Fortinet Fortiadc vulnerabilities

CVE-2020-15935 [MEDIUM] CWE-312 CVE-2020-15935: A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and below may allow a remote authenticated attacker to retrieve some sensitive information such as users LDAP passwords and RADIUS shared secret by deobfuscating the passwords entry fields.

CVE-2021-24024 [MEDIUM] CWE-532 CVE-2021-24024: A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 a A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5.3.7 and below may allow a remote authenticated attacker to read other local users' password in log files.

CVE-2020-6647 [MEDIUM] CWE-79 An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to pe... FG-IR-20-012: An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to pe... An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to perform a cross site scripting attack (XSS) via the name parameter. CVEs: CVE-2020-6647

CVE-2020-9286 [MEDIUM] An improper authorization vulnerability in FortiADC may allow a remote authenticated user with low privileges to perform... FG-IR-20-013: An improper authorization vulnerability in FortiADC may allow a remote authenticated user with low privileges to perform... An improper authorization vulnerability in FortiADC may allow a remote authenticated user with low privileges to perform certain actions such as rebooting the system. CVEs: CVE-2020-9286 CVSS: 6.5 (medium) Affecte

CVE-2019-6699 [MEDIUM] CWE-79 CVE-2019-6699: An improper neutralization of input vulnerability in Fortinet FortiADC 5.3.3 and earlier may allow a An improper neutralization of input vulnerability in Fortinet FortiADC 5.3.3 and earlier may allow an attacker to execute a stored Cross Site Scripting (XSS) via a field in the traffic group interface.

CVE-2018-13374 [MEDIUM] CWE-732 CVE-2018-13374: A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0. A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.