FO
Product
Fortinac
30
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 14Medium 10Low 0
Watch
Add Fortinac to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-33299 | 9.8 | Jun 23 | A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or… Affected: 8.5.0 through 8.5.4; 8.6.0 through 8.6.5; 8.7.0 through 8.7.6; 8.8.0 through 8.8.11; 9.1.0 through 9.1.9; 9.2.0 through 9.2.7; +6 more |
| CVE-2022-39952 | 9.8 | Feb 16 | A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through… Affected: 8.3.7 through 8.8.9; 9.1.0 before 9.1.8; 9.2.0 before 9.2.6; 9.4.0 before 9.4.1 |
| CVE-2022-38375 | 9.8 | Feb 16 | An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative… Affected: 9.2.0 before 9.2.7; 9.4.0 before 9.4.2 |
| CVE-2022-39954 | 9.1 | Feb 16 | An improper restriction of xml external entity reference in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.7, FortiNAC version 9.1.0 through… Affected: 8.3.7 through 9.2.7; 9.4.0 before 9.4.2 |
| CVE-2024-31488 | 9.0 | May 14 | An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0… Affected: 7.2.0 before 7.2.4; 8.7.0 before 9.4.5 |
| CVE-2023-22637 | 9.0 | May 3 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2… Affected: 8.7.0 before 9.4.3 |
| CVE-2022-40677 | 8.8 | Feb 16 | A improper neutralization of argument delimiters in a command ('argument injection') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through… Affected: 8.5.0 through 8.5.4; 8.6.0 through 8.6.5; 8.7.0 through 8.7.6; 8.8.0 through 8.8.11; 9.1.0 through 9.1.7; 9.2.0 through 9.2.5; +2 more |
| CVE-2022-26117 | 8.8 | Jul 18 | An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and… Affected: 8.5.0 through 8.5.2; 8.6.2 through 8.6.5; 8.7.0 through 8.7.6; 8.8.0 through 8.8.11; 9.1.0 before 9.1.6; 9.2.0 before 9.2.4; +3 more |
| CVE-2022-26116 | 8.8 | May 11 | Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4,… Affected: through 8.3.7; 8.5.0 through 8.5.2; 8.6.2 through 8.6.5; 8.7.0 through 8.7.6; 8.8.0 through 8.8.11; 9.1.0 through 9.1.5; +3 more |
| CVE-2023-26203 | 7.8 | May 3 | A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7… Affected: 8.7.0 through 9.2.7; 9.4.0 before 9.4.3 |
| CVE-2022-39953 | 7.8 | Mar 7 | A improper privilege management in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.6, FortiNAC version 9.1.0 through 9.1.8, FortiNAC all versions… Affected: 8.5.0 through 8.5.4; 8.6.0 through 8.6.5; 8.7.0 through 8.7.6; 8.8.0 through 8.8.11; 9.1.0 through 9.1.8; 9.2.0 through 9.2.6; +3 more |
| CVE-2022-40678 | 7.8 | Feb 16 | An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through… Affected: 8.5.0 through 8.5.4; 8.6.0 through 8.6.5; 8.7.0 through 8.7.6; 8.8.0 through 8.8.11; 9.1.0 through 9.1.7; 9.2.0 through 9.2.5; +2 more |
| CVE-2021-43065 | 7.8 | Dec 9 | A incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version 9.1.3 and below, version 8.8.9 and below allows attacker to gain higher… Affected: 8.8.0 before 8.8.10; 9.1.0 before 9.1.4; 9.2.0 |
| CVE-2023-22633 | 7.5 | Jun 13 | An improper permissions, privileges, and access controls vulnerability [CWE-264] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all… Affected: 8.7.0 through 8.7.6; 8.8.0 through 8.8.11; 9.1.0 through 9.1.8; 9.2.0 through 9.2.6; 9.4.0; 9.4.1 |
| CVE-2022-45860 | 7.5 | May 3 | A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all… Affected: 8.7.0 through 9.2.6; 9.4.0 before 9.4.2 |
