Fortinet Fortiproxy vulnerabilities

122 known vulnerabilities affecting fortinet/fortiproxy.

Total CVEs
122
CISA KEV
12
actively exploited
Public exploits
7
Exploited in wild
8
Severity breakdown
CRITICAL17HIGH39MEDIUM63LOW3

Vulnerabilities

Page 4 of 7
CVE-2023-29180HIGHCVSS 7.5≥ 1.0.0, ≤ 1.0.7≥ 1.1.0, ≤ 1.1.6+7 more2024-02-22
CVE-2023-29180 [HIGH] CWE-476 CVE-2023-29180: A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6. A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14, 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.3, 7.0.0 through 7.0.10, 2.0.0 through 2.0.12, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to denial of service via specially
cvelistv5nvd
CVE-2023-29179MEDIUMCVSS 6.5≥ 7.0.0, < 7.0.11≥ 7.2.0, < 7.2.5+2 more2024-02-22
CVE-2023-29179 [MEDIUM] CWE-476 CVE-2023-29179: A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6. A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, Fortiproxy version 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 allows attacker to denial of service via specially crafted HTTP requests.
cvelistv5nvd
CVE-2024-23113CRITICALCVSS 9.8KEV≥ 7.0.0, ≤ 7.0.14≥ 7.2.0, ≤ 7.2.8+1 more2024-02-15
CVE-2024-23113 [CRITICAL] CWE-134 CVE-2024-23113: A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 throu
cvelistv5nvd
CVE-2024-21762CRITICALCVSS 9.8KEV≥ 1.0.0, < 2.0.14≥ 7.0.0, < 7.0.15+9 more2024-02-09
CVE-2024-21762 [CRITICAL] CWE-787 CVE-2024-21762: A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 t A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7
cvelistv5nvd
CVE-2023-44250HIGHCVSS 8.8v7.4.0v7.4.1+1 more2024-01-10
CVE-2023-44250 [HIGH] CWE-269 CVE-2023-44250: An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7. An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0 through 7.4.1 allows an authenticated attacker to perform elevated actions via crafted HTTP or HTTPS requests.
cvelistv5nvd
CVE-2023-36639HIGHCVSS 8.8≥ 7.0.0, ≤ 7.0.10≥ 7.2.0, ≤ 7.2.42023-12-13
CVE-2023-36639 [HIGH] CWE-134 CVE-2023-36639: A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7. A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4.0, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiPAM versions 1.0.0 through 1.0.3 allows attacker to execute unauthorized code or commands via s
cvelistv5nvd
CVE-2023-47536MEDIUMCVSS 5.3≥ 2.0.0, ≤ 2.0.12≥ 7.0.0, ≤ 7.0.9+1 more2023-12-13
CVE-2023-47536 [MEDIUM] CWE-284 CVE-2023-47536: An improper access control vulnerability [CWE-284] in FortiOS version 7.2.0, version 7.0.13 and belo An improper access control vulnerability [CWE-284] in FortiOS version 7.2.0, version 7.0.13 and below, version 6.4.14 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below may allow a remote unauthenticated attacker to bypass the firewall deny geolocalisation policy via timing the bypass with a GeoIP dat
cvelistv5nvd
CVE-2023-36641MEDIUMCVSS 6.5≥ 1.0.0, ≤ 1.0.7≥ 1.1.0, ≤ 1.1.6+4 more2023-11-14
CVE-2023-36641 [MEDIUM] CWE-197 CVE-2023-36641: A numeric truncation error in Fortinet FortiProxy version 7.2.0 through 7.2.4, FortiProxy version 7. A numeric truncation error in Fortinet FortiProxy version 7.2.0 through 7.2.4, FortiProxy version 7.0.0 through 7.0.10, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1, all versions, FortiProxy 1.0 all versions, FortiOS version 7.4.0, FortiOS version 7.2.0 through 7.2.5, FortiOS version 7.0.0 through 7.0.12, FortiOS 6.4 all
cvelistv5nvd
CVE-2023-28002MEDIUMCVSS 6.7≥ 2.0.0, ≤ 2.0.13≥ 7.0.0, ≤ 7.0.13+2 more2023-11-14
CVE-2023-28002 [MEDIUM] CWE-354 CVE-2023-28002: An improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2 An improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versions, 6.2 all versions, 6.0 all versions and VMs may allow a local attacker with admin privileges to boot a malicious image on the device and bypass the filesystem integrity check in place.
cvelistv5nvd
CVE-2023-41675MEDIUMCVSS 5.3≥ 7.0.0, ≤ 7.0.8v7.2.0+3 more2023-10-10
CVE-2023-41675 [MEDIUM] CWE-416 CVE-2023-41675: A use after free vulnerability [CWE-416] in FortiOS version 7.2.0 through 7.2.4 and version 7.0.0 th A use after free vulnerability [CWE-416] in FortiOS version 7.2.0 through 7.2.4 and version 7.0.0 through 7.0.10 and FortiProxy version 7.2.0 through 7.2.2 and version 7.0.0 through 7.0.8 may allow an unauthenticated remote attacker to crash the WAD process via multiple crafted packets reaching proxy policies or firewall policies with proxy mode alo
