Fortinet FortiOS/FortiProxy vulnerabilities
7 known CVE vulnerabilities in Fortinet FortiOS/FortiProxy, translated and rated.
- CVE-2018-13382CriticalActively exploited
An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests.
- CVE-2018-13379CriticalActively exploited
An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.
- CVE-2023-41677High
A insufficiently protected credentials vulnerability in Fortinet FortiOS and FortiProxy allows an attacker to execute unauthorized code or commands via a targeted social engineering attack.
- CVE-2023-29180High
A null pointer dereference vulnerability in Fortinet FortiOS and FortiProxy across multiple versions allows an attacker to cause a denial of service via specially crafted HTTP requests.
- CVE-2023-36641Medium
A numeric truncation error vulnerability in Fortinet FortiOS and FortiProxy allows an attacker to cause a denial of service via specifically crafted HTTP requests.
- CVE-2023-33307Medium
A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to denial of sslvpn service via specifically crafted request in network parameter.
- CVE-2023-29178Medium
An access of uninitialized pointer vulnerability (CWE-824) in Fortinet FortiOS and FortiProxy allows an authenticated attacker to repeatedly crash the httpsd process via crafted HTTP or HTTPS requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS