory corruption
- CVSS 6.2 Medium
Path traversal in Fortinet FortiSwitchManager and others
- Fortinet FortiSwitchManager
- Fortinet FortiProxy
- Path traversal
- CVSS 7.6 High
Cleartext transmission of sensitive information in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Weak cryptography or TLS
- CVSS 7.1 High
Out-of-bounds write in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Memory corruption
- CVSS 4.1 Medium
A permissive list of allowed inputs vulnerability [CWE-183] in FortiGate version 7.2.3 and below, version 7.0.9 and below Policy-based NGFW Mode may allow an authenticated SSL-VPN user to bypass the…
- Fortinet FortiOS
- CWE-183
- CVSS 4.7 Medium
Unlimited authentication attempts in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Authentication bypass
- CVSS 4.1 Medium
Open redirect in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Open redirect
- CVSS 8.3 High
Cross-site scripting in Fortinet FortiProxy and others
- Fortinet FortiProxy
- Fortinet FortiOS
- Cross-site scripting (XSS)
- CVSS 5.2 Medium
Information disclosure in Fortinet FortiProxy and others
- Fortinet FortiProxy
- Fortinet FortiOS
- Information disclosure
- CVSS 7.8 High
Path traversal in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Path traversal
- CVSS 6.4 Medium
Uninitialized pointer access in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Memory corruption
- CVSS 6.5 MediumCritical · KEVKEV
Path traversal in Fortinet FortiOS
- Fortinet FortiOS
- Path traversal
- CVSS 3.1 Low
Fortinet FortiOS: A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the…
- Fortinet FortiOS
- Fortinet FortiProxy
- CWE-329
- CVSS 4.0 Medium
HTTP response splitting in Fortinet FortiProxy and others
- Fortinet FortiProxy
- Fortinet FortiOS
- Other injection
- CVSS 4.0 Medium
Improper privilege management in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Privilege escalation
- CVSS 8.6 High
Cross-site scripting in Fortinet FortiOS
- Fortinet FortiOS
- Cross-site scripting (XSS)
- CVSS 4.4 Medium
Improper certificate validation in Fortinet FortiProxy and others
- Fortinet FortiProxy
- Fortinet FortiOS
- Weak cryptography or TLS
- CVSS 4.1 Medium
Improper signature verification in Fortinet FortiSwitch and others
- Fortinet FortiSwitch
- Fortinet FortiWeb
- Weak cryptography or TLS
- CVSS 8.6 High
Path traversal in Fortinet FortiSwitchManager and others
- Fortinet FortiSwitchManager
- Fortinet FortiOS
- Path traversal
- CVSS 9.3 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware
Fortinet FortiProxy: A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through…
- Fortinet FortiProxy
- Fortinet FortiOS
- CWE-197
- CVSS 3.8 Low
Cross-site scripting in Fortinet FortiProxy and others
- Fortinet FortiProxy
- Fortinet FortiOS
- Cross-site scripting (XSS)
- CVSS 7.7 High
Improper access control in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiProxy
- Broken access control
- CVSS 4.3 Medium
An improper access control [CWE-284] vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticated read-only user to modify the interface settings via the A…
- Fortinet FortiOS
- CVSS 3.7 Low
An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiOS SSL-VPN versions 7.2.0, versions 7.0.0 through 7.0.6 and versions 6.4.0 through 6.4.9 may allow a remo…
- Fortinet FortiOS
- CVSS 3.9 Low
A key management error vulnerability [CWE-320] affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below may allow an unauthenticated attacker to perform a man in th…
- Fortinet FortiOS
- CVSS 9.0 CriticalCritical · CVSS 9+
Fortinet FortiOS: A improper neutralization of special elements used in an os command ('os command…
- Fortinet FortiOS
- CVSS 4.6 Medium
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.2.0, version 6.4.0 through 6.4.9, version 7.0.0 through 7.0.5 may allow an authenticated att…
- Fortinet FortiOS
- CVSS 2.3 Low
A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the keytab files in FortiOS version 7.2.0, 7.0.0 through 7.0.5 and below 7.0.0 may allow an attacker in possession…
- Fortinet FortiOS