Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2768▼ 428 respecto a la semana anterior
Críticas / altas1324▼ 116 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)265▼ 243 respecto a la semana anterior
284 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Alta (8.8) | 0.90% | — | Fortinet FortiproxyFortinet Fortios | 10/1/2024 | 17/6/2026 | An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0 through 7.4.1 allows an authenticated attacker to perform elevated actions via crafted HTTP or HTTPS requests. | |
| Modificada | Media (5.3) | 0.57% | — | Fortinet FortiproxyFortinet Fortios | 13/12/2023 | 17/6/2026 | An improper access control vulnerability [CWE-284] in FortiOS version 7.2.0, version 7.0.13 and below, version 6.4.14 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below may allow a remote unauthenticated attacker to bypass the firewall deny geolocalisation policy via… | |
| Modificada | Alta (8.8) | 1.1% | — | Fortinet FortiosFortinet Fortipam | 13/12/2023 | 17/6/2026 | A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthorized code or commands via specifically crafted request. | |
| Modificada | Alta (8.8) | 1.1% | — | Fortinet FortiproxyFortinet FortiosFortinet Fortipam | 13/12/2023 | 17/6/2026 | A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiPAM versions 1.0.0 through 1.0.3 allows attacker to execute… | |
| Modificada | Media (6.5) | 1.3% | — | Fortinet FortiproxyFortinet Fortios | 14/11/2023 | 17/6/2026 | A numeric truncation error in Fortinet FortiProxy version 7.2.0 through 7.2.4, FortiProxy version 7.0.0 through 7.0.10, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1, all versions, FortiProxy 1.0 all versions, FortiOS version 7.4.0, FortiOS version 7.2.0 through 7.2.5, FortiOS version 7.0.0… | |
| Modificada | Media (6.7) | 0.17% | — | Fortinet FortiproxyFortinet Fortios | 14/11/2023 | 17/6/2026 | An improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versions, 6.2 all versions, 6.0 all versions and VMs may allow a local attacker with admin privileges to boot a malicious image on the device and bypass the filesystem integrity check… | |
| Modificada | Alta (8.8) | 0.83% | — | Fortinet Fortios | 10/10/2023 | 17/6/2026 | An improper authorization vulnerability in Fortinet FortiOS 7.0.0 - 7.0.11 and 7.2.0 - 7.2.4 allows an attacker belonging to the prof-admin profile to perform elevated actions. | |
| Modificada | Media (5.3) | 1.0% | — | Fortinet FortiproxyFortinet Fortios | 10/10/2023 | 17/6/2026 | A use after free vulnerability [CWE-416] in FortiOS version 7.2.0 through 7.2.4 and version 7.0.0 through 7.0.10 and FortiProxy version 7.2.0 through 7.2.2 and version 7.0.0 through 7.0.8 may allow an unauthenticated remote attacker to crash the WAD process via multiple crafted packets reaching proxy policies or… | |
| Modificada | Alta (7.5) | 0.42% | — | Fortinet Fortios IPS Engine | 10/10/2023 | 17/6/2026 | A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packets. | |
| Modificada | Alta (7.5) | 0.88% | — | Fortinet Fortios | 10/10/2023 | 17/6/2026 | A use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12, 7.2.0 - 7.2.5 and 7.4.0 allows an attacker to view plaintext passwords of remote services such as RDP or VNC, if the attacker is able to read the GET requests to those services. | |
| Modificada | Media (5.4) | 0.34% | — | Fortinet Fortios | 10/10/2023 | 17/6/2026 | An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components. | |
| Modificada | Media (4.3) | 0.37% | — | Fortinet Fortios | 10/10/2023 | 17/6/2026 | An improper access control vulnerability in Fortinet FortiOS 7.2.0 - 7.2.4 and 7.4.0 allows an attacker to access a restricted resource from a non trusted host. | |
| Modificada | Media (5.4) | 1.3% | — | Fortinet FortiproxyFortinet Fortios | 13/9/2023 | 17/6/2026 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 and FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14 GUI may allow an authenticated attacker to trigger… | |
