Advisories · Technology

Fortinet FortiWeb.

Every CVE that names Fortinet FortiWeb among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2023-23783 CVE record

CVSS 6.5 Medium

Uncontrolled format string in Fortinet FortiWeb
- Fortinet FortiWeb
- Memory corruption
Not analysed yet 16 Feb 2023
CVE-2023-23784 CVE record

CVSS 5.6 Medium

Path traversal in Fortinet FortiWeb
- Fortinet FortiWeb
- Path traversal
Not analysed yet 16 Feb 2023
CVE-2023-23780 CVE record

CVSS 7.6 High

Stack-based buffer overflow in Fortinet FortiWeb
- Fortinet FortiWeb
- Memory corruption
Not analysed yet 16 Feb 2023
CVE-2023-25602 CVE record

CVSS 7.4 High

Stack-based buffer overflow in Fortinet FortiWeb
- Fortinet FortiWeb
- Memory corruption
Not analysed yet 16 Feb 2023
CVE-2021-42756 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Stack-based buffer overflow in Fortinet FortiWeb
- Fortinet FortiWeb
- Memory corruption
Not analysed yet 16 Feb 2023
CVE-2021-42761 CVE record

CVSS 8.5 High

Session fixation in Fortinet FortiWeb
- Fortinet FortiWeb
- Authentication bypass
Not analysed yet 16 Feb 2023
CVE-2022-30299 CVE record

CVSS 5.0 Medium

Path traversal in Fortinet FortiWeb
- Fortinet FortiWeb
- Path traversal
Not analysed yet 16 Feb 2023
CVE-2021-43074 CVE record

CVSS 4.1 Medium

Improper signature verification in Fortinet FortiSwitch and others
- Fortinet FortiSwitch
- Fortinet FortiWeb
- Weak cryptography or TLS
Not analysed yet 16 Feb 2023
CVE-2022-30300 CVE record

CVSS 6.2 Medium

Path traversal in Fortinet FortiWeb
- Fortinet FortiWeb
- Path traversal
Not analysed yet 16 Feb 2023
CVE-2022-30303 CVE record

CVSS 8.6 High

OS command injection in Fortinet FortiWeb
- Fortinet FortiWeb
- Command injection
Not analysed yet 16 Feb 2023
CVE-2022-42471 CVE record

CVSS 5.3 Medium

HTTP response splitting in Fortinet FortiWeb
- Fortinet FortiWeb
- Other injection
Not analysed yet 3 Jan 2023
CVE-2021-41026 CVE record

CVSS 6.5 Medium

A relative path traversal in FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially craf…
- Fortinet FortiWeb
Not analysed yet 6 Apr 2022
CVE-2021-36193 CVE record

CVSS 6.3 Medium

Stack-based buffer overflow in Fortinet FortiFone and others
- Fortinet FortiFone
- Fortinet FortiADC
- Memory corruption
Not analysed yet 2 Feb 2022
CVE-2021-43071 CVE record

CVSS 8.8 High

Fortinet FortiWeb: A heap-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0…
- Fortinet FortiWeb
Not analysed yet 9 Dec 2021
CVE-2021-36194 CVE record

CVSS 8.8 High

Multiple stack-based buffer overflows in the API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to achieve arbitrary code execution via specially c…
- Fortinet FortiWeb
Not analysed yet 9 Dec 2021
CVE-2021-41017 CVE record

CVSS 8.8 High

Multiple heap-based buffer overflow vulnerabilities in some web API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow a remote authenticated attacker to execute arbitrary code…
- Fortinet FortiWeb
Not analysed yet 8 Dec 2021
CVE-2021-41025 CVE record

CVSS 7.3 High

Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 thorugh 6.0.7, including an…
- Fortinet FortiWeb
Not analysed yet 8 Dec 2021
CVE-2021-36195 CVE record

CVSS 4.2 Medium

Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, and 6.1.0 through 6.1.2 may allow an authentic…
- Fortinet FortiWeb
Not analysed yet 8 Dec 2021
CVE-2021-41013 CVE record

CVSS 5.3 Medium

An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log & Report may allow an unauthorized and unauthenticated…
- Fortinet FortiWeb
Not analysed yet 8 Dec 2021
CVE-2021-36188 CVE record

CVSS 6.1 Medium

Fortinet FortiWeb: A improper neutralization of input during web page generation ('cross-site scripting') in…
- Fortinet FortiWeb
Not analysed yet 8 Dec 2021
CVE-2021-43063 CVE record

CVSS 6.1 Medium

Fortinet FortiWeb: A improper neutralization of input during web page generation ('cross-site scripting') in…
- Fortinet FortiWeb
Not analysed yet 8 Dec 2021
CVE-2021-36190 CVE record

