cve,link,title,description,vendor,products,score,severity,epss,cisa,article,ransomware,exploited,poc,trended,trended_no_1,published,trended_score
CVE-2021-41026,https://securityvulnerability.io/vulnerability/CVE-2021-41026,,"A relative path traversal in FortiWeb versions 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests.",Fortinet,Fortinet Fortiweb,6.5,MEDIUM,0.0009299999801442027,false,false,false,false,,false,false,2022-04-06T16:00:26.000Z,0
CVE-2021-43071,https://securityvulnerability.io/vulnerability/CVE-2021-43071,,"A heap-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the LogReport API controller.",Fortinet,Fortinet Fortiweb,8.8,HIGH,0.0009599999757483602,false,false,false,false,,false,false,2021-12-09T09:18:03.000Z,0
CVE-2021-36194,https://securityvulnerability.io/vulnerability/CVE-2021-36194,,"Multiple stack-based buffer overflows in the API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted requests.",Fortinet,Fortinet Fortiweb,8.8,HIGH,0.0009599999757483602,false,false,false,false,,false,false,2021-12-09T08:46:46.000Z,0
CVE-2021-41017,https://securityvulnerability.io/vulnerability/CVE-2021-41017,,"Multiple heap-based buffer overflow vulnerabilities in some web API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow a remote authenticated attacker to execute arbitrary code or commands via specifically crafted HTTP requests.",Fortinet,Fortinet Fortiweb,8.8,HIGH,0.0017000000225380063,false,false,false,false,,false,false,2021-12-08T18:51:10.000Z,0
CVE-2021-41025,https://securityvulnerability.io/vulnerability/CVE-2021-41025,,"Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 thorugh 6.0.7, including an instance of concurrent execution using shared resource with improper synchronization and one of authentication bypass by capture-replay, may allow a remote unauthenticated attacker to circumvent the authentication process and authenticate as a legitimate cluster peer.",Fortinet,Fortinet Fortiweb,7.3,HIGH,0.007840000092983246,false,false,false,false,,false,false,2021-12-08T18:46:00.000Z,0
CVE-2021-36195,https://securityvulnerability.io/vulnerability/CVE-2021-36195,,"Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, and 6.1.0 through 6.1.2 may allow an authenticated attacker to execute arbitrary commands on the underlying system shell via specially crafted command arguments.",Fortinet,Fortinet Fortiweb,4.2,MEDIUM,0.0019600000232458115,false,false,false,false,,false,false,2021-12-08T18:14:55.000Z,0
CVE-2021-41013,https://securityvulnerability.io/vulnerability/CVE-2021-41013,,An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Report Browse section of Log & Report may allow an unauthorized and unauthenticated user to access the Log reports via their URLs.,Fortinet,Fortinet Fortiweb,5.3,MEDIUM,0.0008900000248104334,false,false,false,false,,false,false,2021-12-08T13:33:58.000Z,0
CVE-2021-36188,https://securityvulnerability.io/vulnerability/CVE-2021-36188,,"A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted GET parameters in requests to login and error handlers",Fortinet,Fortinet Fortiweb,6.1,MEDIUM,0.0007800000021234155,false,false,false,false,,false,false,2021-12-08T13:24:55.000Z,0
CVE-2021-43063,https://securityvulnerability.io/vulnerability/CVE-2021-43063,,"A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the login webpage.",Fortinet,Fortinet Fortiweb,6.1,MEDIUM,0.002219999907538295,false,false,false,false,,false,false,2021-12-08T13:16:29.000Z,0
CVE-2021-36190,https://securityvulnerability.io/vulnerability/CVE-2021-36190,,"A unintended proxy or intermediary ('confused deputy') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to access protected hosts via crafted HTTP requests.",Fortinet,Fortinet Fortiweb,5.5,MEDIUM,0.0008900000248104334,false,false,false,false,,false,false,2021-12-08T13:11:05.000Z,0
CVE-2021-41014,https://securityvulnerability.io/vulnerability/CVE-2021-41014,,"A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to make the httpsd daemon unresponsive via huge HTTP packets",Fortinet,Fortinet Fortiweb,7.5,HIGH,0.0010999999940395355,false,false,false,false,,false,false,2021-12-08T13:06:15.000Z,0
CVE-2021-36191,https://securityvulnerability.io/vulnerability/CVE-2021-36191,,"A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to use the device as proxy via crafted GET parameters in requests to error handlers",Fortinet,Fortinet Fortiweb,4.1,MEDIUM,0.000539999979082495,false,false,false,false,,false,false,2021-12-08T13:03:35.000Z,0
