Advisories · Technology

Fortinet FortiOS.

Every CVE that names Fortinet FortiOS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2022-27491 CVE record

CVSS 6.8 Medium

Fortinet FortiOS: A improper verification of source of a communication channel in Fortinet FortiOS with IPS…
- Fortinet FortiOS
Not analysed yet 6 Sept 2022
CVE-2022-23442 CVE record

CVSS 4.3 Medium

An improper access control vulnerability [CWE-284] in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.0.0 through 7.0.5 may allow an authenticated attacker with a restricted user pro…
- Fortinet FortiOS
Not analysed yet 3 Aug 2022
CVE-2022-23438 CVE record

CVSS 4.7 Medium

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in FortiOS version 7.0.5 and prior and 6.4.9 and prior may allow an unauthenticated remo…
- Fortinet FortiOS
Not analysed yet 18 Jul 2022
CVE-2022-22306 CVE record

CVSS 5.4 Medium

An improper certificate validation vulnerability [CWE-295] in FortiOS 6.0.0 through 6.0.14, 6.2.0 through 6.2.10, 6.4.0 through 6.4.8, 7.0.0 may allow a network adjacent and unauthenticated attacker…
- Fortinet FortiOS
Not analysed yet 24 May 2022
CVE-2021-41032 CVE record

CVSS 6.3 Medium

An improper access control vulnerability [CWE-284] in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an authenticated attacker with a restricted user profile to gather sensitive infor…
- Fortinet FortiOS
Not analysed yet 4 May 2022
CVE-2020-15936 CVE record

CVSS 2.6 Low

A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version 6.0.11 and below, version 5.6.13 and below allows attacker to disclose sensitive informatio…
- Fortinet FortiOS
Not analysed yet 1 Mar 2022
CVE-2021-44168 CVE record

CVSS 3.3 LowCritical · KEVKEV

Download of code without integrity check in Fortinet FortiOS
- Fortinet FortiOS
- CWE-494
Not analysed yet 4 Jan 2022
CVE-2021-36169 CVE record

CVSS 4.2 Medium

Fortinet FortiOS: A Hidden Functionality in Fortinet FortiOS 7.x before 7.0.1…
- Fortinet FortiOS
Not analysed yet 13 Dec 2021
CVE-2021-36173 CVE record

CVSS 8.0 High

A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, and 6.0.0 through 6.0.13 may allow an attacker…
- Fortinet FortiOS
Not analysed yet 8 Dec 2021
CVE-2021-26109 CVE record

CVSS 8.1 High

An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt control data on the heap via specifically cr…
- Fortinet FortiOS
Not analysed yet 8 Dec 2021
CVE-2021-26108 CVE record

CVSS 7.5 High

A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS before 7.0.1 may allow an attacker to retrieve the key by reverse engineering.
- Fortinet FortiOS
Not analysed yet 8 Dec 2021
CVE-2021-41024 CVE record

CVSS 7.5 High

A relative path traversal [CWE-23] vulnerabiltiy in FortiOS versions 7.0.0 and 7.0.1 and FortiProxy verison 7.0.0 may allow an unauthenticated, unauthorized attacker to inject path traversal characte…
- Fortinet FortiOS
Not analysed yet 8 Dec 2021
CVE-2021-26103 CVE record

CVSS 6.3 Medium

An insufficient verification of data authenticity vulnerability (CWE-345) in the user interface of FortiProxy verison 2.0.3 and below, 1.2.11 and below and FortiGate verison 7.0.0, 6.4.6 and below, 6…
- Fortinet FortiOS
Not analysed yet 8 Dec 2021
CVE-2021-42757 CVE record

CVSS 6.3 Medium

Buffer overflow in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiDDoS-F
- Memory corruption
Not analysed yet 8 Dec 2021
CVE-2021-32600 CVE record

CVSS 5.0 Medium

An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS CLI 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, 6.0.x and 5.6.x may allow a local and authenticated user as…
- Fortinet FortiOS
Not analysed yet 17 Nov 2021
CVE-2021-41019 CVE record

CVSS 3.5 Low

An improper validation of certificate with host mismatch [CWE-297] vulnerability in FortiOS versions 6.4.6 and below may allow the connection to a malicious LDAP server via options in GUI, leading to…
- Fortinet FortiOS
Not analysed yet 2 Nov 2021
CVE-2021-24018 CVE record

CVSS 4.3 Medium

A buffer underwrite vulnerability in the firmware verification routine of FortiOS before 7.0.1 may allow an attacker located in the adjacent network to potentially execute arbitrary code via a specif…
- Fortinet FortiOS
Not analysed yet 4 Aug 2021
CVE-2021-24012 CVE record

CVSS 6.5 Medium

An improper following of a certificate's chain of trust vulnerability in FortiGate versions 6.4.0 to 6.4.4 may allow an LDAP user to connect to SSLVPN with any certificate that is signed by a trusted…
- Fortinet FortiOS
Not analysed yet 2 Jun 2021
CVE-2020-15938 CVE record

CVSS 4.0 Medium

When traffic other than HTTP/S (eg: SSH traffic, etc...) traverses the FortiGate in version below 6.2.5 and below 6.4.2 on port 80/443, it is not redirected to the transparent proxy policy for proces…
- Fortinet FortiOS
Not analysed yet 4 Mar 2021
CVE-2020-15937 CVE record