cvelistv5nvd
CVE-2023-29183MEDIUMCVSS 5.4≥ 7.0.0, < 7.0.11≥ 7.2.0, < 7.2.5+2 more2023-09-13
CVE-2023-29183 [MEDIUM] CWE-79 CVE-2023-29183: An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilit An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 and FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14 GUI may allow an authenticated attacker to trigger malicious JavaScript code execution
cvelistv5nvd
CVE-2023-33308CRITICALCVSS 9.8≥ 7.0.0, ≤ 7.0.9v7.2.0+3 more2023-07-26
CVE-2023-33308 [CRITICAL] CWE-121 CVE-2023-33308: A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through 7.0.9 and 7.2.0 through 7.2.2 allows a remote unauthenticated attacker to execute arbitrary code or command via crafted packets reaching proxy policies or firewall policies with proxy mode alon
cvelistv5nvd
CVE-2021-43072MEDIUMCVSS 6.7≥ 1.0.0, < 2.0.9≥ 7.0.0, < 7.0.42023-07-18
CVE-2021-43072 [MEDIUM] CWE-120 CVE-2021-43072: A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiAnalyzer v A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiAnalyzer version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below, version 6.0.11 and below, version 5.6.11 and below, FortiManager version 7.0.2 and below, version 6.4.7 and below, version 6.2.9 and below, version 6.0.11 and below, version 5.6
nvd
CVE-2023-33307MEDIUMCVSS 6.5≥ 7.0.0, ≤ 7.0.9≥ 7.2.0, ≤ 7.2.32023-06-16
CVE-2023-33307 [MEDIUM] CWE-476 CVE-2023-33307: A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2 A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to denial of sslvpn service via specifically crafted request in network parameter.
cvelistv5nvd
CVE-2023-33306MEDIUMCVSS 6.5≥ 7.0.0, < 7.0.10≥ 7.2.0, < 7.2.4+2 more2023-06-16
CVE-2023-33306 [MEDIUM] CWE-476 CVE-2023-33306: A null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11 and before 6.4.13, Forti A null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11 and before 6.4.13, FortiProxy before 7.2.4 and before 7.0.10 allows attacker to denial of sslvpn service via specifically crafted request in bookmark parameter.
cvelistv5nvd
CVE-2023-27997CRITICALCVSS 9.8KEV≥ 1.1.0, ≤ 1.1.6≥ 1.2.0, ≤ 1.2.13+3 more2023-06-13
CVE-2023-27997 [CRITICAL] CWE-122 CVE-2023-27997: A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0 A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to ex
cvelistv5nvd
CVE-2023-22639HIGHCVSS 7.8≥ 1.0.0, ≤ 1.0.7≥ 1.1.0, ≤ 1.1.6+7 more2023-06-13
CVE-2023-22639 [HIGH] CWE-787 CVE-2023-22639: A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.12, FortiOS all versions 6.2, FortiOS all versions 6.0, FortiProxy version 7.2.0 through 7.2.2, FortiProxy version 7.0.0 through 7.0.8, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all v
cvelistv5nvd
CVE-2022-43953HIGHCVSS 7.8≥ 7.0.0, ≤ 7.0.7v7.2.0+2 more2023-06-13
CVE-2022-43953 [HIGH] CWE-134 CVE-2022-43953: A use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiO A use of externally-controlled format string in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS all versions 7.0, FortiOS all versions 6.4, FortiOS all versions 6.2, FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 through 7.0.7 allows attacker to execute unauthorized code or commands via specially crafted commands.
cvelistv5nvd
CVE-2023-29175MEDIUMCVSS 4.8≥ 1.2.0, ≤ 1.2.13≥ 2.0.0, ≤ 2.0.12+2 more2023-06-13
CVE-2023-29175 [MEDIUM] CWE-295 CVE-2023-29175: An improper certificate validation vulnerability [CWE-295] in FortiOS 6.2 all versions, 6.4 all vers An improper certificate validation vulnerability [CWE-295] in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.10, 7.2.0 and FortiProxy 1.2 all versions, 2.0 all versions, 7.0.0 through 7.0.9, 7.2.0 through 7.2.3 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between th
cvelistv5nvd
CVE-2023-33305MEDIUMCVSS 6.5≥ 1.0.0, ≤ 1.0.7≥ 1.1.0, ≤ 1.1.6+4 more2023-06-13
CVE-2023-33305 [MEDIUM] CWE-835 CVE-2023-33305: A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7 A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy version 7.2.0 through 7.2.3, FortiProxy version 7.0.0 through 7.0.9, FortiProxy 2.0 all versions, FortiProxy 1.2 all v
cvelistv5nvd
← Previous4 / 7Next →