| CVE-2022-43951 | 7.5 | Apr 11 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and below, 8.7.6 and… Affected: 8.7.0 through 9.2.7; 9.4.0 before 9.4.2 |
| CVE-2022-45858 | 7.4 | May 3 | A use of a weak cryptographic algorithm vulnerability [CWE-327] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.0 all versions, 8.8.0 all versions, 8.7.0 all versions may… Affected: 8.7.0 before 9.1.0; 9.2.0 before 9.2.6; 9.4.0 before 9.4.2 |
| CVE-2022-40675 | 7.4 | Feb 16 | Some cryptographic issues in Fortinet FortiNAC versions 9.4.0 through 9.4.1, 9.2.0 through 9.2.7, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through… Affected: 8.3.7 through 9.2.7; 9.4.0 before 9.4.2 |
| CVE-2022-39946 | 7.2 | Jun 13 | An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8.6 all versions, 8.5… Affected: 8.5.0 through 8.5.4; 8.6.0 through 8.6.5; 8.7.0 through 8.7.6; 8.8.0 through 8.8.11; 9.1.0 through 9.1.10; 9.2.0 through 9.2.8; +3 more |
| CVE-2021-24011 | 7.2 | May 10 | A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges Affected: before 8.8.2 |
| CVE-2021-41021 | 6.7 | Dec 8 | A privilege escalation vulnerability in FortiNAC versions 8.8.8 and below and 9.1.2 and below may allow an admin user to escalate the privileges to root via the sudo command Affected: 8.8.0; 8.8.1; 8.8.2; 8.8.3; 8.8.4; 8.8.5; +6 more |
| CVE-2023-26206 | 6.1 | Feb 15 | An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9.1.0 - 9.1.10 and 7.2.0 allows an… Affected: 9.1.0 through 9.1.10; 9.2.0 through 9.2.8; 9.4.0 through 9.4.2; 7.2.0 |
| CVE-2022-38376 | 6.1 | Feb 16 | Multiple improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilities [CWE-79] in Fortinet FortiNAC portal UI before 9.4.1 allows an… Affected: 8.5.0 through 8.5.4; 8.6.0 before 9.4.2; 8.3.7 |
| CVE-2020-12816 | 6.1 | Sep 24 | An improper neutralization of input vulnerability in FortiNAC before 8.7.2 may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the… Affected: before 8.7.3 |
| CVE-2019-5594 | 6.1 | Aug 23 | An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated… Affected: 8.3.0 through 8.3.6; 8.5.0 |
| CVE-2022-40676 | 5.4 | Mar 7 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.8, 8.8.0 through… Affected: 8.5.0 through 8.5.4; 8.6.0 through 8.6.5; 8.7.0 through 8.7.6; 8.8.0 through 8.8.11; 9.1.0 through 9.1.8; 9.2.0 through 9.2.5; +2 more |
| CVE-2023-22638 | 5.4 | Feb 16 | Several improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and below, 8.7.6… Affected: 8.5.0 through 8.5.4; 8.6.0 through 8.6.5; 8.7.0 through 8.7.6; 8.8.0 through 8.8.11; 9.1.0 through 9.1.9; 9.2.0 through 9.2.7; +3 more |
| CVE-2023-33300 | 5.3 | Mar 14 | A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earlier allows attacker a limited,… Affected: 7.2.0 before 7.2.2; 9.4.0 before 9.4.4 |
| CVE-2022-43950 | 4.7 | May 3 | A URL redirection to untrusted site ('Open Redirect') vulnerability [CWE-601] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.1 and below, 9.2 all versions, 9.1 all versions, … Affected: 8.7.0 before 9.4.2 |
| CVE-2022-45859 | 4.4 | May 3 | An insufficiently protected credentials vulnerability [CWE-522] in FortiNAC-F 7.2.0, FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.0 all versions, 8.7.0 all… Affected: 8.7.0 through 9.1.8; 9.2.0 before 9.2.7; 9.4.0 before 9.4.2 |
Showing 30