CVE Catalog

A vulnerability in the Howyar UEFI Application 'Reloader' allows for the execution of unsigned software from a hard-coded path, bypassing UEFI Secure Boot. This issue affects both 32-bit and 64-bit versions of the application, which is distributed as part of several real-time system recovery software suites. The vulnerability arises because the Reloader application does not use standard UEFI functions to load applications securely, enabling the execution of arbitrary code during the boot process with high privileges.

A command injection vulnerability has been identified in Fortinet FortiMail versions 7.2.0 to 7.2.4, 7.0.0 to 7.0.6, and 6.4.0 to 6.4.7, as well as FortiRecorder versions 7.0.0 and 6.4.0 to 6.4.4. This vulnerability allows attackers to execute unauthorized code or commands via the command line interface (CLI) by improperly neutralizing special elements used in operating system commands.

A SQL injection vulnerability has been identified in Fortinet FortiWeb versions 6.3.17 through 7.6.1. This vulnerability arises from improper neutralization of special elements used in SQL commands, allowing attackers to execute crafted SQL queries that could lead to unauthorized information disclosure.

A vulnerability allowing authentication bypass via an alternate path or channel has been identified in Fortinet FortiOS versions 7.0.0 to 7.0.16, as well as FortiProxy versions 7.0.0 to 7.0.19 and 7.2.0 to 7.2.12. This vulnerability allows remote attackers to gain super-admin privileges by sending crafted requests to the Node.js WebSocket module.

A vulnerability allowing HTTP response splitting has been identified in Fortinet FortiOS versions 7.2.0 to 7.6.0 and FortiProxy versions 7.2.0 to 7.4.5. This vulnerability arises from improper handling of carriage return and line feed (CRLF) sequences in HTTP headers, which can be exploited by attackers to execute unauthorized code or commands by crafting specific HTTP headers.

A SQL injection vulnerability has been identified in Fortinet FortiSIEM versions 7.1.7 and below, 7.1.0, 7.0.3 and below, 6.7.9 and below, 6.7.8, 6.6.5 and below, 6.5.3 and below, and 6.4.4 and below. This vulnerability allows authenticated attackers to extract database information by sending crafted requests through the Update/Create Case feature.

A cross-site scripting vulnerability has been identified in Fortinet FortiPortal versions 6.0.0 to 6.0.14. This issue arises from improper handling of script-related HTML tags, allowing attackers to execute unauthorized code or commands through HTML injection.

A denial-of-service vulnerability has been identified in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, and 6.4.0 through 6.4.15. The issue arises from an out-of-bounds write that allows attackers to disrupt services by sending specially crafted packets.

An OS command injection vulnerability has been identified in Fortinet FortiManager. This issue affects versions 7.6.0 through 7.6.1, 7.4.5 through 7.4.0, and 7.2.1 through 7.2.8, as well as FortiManager Cloud versions 7.6.0 through 7.6.1, 7.4.0 through 7.4.4, and 7.2.2 through 7.2.7. The vulnerability arises from improper neutralization of special elements in OS commands, which may allow an authenticated remote attacker to execute unauthorized code by sending crafted FGFM requests.

A vulnerability exists in Fortinet FortiClient for Windows in versions 7.4.0, 7.2.x (all versions), 7.0.x (all versions), and 6.4.x (all versions). The issue arises from the use of a hard-coded cryptographic key, which may enable a low-privileged user to decrypt interprocess communication by monitoring named pipes.

A stored cross-site scripting vulnerability has been identified in Fortinet FortiSOAR versions 7.3.0 to 7.3.3 and 7.2.1 to 7.2.2. This vulnerability arises from improper input neutralization during web page generation, potentially allowing an authenticated attacker to inject malicious scripts through the creation of harmful playbooks.

A vulnerability allowing OS command injection has been identified in the FortiSOAR IMAP connector, specifically in versions through 3.5.7. This vulnerability arises from improper neutralization of special elements used in OS commands, potentially allowing an authenticated attacker to execute unauthorized code or commands by crafting a specific playbook.

A vulnerability exists in Fortinet FortiOS (versions 7.4.0 to 7.4.4, 7.2.0 to 7.2.8, 7.0.0 to 7.0.15, 6.4.0 to 6.4.15), FortiProxy (versions 7.4.0 to 7.4.4, 7.2.0 to 7.2.10, 7.0.0 to 7.0.17, 2.0.0 to 2.0.14), FortiManager (versions 7.6.0 to 7.6.1, 7.4.1 to 7.4.3) and FortiAnalyzer Cloud (versions 7.4.1 to 7.4.3). The vulnerability arises from weak authentication, allowing attackers to execute unauthorized code or commands through brute-force attacks.

