# Fortinet FortiWeb.

Every CVE that names Fortinet FortiWeb among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Uncontrolled format string in Fortinet FortiWeb](https://agentprime.io/advisories/CVE-2023-23783.md)
  `CVE-2023-23783` · CVE record: Fortinet FortiWeb · CVSS 6.5 Medium · Not analysed yet · Published 16 Feb 2023 · Tags: Memory corruption
- [Path traversal in Fortinet FortiWeb](https://agentprime.io/advisories/CVE-2023-23784.md)
  `CVE-2023-23784` · CVE record: Fortinet FortiWeb · CVSS 5.6 Medium · Not analysed yet · Published 16 Feb 2023 · Tags: Path traversal
- [Stack-based buffer overflow in Fortinet FortiWeb](https://agentprime.io/advisories/CVE-2023-23780.md)
  `CVE-2023-23780` · CVE record: Fortinet FortiWeb · CVSS 7.6 High · Not analysed yet · Published 16 Feb 2023 · Tags: Memory corruption
- [Stack-based buffer overflow in Fortinet FortiWeb](https://agentprime.io/advisories/CVE-2023-25602.md)
  `CVE-2023-25602` · CVE record: Fortinet FortiWeb · CVSS 7.4 High · Not analysed yet · Published 16 Feb 2023 · Tags: Memory corruption
- [Stack-based buffer overflow in Fortinet FortiWeb](https://agentprime.io/advisories/CVE-2021-42756.md)
  `CVE-2021-42756` · CVE record: Fortinet FortiWeb · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.35 · Not analysed yet · Published 16 Feb 2023 · Tags: Memory corruption
- [Session fixation in Fortinet FortiWeb](https://agentprime.io/advisories/CVE-2021-42761.md)
  `CVE-2021-42761` · CVE record: Fortinet FortiWeb · CVSS 8.5 High · Not analysed yet · Published 16 Feb 2023 · Tags: Authentication bypass
- [Path traversal in Fortinet FortiWeb](https://agentprime.io/advisories/CVE-2022-30299.md)
  `CVE-2022-30299` · CVE record: Fortinet FortiWeb · CVSS 5.0 Medium · Not analysed yet · Published 16 Feb 2023 · Tags: Path traversal
- [Improper signature verification in Fortinet FortiSwitch and others](https://agentprime.io/advisories/CVE-2021-43074.md)
  `CVE-2021-43074` · CVE record: Fortinet FortiSwitch and 3 more · CVSS 4.1 Medium · Not analysed yet · Published 16 Feb 2023 · Tags: Weak cryptography or TLS
- [Path traversal in Fortinet FortiWeb](https://agentprime.io/advisories/CVE-2022-30300.md)
  `CVE-2022-30300` · CVE record: Fortinet FortiWeb · CVSS 6.2 Medium · Not analysed yet · Published 16 Feb 2023 · Tags: Path traversal
- [OS command injection in Fortinet FortiWeb](https://agentprime.io/advisories/CVE-2022-30303.md)
  `CVE-2022-30303` · CVE record: Fortinet FortiWeb · CVSS 8.6 High · Not analysed yet · Published 16 Feb 2023 · Tags: Command injection
- [HTTP response splitting in Fortinet FortiWeb](https://agentprime.io/advisories/CVE-2022-42471.md)
  `CVE-2022-42471` · CVE record: Fortinet FortiWeb · CVSS 5.3 Medium · Not analysed yet · Published 3 Jan 2023 · Tags: Other injection
- [A relative path traversal in FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially craf…](https://agentprime.io/advisories/CVE-2021-41026.md)
  `CVE-2021-41026` · CVE record: Fortinet Fortinet FortiWeb · CVSS 6.5 Medium · Not analysed yet · Published 6 Apr 2022
- [Stack-based buffer overflow in Fortinet FortiFone and others](https://agentprime.io/advisories/CVE-2021-36193.md)
  `CVE-2021-36193` · CVE record: Fortinet FortiFone and 4 more · CVSS 6.3 Medium · Not analysed yet · Published 2 Feb 2022 · Tags: Memory corruption
- [Fortinet FortiWeb: A heap-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0…](https://agentprime.io/advisories/CVE-2021-43071.md)
  `CVE-2021-43071` · CVE record: Fortinet Fortinet FortiWeb · CVSS 8.8 High · Not analysed yet · Published 9 Dec 2021
- [Multiple stack-based buffer overflows in the API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to achieve arbitrary code execution via specially c…](https://agentprime.io/advisories/CVE-2021-36194.md)
  `CVE-2021-36194` · CVE record: Fortinet Fortinet FortiWeb · CVSS 8.8 High · Not analysed yet · Published 9 Dec 2021
- [Multiple heap-based buffer overflow vulnerabilities in some web API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow a remote authenticated attacker to execute arbitrary code…](https://agentprime.io/advisories/CVE-2021-41017.md)
