fortiadc Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/fortiadc/ Thu, 23 Feb 2023 14:12:23 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png fortiadc Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/fortiadc/ 32 32 CVE-2021-43076 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-43076/ Thu, 23 Feb 2023 14:12:23 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-43076/ An improper privilege management vulnerability [CWE-269] in FortiADC versions 6.2.1 and below, 6.1.5 and below, 6.0.4 and below, 5.4.5 and below and 5.3.7 and below may allow a remote authenticated attacker with restricted user profile to modify the system files using the shell access.

The post CVE-2021-43076 appeared first on CVE Vulnerability.

]]> An improper privilege management vulnerability [CWE-269] in FortiADC versions 6.2.1 and below, 6.1.5 and below, 6.0.4 and below, 5.4.5 and below and 5.3.7 and below may allow a remote authenticated attacker with restricted user profile to modify the system files using the shell access.

The post CVE-2021-43076 appeared first on CVE Vulnerability.

]]> CVE-2021-42757 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-42757/ Thu, 23 Feb 2023 14:12:19 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-42757/ A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments.

The post CVE-2021-42757 appeared first on CVE Vulnerability.

]]> A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments.

The post CVE-2021-42757 appeared first on CVE Vulnerability.

]]> CVE-2021-32591 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-32591/ Thu, 23 Feb 2023 14:09:48 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-32591/ A missing cryptographic steps vulnerability in the function that encrypts users’ LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier may allow an attacker in possession of the password store to compromise the confidentiality of the encrypted secrets.

The post CVE-2021-32591 appeared first on CVE Vulnerability.

]]> A missing cryptographic steps vulnerability in the function that encrypts users’ LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier may allow an attacker in possession of the password store to compromise the confidentiality of the encrypted secrets.

The post CVE-2021-32591 appeared first on CVE Vulnerability.

]]> CVE-2022-39947 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-39947/ Thu, 23 Feb 2023 05:20:29 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-39947/ A improper neutralization of special elements used in an os command (‘os command injection’) in Fortinet FortiADC version 7.0.0 through 7.0.2, FortiADC version 6.2.0 through 6.2.3, FortiADC version version 6.1.0 through 6.1.6, FortiADC version 6.0.0 through 6.0.4, FortiADC version 5.4.0 through 5.4.5 may allow an attacker to execute unauthorized code or commands via specifically crafted […]

The post CVE-2022-39947 appeared first on CVE Vulnerability.

]]> A improper neutralization of special elements used in an os command (‘os command injection’) in Fortinet FortiADC version 7.0.0 through 7.0.2, FortiADC version 6.2.0 through 6.2.3, FortiADC version version 6.1.0 through 6.1.6, FortiADC version 6.0.0 through 6.0.4, FortiADC version 5.4.0 through 5.4.5 may allow an attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

The post CVE-2022-39947 appeared first on CVE Vulnerability.

]]> CVE-2022-38374 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-38374/ Thu, 23 Feb 2023 05:20:13 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-38374/ A improper neutralization of input during web page generation (‘cross-site scripting’) in Fortinet FortiADC 7.0.0 – 7.0.2 and 6.2.0 – 6.2.4 allows an attacker to execute unauthorized code or commands via the URL and User fields observed in the traffic and event logviews.

The post CVE-2022-38374 appeared first on CVE Vulnerability.

]]> A improper neutralization of input during web page generation (‘cross-site scripting’) in Fortinet FortiADC 7.0.0 – 7.0.2 and 6.2.0 – 6.2.4 allows an attacker to execute unauthorized code or commands via the URL and User fields observed in the traffic and event logviews.

The post CVE-2022-38374 appeared first on CVE Vulnerability.

]]> CVE-2022-38381 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-38381/ Thu, 23 Feb 2023 05:20:13 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-38381/ An improper handling of malformed request vulnerability [CWE-228] exists in FortiADC 5.0 all versions, 6.0.0 all versions, 6.1.0 all versions, 6.2.0 through 6.2.3, and 7.0.0 through 7.0.2. This may allow a remote attacker without privileges to bypass some Web Application Firewall (WAF) protection such as the SQL Injection and XSS filters via a malformed HTTP […]

The post CVE-2022-38381 appeared first on CVE Vulnerability.

]]> An improper handling of malformed request vulnerability [CWE-228] exists in FortiADC 5.0 all versions, 6.0.0 all versions, 6.1.0 all versions, 6.2.0 through 6.2.3, and 7.0.0 through 7.0.2. This may allow a remote attacker without privileges to bypass some Web Application Firewall (WAF) protection such as the SQL Injection and XSS filters via a malformed HTTP request.

The post CVE-2022-38381 appeared first on CVE Vulnerability.

]]> CVE-2022-35851 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-35851/ Thu, 23 Feb 2023 05:19:44 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-35851/ An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiADC management interface 7.1.0 may allow a remote and authenticated attacker to trigger a stored cross site scripting (XSS) attack via configuring a specially crafted IP Address.

The post CVE-2022-35851 appeared first on CVE Vulnerability.

]]> An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiADC management interface 7.1.0 may allow a remote and authenticated attacker to trigger a stored cross site scripting (XSS) attack via configuring a specially crafted IP Address.

The post CVE-2022-35851 appeared first on CVE Vulnerability.

]]> CVE-2022-33875 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-33875/ Thu, 23 Feb 2023 05:19:18 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-33875/ An improper neutralization of special elements used in an SQL Command (‘SQL Injection’) vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

The post CVE-2022-33875 appeared first on CVE Vulnerability.

]]> An improper neutralization of special elements used in an SQL Command (‘SQL Injection’) vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

The post CVE-2022-33875 appeared first on CVE Vulnerability.

]]> CVE-2022-33876 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-33876/ Thu, 23 Feb 2023 05:19:18 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-33876/ Multiple instances of improper input validation vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allows an authenticated attacker to retrieve files with specific extension from the underlying Linux system via crafted HTTP requests.

The post CVE-2022-33876 appeared first on CVE Vulnerability.

]]> Multiple instances of improper input validation vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allows an authenticated attacker to retrieve files with specific extension from the underlying Linux system via crafted HTTP requests.

The post CVE-2022-33876 appeared first on CVE Vulnerability.

]]> CVE-2022-27482 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-27482/ Thu, 23 Feb 2023 05:18:04 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-27482/ A improper neutralization of special elements used in an os command (‘os command injection’) in Fortinet FortiADC version 7.0.0 through 7.0.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.6, 6.0.x, 5.x.x allows attacker to execute arbitrary shell code as `root` via CLI commands.

The post CVE-2022-27482 appeared first on CVE Vulnerability.

]]> A improper neutralization of special elements used in an os command (‘os command injection’) in Fortinet FortiADC version 7.0.0 through 7.0.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.6, 6.0.x, 5.x.x allows attacker to execute arbitrary shell code as `root` via CLI commands.

The post CVE-2022-27482 appeared first on CVE Vulnerability.

]]>