A path traversal vulnerability has been identified in Fortinet FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiOS versions 7.6.0, 7.4.0 through 7.4.4, 7.2.5 through 7.2.9, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, and FortiProxy versions 7.4.0 through 7.4.5, 7.2.0 through 7.2.11, 7.0.0 through 7.0.18, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, and 1.0.0 through 1.0.7. This vulnerability allows attackers to escalate privileges by sending specially crafted packets, exploiting improper restrictions on file paths that could lead to unauthorized access to restricted directories.

A vulnerability exists in Fortinet FortiSOAR versions 7.2.1 through 7.4.1, due to improper handling of formula elements in CSV files. This flaw enables attackers to execute unauthorized code or commands by manipulating the CSV file.

A vulnerability allowing improper access control has been identified in Fortinet FortiManager versions 6.4.12 through 7.4.0. This vulnerability arises from an operation on a resource after its expiration or release, which can allow an attacker to gain unauthorized access to FortiGate using valid credentials. Specifically, an admin account deleted through FortiManager may still be able to log into FortiGate.

A path traversal vulnerability has been identified in Fortinet FortiRecorder versions 7.2.0 through 7.2.1 and prior to 7.0.4. This vulnerability allows a privileged attacker to delete files from the underlying filesystem by sending crafted CLI requests. The issue arises from an improper restriction of pathname limitations, enabling unauthorized file deletion.

A vulnerability allowing out-of-bounds read has been identified in Fortinet FortiOS versions 7.6.0, 7.4.4 and below, 7.2.9 and below, as well as in FortiSASE FortiOS tenant version 24.3.b. This vulnerability may allow an unauthenticated remote attacker to send crafted requests that trigger excessive memory consumption, leading to a denial-of-service condition.

A vulnerability allowing integer overflow or wraparound has been identified in Fortinet FortiOS versions 7.4.0 through 7.4.4, and 7.2.0 through 7.2.10, as well as FortiSASE version 23.4.b. This vulnerability exists in the FortiOS tenant IPsec IKEv1 service, where an authenticated attacker can send crafted requests to crash the IPsec tunnel, leading to a potential denial-of-service condition.

A vulnerability allowing resource exhaustion through unlimited large file uploads has been identified in Fortinet FortiOS. This issue affects versions 7.4.0 to 7.4.4, 7.2.0 to 7.2.8, 7.0.0 to 7.0.15, and 6.4.0 to 6.4.15. The vulnerability could enable an unauthenticated remote user to deplete all system memory, potentially leading to a denial of service.

A denial-of-service vulnerability has been identified in Fortinet FortiSIEM versions 5.3, 5.4, 6.x, 7.0, and 7.1.0 through 7.1.5. This vulnerability arises from an unlimited allocation of resources, allowing an attacker to consume all available connections and disrupt valid TLS traffic.

A denial-of-service vulnerability has been identified in Fortinet FortiOS. This issue affects versions 7.6.0, 7.4.4 through 7.4.0, 7.2 (all versions), 7.0 (all versions), and 6.4 (all versions). The vulnerability arises from an allocation of resources without limits or throttling, allowing remote unauthenticated attackers to disrupt access to the graphical user interface (GUI) by sending specially crafted requests to specific endpoints.

A vulnerability allowing the insertion of sensitive information into transmitted data has been identified in Fortinet FortiOS versions 7.6.0 and 7.4.0 through 7.4.4. This vulnerability may enable an attacker in a man-in-the-middle position to intercept accounting requests and retrieve the shared secret used for RADIUS accounting server communications.

A relative path traversal vulnerability has been identified in Fortinet FortiRecorder versions 7.2.0 through 7.2.1 and prior to 7.0.4. This vulnerability allows a privileged attacker to read files from the underlying filesystem by sending crafted HTTP or HTTPS requests.

A vulnerability allowing improper access control has been identified in Fortinet FortiDeceptor versions 6.0.0, 5.3.3 and below, 5.2.1 and below, 5.1.0, and 5.0.0. This vulnerability may enable an authenticated attacker with no privileges to execute operations on the central management appliance by sending crafted requests.