  `CVE-2021-41017` · CVE record: Fortinet Fortinet FortiWeb · CVSS 8.8 High · Not analysed yet · Published 8 Dec 2021
- [Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 thorugh 6.0.7, including an…](https://agentprime.io/advisories/CVE-2021-41025.md)
  `CVE-2021-41025` · CVE record: Fortinet Fortinet FortiWeb · CVSS 7.3 High · Not analysed yet · Published 8 Dec 2021
- [Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, and 6.1.0 through 6.1.2 may allow an authentic…](https://agentprime.io/advisories/CVE-2021-36195.md)
  `CVE-2021-36195` · CVE record: Fortinet Fortinet FortiWeb · CVSS 4.2 Medium · Not analysed yet · Published 8 Dec 2021
- [An improper access control vulnerability \[CWE-284\] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log & Report may allow an unauthorized and unauthenticated…](https://agentprime.io/advisories/CVE-2021-41013.md)
  `CVE-2021-41013` · CVE record: Fortinet Fortinet FortiWeb · CVSS 5.3 Medium · Not analysed yet · Published 8 Dec 2021
- [Fortinet FortiWeb: A improper neutralization of input during web page generation ('cross-site scripting') in…](https://agentprime.io/advisories/CVE-2021-36188.md)
  `CVE-2021-36188` · CVE record: Fortinet Fortinet FortiWeb · CVSS 6.1 Medium · Not analysed yet · Published 8 Dec 2021
- [Fortinet FortiWeb: A improper neutralization of input during web page generation ('cross-site scripting') in…](https://agentprime.io/advisories/CVE-2021-43063.md)
  `CVE-2021-43063` · CVE record: Fortinet Fortinet FortiWeb · CVSS 6.1 Medium · Not analysed yet · Published 8 Dec 2021
- [Fortinet FortiWeb: A unintended proxy or intermediary ('confused deputy') in Fortinet FortiWeb version 6.4.1…](https://agentprime.io/advisories/CVE-2021-36190.md)
  `CVE-2021-36190` · CVE record: Fortinet Fortinet FortiWeb · CVSS 5.5 Medium · Not analysed yet · Published 8 Dec 2021
- [Fortinet FortiWeb: A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.1 and below…](https://agentprime.io/advisories/CVE-2021-41014.md)
  `CVE-2021-41014` · CVE record: Fortinet Fortinet FortiWeb · CVSS 7.5 High · Not analysed yet · Published 8 Dec 2021
- [Fortinet FortiWeb: A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1…](https://agentprime.io/advisories/CVE-2021-36191.md)
  `CVE-2021-36191` · CVE record: Fortinet Fortinet FortiWeb · CVSS 4.1 Medium · Not analysed yet · Published 8 Dec 2021
- [Fortinet FortiWeb: A stack-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0…](https://agentprime.io/advisories/CVE-2021-41027.md)
  `CVE-2021-41027` · CVE record: Fortinet Fortinet FortiWeb · CVSS 7.3 High · Not analysed yet · Published 8 Dec 2021
- [Fortinet FortiWeb: A improper neutralization of input during web page generation ('cross-site scripting') in…](https://agentprime.io/advisories/CVE-2021-41015.md)
  `CVE-2021-41015` · CVE record: Fortinet Fortinet FortiWeb · CVSS 6.1 Medium · Not analysed yet · Published 8 Dec 2021
- [Fortinet FortiWeb: A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1…](https://agentprime.io/advisories/CVE-2021-43064.md)
  `CVE-2021-43064` · CVE record: Fortinet Fortinet FortiWeb · CVSS 4.3 Medium · Not analysed yet · Published 8 Dec 2021
- [Buffer overflow in Fortinet FortiOS and others](https://agentprime.io/advisories/CVE-2021-42757.md)
  `CVE-2021-42757` · CVE record: Fortinet FortiOS and 4 more · CVSS 6.3 Medium · Not analysed yet · Published 8 Dec 2021 · Tags: Memory corruption
- [Multiple improper neutralization of special elements used in a command vulnerabilities \[CWE-77\] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authen…](https://agentprime.io/advisories/CVE-2021-36180.md)
  `CVE-2021-36180` · CVE record: Fortinet Fortinet FortiWeb · CVSS 8.1 High · Not analysed yet · Published 8 Dec 2021
- [Fortinet FortiWeb: A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0…](https://agentprime.io/advisories/CVE-2021-36186.md)
  `CVE-2021-36186` · CVE record: Fortinet Fortinet FortiWeb · CVSS 8.8 High · Not analysed yet · Published 2 Nov 2021
- [Fortinet FortiWeb: A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0…](https://agentprime.io/advisories/CVE-2021-36187.md)
  `CVE-2021-36187` · CVE record: Fortinet Fortinet FortiWeb · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2021
