Fortinet Fortiwlm vulnerabilities
23 known vulnerabilities affecting fortinet/fortiwlm.
Total CVEs
23
CISA KEV
0
Public exploits
2
Exploited in wild
1
Severity breakdown
CRITICAL8HIGH11MEDIUM4
Vulnerabilities
Page 1 of 2
CVE-2023-34993P1CRITICALCVSS 9.8ExploitedPoC≥ 8.5.0, ≤ 8.5.4≥ 8.6.0, ≤ 8.6.52023-10-10
CVE-2023-34993 [CRITICAL] CWE-78 CVE-2023-34993: A improper neutralization of special elements used in an os command ('os command injection') in Fort
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
nvd
CVE-2023-34990P1CRITICALCVSS 9.8PoC≥ 8.5.0, < 8.5.5≥ 8.6.0, < 8.6.6+2 more2024-12-18
CVE-2023-34990 [CRITICAL] CWE-23 CVE-2023-34990: A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 a
A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specially crafted web requests.
nvd
CVE-2023-34991P2CRITICALCVSS 9.8≥ 8.5.0, ≤ 8.5.4≥ 8.6.0, ≤ 8.6.5+9 more2023-11-14
CVE-2023-34991 [CRITICAL] CWE-89 CVE-2023-34991: A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet F
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.0 through 8.4.2 and 8.3.0 through 8.3.2 and 8.2.2 allows attacker to execute unauthorized code or commands via a crafted http request.
nvd
CVE-2023-36549P2CRITICALCVSS 9.8≥ 8.5.0, ≤ 8.5.4≥ 8.6.0, ≤ 8.6.52023-10-10
CVE-2023-36549 [CRITICAL] CWE-78 CVE-2023-36549: A improper neutralization of special elements used in an os command ('os command injection') in Fort
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
nvd
CVE-2023-36547P2CRITICALCVSS 9.8≥ 8.5.0, ≤ 8.5.4≥ 8.6.0, ≤ 8.6.52023-10-10
CVE-2023-36547 [CRITICAL] CWE-78 CVE-2023-36547: A improper neutralization of special elements used in an os command ('os command injection') in Fort
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
nvd
CVE-2023-36548P2CRITICALCVSS 9.8≥ 8.5.0, ≤ 8.5.4≥ 8.6.0, ≤ 8.6.52023-10-10
CVE-2023-36548 [CRITICAL] CWE-78 CVE-2023-36548: A improper neutralization of special elements used in an os command ('os command injection') in Fort
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
nvd
CVE-2023-36550P2CRITICALCVSS 9.8≥ 8.5.0, ≤ 8.5.4≥ 8.6.0, ≤ 8.6.52023-10-10
CVE-2023-36550 [CRITICAL] CWE-78 CVE-2023-36550: A improper neutralization of special elements used in an os command ('os command injection') in Fort
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
nvd
CVE-2023-48782P2HIGHCVSS 8.8≥ 8.6.0, ≤ 8.6.52023-12-13
CVE-2023-48782 [HIGH] CWE-78 CVE-2023-48782: A improper neutralization of special elements used in an os command ('os command injection') in Fort
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters
nvd
CVE-2023-34986P2HIGHCVSS 8.8≥ 8.5.0, ≤ 8.5.4≥ 8.6.0, ≤ 8.6.52023-10-10
CVE-2023-34986 [HIGH] CWE-78 CVE-2023-34986: A improper neutralization of special elements used in an os command ('os command injection') in Fort
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters.
nvd
CVE-2023-34988P2HIGHCVSS 8.8≥ 8.5.0, ≤ 8.5.4≥ 8.6.0, ≤ 8.6.52023-10-10
CVE-2023-34988 [HIGH] CWE-78 CVE-2023-34988: A improper neutralization of special elements used in an os command ('os command injection') in Fort
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters.
nvd
CVE-2023-34989P2HIGHCVSS 8.8≥ 8.5.0, ≤ 8.5.4≥ 8.6.0, ≤ 8.6.52023-10-10
CVE-2023-34989 [HIGH] CWE-78 CVE-2023-34989: A improper neutralization of special elements used in an os command ('os command injection') in Fort
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters.
nvd
CVE-2023-34987P2HIGHCVSS 8.8≥ 8.5.0, ≤ 8.5.4≥ 8.6.0, ≤ 8.6.52023-10-10
CVE-2023-34987 [HIGH] CWE-78 CVE-2023-34987: A improper neutralization of special elements used in an os command ('os command injection') in Fort
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters.
nvd
CVE-2023-34985P2HIGHCVSS 8.8≥ 8.5.0, ≤ 8.5.4≥ 8.6.0, ≤ 8.6.52023-10-10
CVE-2023-34985 [HIGH] CWE-78 CVE-2023-34985: A improper neutralization of special elements used in an os command ('os command injection') in Fort
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters.
nvd
CVE-2017-7336P2CRITICALCVSS 9.8≤ 8.3.02017-07-22
CVE-2017-7336 [CRITICAL] CWE-798 CVE-2017-7336: A hard-coded account named 'upgrade' in Fortinet FortiWLM 8.3.0 and lower versions allows a remote a
A hard-coded account named 'upgrade' in Fortinet FortiWLM 8.3.0 and lower versions allows a remote attacker to log-in and execute commands with 'upgrade' account privileges.
nvd
CVE-2021-36185P2HIGHCVSS 8.8≥ 8.2.2, ≤ 8.6.12021-11-02
CVE-2021-36185 [HIGH] CWE-78 CVE-2021-36185: A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fort
A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.
nvd
CVE-2021-43075P2HIGHCVSS 8.8≤ 8.3.2≥ 8.4.0, ≤ 8.4.2+2 more2022-03-01
CVE-2021-43075 [HIGH] CWE-78 CVE-2021-43075: A improper neutralization of special elements used in an os command ('os command injection') in Fort
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the alarm dashboard and controller config handlers.
nvd
CVE-2021-43077P3HIGHCVSS 8.8≤ 8.3.2≥ 8.4.0, ≤ 8.4.2+2 more2022-03-01
CVE-2021-43077 [HIGH] CWE-89 CVE-2021-43077: A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet F
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the AP monitor handlers.
nvd
CVE-2021-42760P3HIGHCVSS 8.8≤ 8.6.12021-12-08
CVE-2021-42760 [HIGH] CWE-89 CVE-2021-42760: A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet F
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose sensitive information from DB tables via crafted requests.
nvd
CVE-2023-42783P3HIGHCVSS 7.5≥ 8.5.0, ≤ 8.5.4≥ 8.6.0, ≤ 8.6.6+9 more2023-11-14
CVE-2023-42783 [HIGH] CWE-23 CVE-2023-42783: A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 a
A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.2 through 8.4.0 and 8.3.2 through 8.3.0 and 8.2.2 allows attacker to read arbitrary files via crafted http requests.
nvd
CVE-2021-43070P3MEDIUMCVSS 6.5≥ 8.3.0, ≤ 8.3.3≥ 8.4.0, ≤ 8.4.2+3 more2022-03-02
CVE-2021-43070 [MEDIUM] CWE-22 CVE-2021-43070: Multiple relative path traversal vulnerabilities [CWE-23] in FortiWLM management interface 8.6.2 and
Multiple relative path traversal vulnerabilities [CWE-23] in FortiWLM management interface 8.6.2 and below, 8.5.2 and below, 8.4.2 and below, 8.3.3 and below, 8.2.2 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests.
nvd
1 / 2Next →