A vulnerability allowing OS command injection has been identified in Fortinet FortiVoice versions 7.0.0 through 7.0.4 and prior to 6.4.9. This vulnerability arises from improper neutralization of special elements used in OS commands, allowing an authenticated privileged attacker to execute unauthorized code or commands through crafted CLI requests.

A path traversal vulnerability has been identified in Fortinet FortiManager and FortiAnalyzer versions 7.4.0 to 7.4.3, 7.2.0 to 7.2.5, 7.0.2 to 7.0.12, and 6.2.10 to 6.2.13. This vulnerability arises from an improper restriction of file paths, allowing attackers to execute unauthorized code or commands by sending crafted HTTP or HTTPS requests.

A vulnerability allowing user enumeration through response timing discrepancies has been identified in Fortinet FortiClient EMS versions 7.4.0, 7.2.0 prior to 7.2.4, 7.0 all versions, and Fortinet FortiSOAR versions 7.5.0, 7.4.0 prior to 7.4.4, 7.3.0 prior to 7.3.2, 7.2 all versions, 7.0 all versions, and 6.4 all versions. This vulnerability allows an unauthenticated attacker to identify valid users by analyzing the differences in login request responses.

A vulnerability allowing for improper verification of the source of a communication channel has been identified in Fortinet FortiClient EMS versions 7.4.0, 7.2.0 through 7.2.4, 7.0 (all versions), and 6.4 (all versions). This vulnerability may enable a remote attacker to bypass the trusted host feature by manipulating session connections.

A denial-of-service vulnerability has been identified in the FortiOS SSLVPN web portal. This issue arises from an out-of-bounds read vulnerability, allowing an authenticated attacker to disrupt the SSLVPN web portal's functionality. The vulnerability is present in FortiOS SSLVPN web portal versions 7.4.0 to 7.4.4, 7.2.0 to 7.2.8, all versions of 7.0, and all versions of 6.4. The issue can be exploited by sending a specially crafted URL to the SSLVPN web portal.

A SQL injection vulnerability has been identified in Fortinet FortiPortal versions 7.2.4 through 7.2.0 and 7.0.0 through 7.2.8. This vulnerability arises from improper neutralization of special elements used in SQL commands, which may allow an authenticated attacker to view SQL queries being executed on the server side. The issue can be exploited by including special elements in an HTTP request.

A vulnerability allowing unauthorized access to the configuration of managed devices has been identified in Fortinet FortiPortal versions 6.0.0 to 6.0.15 and FortiManager versions 7.4.0 to 7.4.2, 7.2.0 to 7.2.5, 7.0.0 to 7.0.12, and 6.4.0 to 6.4.14. This vulnerability arises from a missing authentication for critical functions, enabling attackers to access device configurations by sending specially crafted packets.

A stack-based buffer overflow vulnerability has been identified in Fortinet FortiAnalyzer, FortiManager, FortiManager Cloud, and FortiAnalyzer Cloud. This vulnerability affects multiple versions within the FortiAnalyzer and FortiManager product lines, as well as their cloud counterparts. The issue allows attackers to execute unauthorized code or commands by sending specially crafted packets.

A SQL injection vulnerability has been identified in Fortinet FortiAnalyzer versions 7.4.0 to 7.4.2 and FortiManager versions 7.4.0 to 7.4.2. This vulnerability arises from improper neutralization of special elements used in SQL commands, allowing attackers to escalate privileges by sending specially crafted HTTP requests.

A vulnerability allowing out-of-bounds write has been identified in Fortinet FortiManager versions 7.4.0 to 7.4.2 and FortiAnalyzer versions 7.4.0 to 7.4.2. This vulnerability allows attackers to escalate privileges by sending specially crafted HTTP requests.

A vulnerability allowing privilege escalation through specific shell commands has been identified in Fortinet FortiManager and FortiAnalyzer. This issue affects multiple versions: FortiManager versions 7.4.0 to 7.4.3, 7.2.0 to 7.2.5, 7.0.0 to 7.0.12, and 6.4.0 to 6.4.14. FortiAnalyzer versions 7.4.0 to 7.4.2, 7.2.0 to 7.2.5, 7.0.0 to 7.0.12, and 6.4.0 to 6.4.14 are also affected.

A path traversal vulnerability has been identified in Fortinet FortiManager and FortiAnalyzer. Affected versions include FortiManager and FortiAnalyzer 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.12, and 6.0.0 through 6.0.12. This vulnerability allows attackers to execute unauthorized code or commands by sending crafted HTTP or HTTPS requests that exploit the improper limitation of pathnames to restricted directories.

