Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.
| CVE | Vendor | Product | Added | Due | Status |
|---|---|---|---|---|---|
|
CVE-2023-27997 — Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability
Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.
|
Fortinet | FortiOS and FortiProxy SSL-VPN | Jun 13, 2023 | Jul 4, 2023 | Ransomware |
|
CVE-2022-41328 — Fortinet FortiOS Path Traversal Vulnerability
Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.
|
Fortinet | FortiOS | Mar 14, 2023 | Apr 4, 2023 | |
|
CVE-2022-42475 — Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
|
Fortinet | FortiOS | Dec 13, 2022 | Jan 3, 2023 | Ransomware |
|
CVE-2022-40684 — Fortinet Multiple Products Authentication Bypass Vulnerability
Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
|
Fortinet | Multiple Products | Oct 11, 2022 | Nov 1, 2022 | Ransomware |
|
CVE-2018-13374 — Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.
|
Fortinet | FortiOS and FortiADC | Sep 8, 2022 | Sep 29, 2022 | Ransomware |
|
CVE-2018-13382 — Fortinet FortiOS and FortiProxy Improper Authorization
An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.
|
Fortinet | FortiOS and FortiProxy | Jan 10, 2022 | Jul 10, 2022 | Ransomware |
|
CVE-2018-13383 — Fortinet FortiOS and FortiProxy Out-of-bounds Write
A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.
|
Fortinet | FortiOS and FortiProxy | Jan 10, 2022 | Jul 10, 2022 | Ransomware |
|
CVE-2021-44168 — Fortinet FortiOS Arbitrary File Download
Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.
|
Fortinet | FortiOS | Dec 10, 2021 | Dec 24, 2021 | |
|
CVE-2018-13379 — Fortinet FortiOS SSL VPN Path Traversal Vulnerability
Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
|
Fortinet | FortiOS | Nov 3, 2021 | May 3, 2022 | Ransomware |
|
CVE-2019-5591 — Fortinet FortiOS Default Configuration Vulnerability
Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.
|
Fortinet | FortiOS | Nov 3, 2021 | May 3, 2022 | Ransomware |
Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.
FortiOS and FortiProxy SSL-VPN · Jun 13, 2023
Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands.
FortiOS · Mar 14, 2023
Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests.
FortiOS · Dec 13, 2022
Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability that could allow an unauthenticated attacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
Multiple Products · Oct 11, 2022
Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.
FortiOS and FortiADC · Sep 8, 2022
An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password.
FortiOS and FortiProxy · Jan 10, 2022
A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users.
FortiOS and FortiProxy · Jan 10, 2022
Fortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files.
FortiOS · Dec 10, 2021
Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests.
FortiOS · Nov 3, 2021
Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server.
FortiOS · Nov 3, 2021