Browse CVEs

HIGH 8.1 CVE-2023-40723 An exposure of sensitive information to an unauthorized actor in Fortinet FortiSIEM version 6.7.0 through 6.7.4 and 6.6.0 through 6.6.3 and 6.5.0 thr… Fortisiem 6.4.2 / 6.5.2+ Fix from $1,9502025-03-11 MEDIUM 6.1 CVE-2023-37933 An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiADC GUI version 7.4.0, 7.2.0 t… Fortiadc 7.1.4 / 7.2.2+ Fix from $1,6002025-03-11 HIGH 8.6 CVE-2025-24470 An Improper Resolution of Path Equivalence vulnerability [CWE-41] in FortiPortal 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.11 may a… Fortiportal 7.0.12 / 7.2.7+ Fix from $1,9502025-02-11 HIGH 8.1 CVE-2025-24472 KEV An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 throu… Fortiproxy 7.0.17 / 7.0.20+ Fix from $1,9502025-02-11 HIGH 8.4 CVE-2024-52968 An improper authentication in Fortinet FortiClientMac 7.0.11 through 7.2.4 allows attacker to gain improper access to MacOS via empty password. Forticlient 7.0.13 / 7.2.5+ Fix from $1,9502025-02-11 HIGH 7.2 CVE-2024-50569 A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.0.0 through 7.6.0 allows attacker… Fortiweb 7.4.6+ Fix from $1,9502025-02-11 HIGH 8.1 CVE-2024-35279 A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.4 through 7.2.8 and version 7.4.0 through 7.4.4 allows a remote… Fortios 7.2.9 / 7.4.5+ Fix from $1,9502025-02-11 HIGH 7.7 CVE-2024-33504 A use of hard-coded cryptographic key to encrypt sensitive data vulnerability [CWE-321] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2… Fortimanager 7.2.9 / 7.2.10+ Fix from $1,9502025-02-11 HIGH 7.2 CVE-2024-40584 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiAnalyzer versio… Fortimanager Cloud 7.2.6 / 7.2.8+ Fix from $1,9502025-02-11 HIGH 7.2 CVE-2024-40591 An incorrect privilege assignment vulnerability [CWE-266] in Fortinet FortiOS version 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.9 and before 7.0.… Fortios 6.4.16 / 7.0.16+ Fix from $1,9502025-02-11 HIGH 7.2 CVE-2024-50567 An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb 7.4.0 through 7.6.0 allows attacke… Fortiweb 7.4.6+ Fix from $1,9502025-02-11 MEDIUM 6.7 CVE-2024-40586 An Improper Access Control vulnerability [CWE-284] in FortiClient Windows version 7.4.0, version 7.2.6 and below, version 7.0.13 and below may allow … Forticlient 7.0.14 / 7.2.7+ Fix from $1,6002025-02-11 MEDIUM 6.0 CVE-2024-36508 An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.4.0 throu… Fortimanager 7.2.6 / 7.4.3+ Fix from $1,6002025-02-11 CRITICAL 9.0 CVE-2024-27781EPSS 28% An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, F… Fortisandbox 4.0.5 / 4.2.7+ Fix from $2,3002025-02-11 MEDIUM 6.7 CVE-2023-40721 A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbitrary cod… Fortios 1.2.0 / 7.0.3+ Fix from $1,6002025-02-11 MEDIUM 5.4 CVE-2024-27780 Multiple Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabilities [CWE-79] in FortiSIEM 7.1 all versions… Fortisiem after 7.1.8 Fix from $1,6002025-02-11 MEDIUM 6.1 CVE-2022-23439 A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP re… Fortiadc 5.5.2 / 6.0.11+ Fix from $1,6002025-01-22 CRITICAL 9.8 CVE-2024-50563 A weak authentication in Fortinet FortiManager Cloud, FortiAnalyzer versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7… Fortianalyzer 7.4.4 / 7.6.2+ Fix from $2,3002025-01-16 CRITICAL 9.1 CVE-2024-48885 A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiRecorder 7.2.0 through 7.2.1, FortiRe… Fortirecorder 7.0.5 / 7.2.2+ Fix from $2,3002025-01-16 HIGH 7.8 CVE-2024-45331 A incorrect privilege assignment vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 al… Fortianalyzer 7.2.6 / 7.2.7+ Fix from $1,9502025-01-16 MEDIUM 6.1 CVE-2024-35280 A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiDeceptor 5.3.0, FortiDeceptor 5… Fortideceptor 5.2.1+ Fix from $1,6002025-01-15 CRITICAL 9.8 CVE-2024-55591 KEVEPSS 98% An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy ver… Fortiproxy 7.0.17 / 7.0.20+ Fix from $2,3002025-01-14 MEDIUM 6.7 CVE-2024-56497 An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiMail versions 7.2.0 through 7.2.4 and … Fortimail 6.4.5 / 6.4.8+ Fix from $1,6002025-01-14 MEDIUM 6.5 CVE-2024-52969 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiSIEM ersion 7.1.7 and below, v… Fortisiem after 7.1.7 Fix from $1,6002025-01-14 MEDIUM 5.8 CVE-2024-54021 An Improper Neutralization of CRLF Sequences in HTTP Headers ('http response splitting') vulnerability [CWE-113] in Fortinet FortiOS 7.2.0 through 7.… Fortiproxy 7.2.9 / 7.2.12+ Fix from $1,6002025-01-14 CRITICAL 9.8 CVE-2024-48886 A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy v… Fortianalyzer 2.0.15 / 7.0.16+ Fix from $2,3002025-01-14 HIGH 8.8 CVE-2024-48890 An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiSOAR IMAP connector vers… Fortisoar Imap Connector 3.5.8+ Fix from $1,9502025-01-14 HIGH 8.8 CVE-2024-50566 A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager Cloud 7.6.0 throu… Fortimanager 7.2.8 / 7.2.9+ Fix from $1,9502025-01-14 MEDIUM 5.9 CVE-2024-52963 A out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4.0 through 6.4.15 allow… Fortios 7.2.11 / 7.4.8+ Fix from $1,6002025-01-14 MEDIUM 5.4 CVE-2024-48893 An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiSOAR 7.3.0 through 7.3.3, 7.2.1 through 7.2.2 may allow… Fortisoar after 7.3.3 Fix from $1,6002025-01-14