Product:

Fortiweb

(Fortinet)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 106
Date Id Summary Products Score Patch Annotated
2021-04-12 CVE-2020-15942 An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote authenticated attacker to read the password used by the FortiWeb scanner to access the device defined in the scan profile. Fortiweb 6.5
2021-06-01 CVE-2021-22123 An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated attacker to execute arbitrary commands on the system via the SAML server configuration page. Fortiweb 8.8
2021-09-08 CVE-2021-36179 A stack-based buffer overflow in Fortinet FortiWeb version 6.3.14 and below, 6.2.4 and below allows attacker to execute unauthorized code or commands via crafted parameters in CLI command execution Fortiweb 8.8
2021-09-08 CVE-2021-36182 A Improper neutralization of special elements used in a command ('Command Injection') in Fortinet FortiWeb version 6.3.13 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests Fortiweb 8.8
2021-10-06 CVE-2021-36175 An improper neutralization of input vulnerability [CWE-79] in FortiWebManager versions 6.2.3 and below, 6.0.2 and below may allow a remote authenticated attacker to inject malicious script/tags via the name/description/comments parameter of various sections of the device. Fortiweb 5.4
2021-11-02 CVE-2021-36186 A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests Fortiweb 9.8
2021-11-02 CVE-2021-36187 A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to cause a denial of service for webserver daemon via crafted HTTP requests Fortiweb 7.5
2021-12-08 CVE-2021-42757 A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments. Fortiadc, Fortianalyzer, Fortimail, Fortimanager, Fortindr, Fortios, Fortios\-6k7k, Fortiportal, Fortiproxy, Fortirecorder_firmware, Fortiswitch, Fortivoice, Fortiweb 6.7
2021-12-08 CVE-2021-36180 Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests. Fortiweb 8.8
2021-12-08 CVE-2021-32591 A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier may allow an attacker in possession of the password store to compromise the confidentiality of the encrypted secrets. Fortiadc, Fortimail, Fortisandbox, Fortiweb 5.3