CVSS 5.5 Medium

Fortinet FortiWeb: A unintended proxy or intermediary ('confused deputy') in Fortinet FortiWeb version 6.4.1…
- Fortinet FortiWeb
Not analysed yet 8 Dec 2021
CVE-2021-41014 CVE record

CVSS 7.5 High

Fortinet FortiWeb: A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.1 and below…
- Fortinet FortiWeb
Not analysed yet 8 Dec 2021
CVE-2021-36191 CVE record

CVSS 4.1 Medium

Fortinet FortiWeb: A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1…
- Fortinet FortiWeb
Not analysed yet 8 Dec 2021
CVE-2021-41027 CVE record

CVSS 7.3 High

Fortinet FortiWeb: A stack-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0…
- Fortinet FortiWeb
Not analysed yet 8 Dec 2021
CVE-2021-41015 CVE record

CVSS 6.1 Medium

Fortinet FortiWeb: A improper neutralization of input during web page generation ('cross-site scripting') in…
- Fortinet FortiWeb
Not analysed yet 8 Dec 2021
CVE-2021-43064 CVE record

CVSS 4.3 Medium

Fortinet FortiWeb: A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1…
- Fortinet FortiWeb
Not analysed yet 8 Dec 2021
CVE-2021-42757 CVE record

CVSS 6.3 Medium

Buffer overflow in Fortinet FortiOS and others
- Fortinet FortiOS
- Fortinet FortiDDoS-F
- Memory corruption
Not analysed yet 8 Dec 2021
CVE-2021-36180 CVE record

CVSS 8.1 High

Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authen…
- Fortinet FortiWeb
Not analysed yet 8 Dec 2021
CVE-2021-36186 CVE record

CVSS 8.8 High

Fortinet FortiWeb: A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0…
- Fortinet FortiWeb
Not analysed yet 2 Nov 2021
CVE-2021-36187 CVE record

CVSS 5.3 Medium

Fortinet FortiWeb: A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0…
- Fortinet FortiWeb
Not analysed yet 2 Nov 2021
CVE-2021-36182 CVE record

CVSS 8.8 High

Fortinet FortiWeb: A Improper neutralization of special elements used in a command ('Command Injection') in…
- Fortinet FortiWeb
Not analysed yet 8 Sept 2021
CVE-2021-36179 CVE record

CVSS 8.0 High

Fortinet FortiWeb: A stack-based buffer overflow in Fortinet FortiWeb version 6.3.14 and below…
- Fortinet FortiWeb
Not analysed yet 8 Sept 2021
CVE-2021-22123 CVE record

CVSS 7.6 HighCritical · CVSS 7+ and EPSS

An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated attacker to execute arbitrary commands…
- Fortinet FortiWeb
Not analysed yet 1 Jun 2021
CVE-2020-15942 CVE record

CVSS 4.3 Medium

An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote authenticated attacker to r…
- Fortinet FortiWeb
Not analysed yet 12 Apr 2021
CVE-2021-22122 CVE record

An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to perform a reflec…
- Fortinet FortiWeb
Not analysed yet 8 Feb 2021
CVE-2020-29015 CVE record

A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by send…
- Fortinet FortiWeb
Not analysed yet 14 Jan 2021
CVE-2020-29018 CVE record

A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive data via the redir parameter.
- Fortinet FortiWeb
Not analysed yet 14 Jan 2021
CVE-2020-29016 CVE record

A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.5 and version before 6.2.4 may allow an unauthenticated, remote attacker to overwrite the content of the stack and potentiall…
- Fortinet FortiWeb
Not analysed yet 14 Jan 2021
CVE-2020-29019 CVE record

A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow a remote, unauthenticated attacker to crash the httpd daemon thread by sending a request…
- Fortinet FortiWeb
Not analysed yet 14 Jan 2021
CVE-2020-6646 CVE record

An improper neutralization of input vulnerability in FortiWeb allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Disclaimer Description of a Replacem…
- Fortinet FortiWeb
Not analysed yet 17 Mar 2020
CVE-2019-16157 CVE record

Fortinet FortiWeb: An information exposure vulnerability in Fortinet FortiWeb 6.2.0 CLI and earlier may…
- Fortinet FortiWeb
Not analysed yet 13 Mar 2020
CVE-2019-16156 CVE record

Fortinet FortiWeb: An Improper Neutralization of Input vulnerability in the Anomaly Detection Parameter Name…
- Fortinet FortiWeb
Not analysed yet 12 Mar 2020
CVE-2019-5590 CVE record

Fortinet FortiWeb: The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below…
- Fortinet FortiWeb
Not analysed yet 28 Aug 2019