A relative path traversal vulnerability has been identified in Fortinet FortiManager versions 7.4.0 through 7.4.2 and prior to 7.2.5. This vulnerability allows a privileged attacker to delete files from the underlying filesystem by sending crafted HTTP or HTTPS requests.

A command injection vulnerability has been identified in Fortinet FortiSandbox versions 4.4.0 to 4.4.4, 4.2.0 to 4.2.6, and below 4.0.4. This vulnerability allows an authenticated attacker with at least read-only permissions to execute unauthorized commands by sending crafted requests. The issue arises from improper handling of special elements in operating system command execution.

A command injection vulnerability has been identified in Fortinet FortiAP-S versions 6.2 (all versions), 6.4.0 through 6.4.9, FortiAP-W2 versions 6.4 (all versions), 7.0 (all versions), 7.2.0 through 7.2.3, and 7.4.0 through 7.4.2, as well as FortiAP versions 6.4 (all versions), 7.0 (all versions), 7.2.0 through 7.2.3, and 7.4.0 through 7.4.2. This vulnerability allows local authenticated attackers to execute unauthorized code via the command line interface (CLI).

A vulnerability allowing brute force attacks on the FortiClientEMS console has been identified in FortiClientEMS versions 7.2.0 through 7.2.4 and prior to 7.0.10. This issue arises from improper restrictions on excessive authentication attempts, enabling an unauthenticated attacker to exploit the vulnerability via crafted HTTP or HTTPS requests.

A stack-based buffer overflow vulnerability has been identified in Fortinet FortiWeb versions 7.2.0 through 7.2.7, and 7.4.0 through 7.4.1. This vulnerability may allow a privileged user to execute arbitrary code by sending specially crafted CLI commands, provided the user can bypass FortiWeb's stack protections.

A denial-of-service vulnerability has been identified in Arm SCP-Firmware release versions through 2.15.0. This issue arises when specifically crafted SCMI messages are sent to an SCP, potentially leading to a Usage Fault and causing the SCP to crash.

A denial-of-service vulnerability has been identified in Arm SCP-Firmware versions through 2.15.0. The issue arises when specifically crafted SCMI messages are sent to an SCP, potentially leading to a Usage Fault and causing the SCP to crash.

A vulnerability in Phoenix Contact CHARX SEC-3000 series charge controllers, all versions prior to 1.7.0, allows an authenticated low-privileged user to escalate privileges and gain root access. This issue arises from improper file permission handling, which can be exploited to alter access rights and elevate user privileges.

A vulnerability allowing IP spoofing has been identified in Fortinet FortiOS IPSec VPN versions 7.4.0 through 7.4.1 and in version 7.2.6 and below. This origin validation error allows an authenticated IPSec VPN user with dynamic IP addressing to send packets that impersonate the IP of another user, using specially crafted network packets. However, the vulnerability does not allow the spoofed packets to be received by the targeted user.

A null pointer dereference vulnerability has been identified in Fortinet FortiOS. This issue is present in versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, as well as all versions of 7.0, 6.4, 6.2, and 6.0. The vulnerability allows an attacker to trigger a denial-of-service condition by sending a crafted HTTP request.

A null pointer dereference vulnerability has been identified in Fortinet FortiOS. This issue is present in versions 7.4.0 through 7.4.1, 7.2.0 through 7.2.5, as well as all versions of 7.0, 6.4, 6.2, and 6.0. The vulnerability allows an attacker to cause a denial-of-service condition by sending a crafted HTTP request.

A command injection vulnerability has been identified in Fortinet FortiSwitch versions 7.4.0, 7.2.0 through 7.2.5, 7.0.0 through 7.0.7, 6.4.0 through 6.4.13, 6.2.0 through 6.2.7, and 6.0.0 through 6.0.7. This vulnerability allows attackers to execute unauthorized code or commands via the FortiSwitch command-line interface (CLI).

A vulnerability exists in Fortinet FortiSwitch versions 7.4.0, 7.2.0 through 7.2.5, 7.0.0 through 7.0.7, 6.4.0 through 6.4.13, 6.2.0 through 6.2.7, and 6.0.0 through 6.0.7. The issue arises from the use of a hard-coded cryptographic key, which allows attackers to execute unauthorized code or commands by sending crafted requests.