- [Fortinet FortiWeb: A Improper neutralization of special elements used in a command ('Command Injection') in…](https://agentprime.io/advisories/CVE-2021-36182.md)
  `CVE-2021-36182` · CVE record: Fortinet Fortinet FortiWeb · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2021
- [Fortinet FortiWeb: A stack-based buffer overflow in Fortinet FortiWeb version 6.3.14 and below…](https://agentprime.io/advisories/CVE-2021-36179.md)
  `CVE-2021-36179` · CVE record: Fortinet Fortinet FortiWeb · CVSS 8.0 High · Not analysed yet · Published 8 Sept 2021
- [An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated attacker to execute arbitrary commands…](https://agentprime.io/advisories/CVE-2021-22123.md)
  `CVE-2021-22123` · CVE record: Fortinet Fortinet FortiWeb · CVSS 7.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.84 · Not analysed yet · Published 1 Jun 2021
- [An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote authenticated attacker to r…](https://agentprime.io/advisories/CVE-2020-15942.md)
  `CVE-2020-15942` · CVE record: Fortinet Fortinet FortiWeb · CVSS 4.3 Medium · Not analysed yet · Published 12 Apr 2021
- [An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to perform a reflec…](https://agentprime.io/advisories/CVE-2021-22122.md)
  `CVE-2021-22122` · CVE record: Fortinet Fortinet FortiWeb · No CVSS score · EPSS 0.11 · Not analysed yet · Published 8 Feb 2021
- [A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by send…](https://agentprime.io/advisories/CVE-2020-29015.md)
  `CVE-2020-29015` · CVE record: Fortinet FortiWeb · No CVSS score · Not analysed yet · Published 14 Jan 2021
- [A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive data via the redir parameter.](https://agentprime.io/advisories/CVE-2020-29018.md)
  `CVE-2020-29018` · CVE record: Fortinet Fortinet FortiWeb · No CVSS score · Not analysed yet · Published 14 Jan 2021
- [A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.5 and version before 6.2.4 may allow an unauthenticated, remote attacker to overwrite the content of the stack and potentiall…](https://agentprime.io/advisories/CVE-2020-29016.md)
  `CVE-2020-29016` · CVE record: Fortinet Fortinet FortiWeb · No CVSS score · Not analysed yet · Published 14 Jan 2021
- [A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow a remote, unauthenticated attacker to crash the httpd daemon thread by sending a request…](https://agentprime.io/advisories/CVE-2020-29019.md)
  `CVE-2020-29019` · CVE record: Fortinet FortiWeb · No CVSS score · Not analysed yet · Published 14 Jan 2021
- [An improper neutralization of input vulnerability in FortiWeb allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Disclaimer Description of a Replacem…](https://agentprime.io/advisories/CVE-2020-6646.md)
  `CVE-2020-6646` · CVE record: Fortinet FortiWeb · No CVSS score · Not analysed yet · Published 17 Mar 2020
- [Fortinet FortiWeb: An information exposure vulnerability in Fortinet FortiWeb 6.2.0 CLI and earlier may…](https://agentprime.io/advisories/CVE-2019-16157.md)
  `CVE-2019-16157` · CVE record: Fortinet Fortinet FortiWeb · No CVSS score · Not analysed yet · Published 13 Mar 2020
- [Fortinet FortiWeb: An Improper Neutralization of Input vulnerability in the Anomaly Detection Parameter Name…](https://agentprime.io/advisories/CVE-2019-16156.md)
  `CVE-2019-16156` · CVE record: Fortinet Fortinet FortiWeb · No CVSS score · Not analysed yet · Published 12 Mar 2020
- [Fortinet FortiWeb: The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below…](https://agentprime.io/advisories/CVE-2019-5590.md)
  `CVE-2019-5590` · CVE record: Fortinet FortiWeb · No CVSS score · Not analysed yet · Published 28 Aug 2019

Newest: <https://agentprime.io/advisories/technology/fortinet-fortiweb.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=fortinet-fortiweb&cursor=WyIyMDIzLTAyLTE2VDE4OjA1OjU3LjY5MTAwMFoiLCJDVkUtMjAyMy0yMzc4MiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/fortinet-fortiweb/?cursor=WyIyMDIzLTAyLTE2VDE4OjA1OjU3LjY5MTAwMFoiLCJDVkUtMjAyMy0yMzc4MiJd>. Everything for agents: <https://agentprime.io/llms.txt>.