| Modificada | Media (4.2) | 0.48% | — | Fortinet FortianalyzerFortinet FortimanagerFortinet FortisandboxFortinet Fortios | 1/9/2023 | 17/6/2026 | An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, 6.4.7 and below; FortiOS 6.2.x and 6.0.x; FortiSandbox 4.0.x, 3.2.x and 3.1.x may allow a network adjacent and unauthenticated attacker to man-in-the-middle the communication… | |
| Modificada | Media (6.7) | 0.29% | — | Fortinet Fortios | 17/8/2023 | 17/6/2026 | A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiOS before 7.0.3 allows a privileged attacker to execute arbitrary code via specially crafted CLI commands, provided the attacker were able to evade FortiOS stack protections. | |
| Modificada | Crítica (9.8) | 2.1% | — | Fortinet FortiproxyFortinet Fortios | 26/7/2023 | 17/6/2026 | A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0 through 7.2.2 allows a remote unauthenticated attacker to execute arbitrary code or command via crafted packets reaching proxy policies or… | |
| Modificada | Media (6.7) | 0.18% | — | Fortinet FortianalyzerFortinet FortimanagerFortinet FortiproxyFortinet Fortios | 18/7/2023 | 17/6/2026 | A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiAnalyzer version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below, version 6.0.11 and below, version 5.6.11 and below, FortiManager version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below,… | |
| Modificada | Crítica (9.8) | 0.51% | — | Fortinet Fortios | 11/7/2023 | 17/6/2026 | An insufficient session expiration in Fortinet FortiOS 7.0.0 - 7.0.12 and 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via reusing the session of a deleted user in the REST API. | |
| Modificada | Baja (3.3) | 0.29% | — | Fortinet FortiauthenticatorFortinet Fortios | 11/7/2023 | 17/6/2026 | A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.13 and FortiAuthenticator version 5.5.0 and all versions of 6.1 and 6.0 may allow a local unauthorized party to retrieve the Fortinet private keys used to… | |
| Modificada | Media (6.5) | 0.59% | — | Fortinet FortiproxyFortinet Fortios | 16/6/2023 | 17/6/2026 | A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to denial of sslvpn service via specifically crafted request in network parameter. | |
| Modificada | Media (6.5) | 0.84% | — | Fortinet FortiproxyFortinet Fortios | 16/6/2023 | 17/6/2026 | A null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11 and before 6.4.13, FortiProxy before 7.2.4 and before 7.0.10 allows attacker to denial of sslvpn service via specifically crafted request in bookmark parameter. | |
| Modificada | Media (6.5) | 0.83% | — | Fortinet FortiproxyFortinet FortiwebFortinet Fortios | 13/6/2023 | 17/6/2026 | A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy version 7.2.0 through 7.2.3, FortiProxy version 7.0.0 through 7.0.9, FortiProxy 2.0… | |
| Modificada | Media (4.3) | 0.88% | — | Fortinet FortiproxyFortinet Fortios | 13/6/2023 | 17/6/2026 | A access of uninitialized pointer vulnerability [CWE-824] in Fortinet FortiProxy version 7.2.0 through 7.2.3 and before 7.0.9 and FortiOS version 7.2.0 through 7.2.4 and before 7.0.11 allows an authenticated attacker to repetitively crash the httpsd process via crafted HTTP or HTTPS requests. | |
| Modificada | Media (4.8) | 0.19% | — | Fortinet FortiproxyFortinet Fortios | 13/6/2023 | 17/6/2026 | An improper certificate validation vulnerability [CWE-295] in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.10, 7.2.0 and FortiProxy 1.2 all versions, 2.0 all versions, 7.0.0 through 7.0.9, 7.2.0 through 7.2.3 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the… | |
| Analizada | Crítica (9.8) | 86% | ⚠ Explotación activa💥 PoC | Fortinet FortiproxyFortinet Fortios | 13/6/2023 | 31/7/2026 | A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may… |