CVSS 4.7 Medium

An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack (XSS) via th…
- Fortinet FortiOS
Not analysed yet 3 Mar 2021
CVE-2020-12818 CVE record

An insufficient logging vulnerability in FortiGate before 6.4.1 may allow the traffic from an unauthenticated attacker to Fortinet owned IP addresses to go unnoticed.
- Fortinet FortiOS
Not analysed yet 24 Sept 2020
CVE-2019-5591 CVE record

CVSS 6.5 MediumCritical · KEVKEV · ransomware

Missing authentication in Fortinet FortiOS
- Fortinet FortiOS
- Authentication bypass
Not analysed yet 14 Aug 2020
CVE-2020-12812 CVE record

CVSS 7.5 HighCritical · KEV, CVSS 7+ and EPSSKEV · ransomware

Improper authentication in Fortinet FortiOS
- Fortinet FortiOS
- Authentication bypass
Not analysed yet 24 Jul 2020
CVE-2018-13371 CVE record

An external control of system vulnerability in FortiOS may allow an authenticated, regular user to change the routing settings of the device via connecting to the ZebOS component.
- Fortinet FortiOS
Not analysed yet 2 Apr 2020
CVE-2019-6696 CVE record

An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may allow an attacker to perform an URL redirect attack via a specifically crafted re…
- Fortinet FortiOS
Not analysed yet 15 Mar 2020
CVE-2019-5593 CVE record

Fortinet FortiOS: Improper permission or value checking in the CLI console may allow a non-privileged user…
- Fortinet FortiOS
Not analysed yet 23 Jan 2020
CVE-2018-9195 CVE record

Fortinet FortiClient for Windows: Use of a hardcoded cryptographic key in the FortiGuard services communication protocol…
- Fortinet FortiClient for Windows
- Fortinet FortiOS
Not analysed yet 21 Nov 2019
CVE-2019-15703 CVE record

Fortinet FortiOS: An Insufficient Entropy in PRNG vulnerability in Fortinet FortiOS 6.2.1, 6.2.0…
- Fortinet FortiOS
Not analysed yet 24 Oct 2019
CVE-2018-13367 CVE record

Fortinet FortiOS: An information exposure vulnerability in FortiOS 6.2.3…
- Fortinet FortiOS
Not analysed yet 23 Aug 2019
CVE-2019-5588 CVE record

Fortinet FortiOS: A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4…
- Fortinet FortiOS
Not analysed yet 4 Jun 2019
CVE-2019-5586 CVE record

Fortinet FortiOS: A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10…
- Fortinet FortiOS
Not analysed yet 4 Jun 2019
CVE-2019-5587 CVE record

Fortinet FortiOS: Lack of root file system integrity checking in Fortinet FortiOS VM application images all…
- Fortinet FortiOS
Not analysed yet 4 Jun 2019
CVE-2018-13384 CVE record

Fortinet FortiOS: A Host Header Redirection vulnerability in Fortinet FortiOS all versions below 6.0.5…
- Fortinet FortiOS
Not analysed yet 4 Jun 2019
CVE-2018-13365 CVE record

Fortinet FortiOS: An Information Exposure vulnerability in Fortinet FortiOS 6.0.1, 5.6.5 and below…
- Fortinet FortiOS
Not analysed yet 29 May 2019
CVE-2018-13366 CVE record

Fortinet FortiOS: An information disclosure vulnerability in Fortinet FortiOS 6.0.1…
- Fortinet FortiOS
Not analysed yet 9 Apr 2019
CVE-2017-17544 CVE record

Fortinet FortiOS: A privilege escalation vulnerability in Fortinet FortiOS 6.0.0 to 6.0.6, 5.6.0 to 5.6.10…
- Fortinet FortiOS
Not analysed yet 9 Apr 2019
CVE-2018-9185 CVE record

Fortinet FortiOS: An information disclosure vulnerability in Fortinet FortiOS 6.0.0 and below versions…
- Fortinet FortiOS
Not analysed yet 5 Jul 2018
CVE-2017-7733 CVE record

Fortinet FortiOS: A Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 and 5.6.0…
- Fortinet FortiOS
Not analysed yet 27 Oct 2017
CVE-2017-14182 CVE record

Fortinet FortiOS: A Denial of Service (DoS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 allows an…
- Fortinet FortiOS
Not analysed yet 27 Oct 2017
CVE-2017-3128 CVE record

Fortinet FortiOS: A stored XSS (Cross-Site-Scripting) vulnerability in Fortinet FortiOS allows attackers to…
- Fortinet FortiOS
Not analysed yet 23 May 2017
CVE-2016-7542 CVE record

Fortinet FortiOS: A read-only administrator on Fortinet devices with FortiOS 5.2.x before 5.2.10 GA and…
- Fortinet FortiOS
Not analysed yet 30 Mar 2017
CVE-2016-7541 CVE record

Fortinet FortiOS: Long lived sessions in Fortinet FortiGate devices with FortiOS 5.x before 5.4.0 could…
- Fortinet FortiOS
Not analysed yet 30 Mar 2017