CVE-2021-41027,https://securityvulnerability.io/vulnerability/CVE-2021-41027,,"A stack-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, allows an authenticated attacker to execute unauthorized code or commands via crafted certificates loaded into the device.",Fortinet,Fortinet Fortiweb,7.3,HIGH,0.0004400000034365803,false,false,false,false,,false,false,2021-12-08T12:55:42.000Z,0
CVE-2021-41015,https://securityvulnerability.io/vulnerability/CVE-2021-41015,,"A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to SAML login handler",Fortinet,Fortinet Fortiweb,6.1,MEDIUM,0.002219999907538295,false,false,false,false,,false,false,2021-12-08T12:39:00.000Z,0
CVE-2021-43064,https://securityvulnerability.io/vulnerability/CVE-2021-43064,,"A url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to use the device as a proxy and reach external or protected hosts via redirection handlers.",Fortinet,Fortinet Fortiweb,4.3,MEDIUM,0.0007800000021234155,false,false,false,false,,false,false,2021-12-08T12:33:18.000Z,0
CVE-2021-36180,https://securityvulnerability.io/vulnerability/CVE-2021-36180,,"Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests.",Fortinet,Fortinet Fortiweb,8.1,HIGH,0.001180000021122396,false,false,false,false,,false,false,2021-12-08T10:46:45.000Z,0
CVE-2021-36186,https://securityvulnerability.io/vulnerability/CVE-2021-36186,,"A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests",Fortinet,Fortinet Fortiweb,8.8,HIGH,0.0025100000202655792,false,false,false,false,,false,false,2021-11-02T18:35:58.000Z,0
CVE-2021-36187,https://securityvulnerability.io/vulnerability/CVE-2021-36187,,"A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to cause a denial of service for webserver daemon via crafted HTTP requests",Fortinet,Fortinet Fortiweb,5.3,MEDIUM,0.0022299999836832285,false,false,false,false,,false,false,2021-11-02T18:32:37.000Z,0
CVE-2021-36182,https://securityvulnerability.io/vulnerability/CVE-2021-36182,,A Improper neutralization of special elements used in a command ('Command Injection') in Fortinet FortiWeb version 6.3.13 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests,Fortinet,Fortinet Fortiweb,8.8,HIGH,0.0013200000394135714,false,false,false,false,,false,false,2021-09-08T10:20:57.000Z,0
CVE-2021-36179,https://securityvulnerability.io/vulnerability/CVE-2021-36179,,"A stack-based buffer overflow in Fortinet FortiWeb version 6.3.14 and below, 6.2.4 and below allows attacker to execute unauthorized code or commands via crafted parameters in CLI command execution",Fortinet,Fortinet Fortiweb,8,HIGH,0.0009800000116229057,false,false,false,false,,false,false,2021-09-08T10:15:48.000Z,0
CVE-2021-22123,https://securityvulnerability.io/vulnerability/CVE-2021-22123,,"An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated attacker to execute arbitrary commands on the system via the SAML server configuration page.",Fortinet,Fortinet Fortiweb,7.6,HIGH,0.021400000900030136,false,false,false,true,true,false,false,2021-06-01T19:58:35.000Z,0
CVE-2020-15942,https://securityvulnerability.io/vulnerability/CVE-2020-15942,,An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote authenticated attacker to read the password used by the FortiWeb scanner to access the device defined in the scan profile.,Fortinet,Fortinet Fortiweb,4.3,MEDIUM,0.0013000000035390258,false,false,false,false,,false,false,2021-04-12T14:11:25.000Z,0
CVE-2021-22122,https://securityvulnerability.io/vulnerability/CVE-2021-22122,,"An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to perform a reflected cross site scripting attack (XSS) by injecting malicious payload in different vulnerable API end-points.",Fortinet,Fortinet Fortiweb,6.1,MEDIUM,0.03523999825119972,false,false,false,false,,false,false,2021-02-08T15:55:39.000Z,0
CVE-2020-29015,https://securityvulnerability.io/vulnerability/CVE-2020-29015,,"A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sending a request with a crafted Authorization header containing a malicious SQL statement.",Fortinet,Fortinet Fortiweb,9.8,CRITICAL,0.0013099999632686377,false,false,false,false,,false,false,2021-01-14T16:07:20.000Z,0
CVE-2020-29018,https://securityvulnerability.io/vulnerability/CVE-2020-29018,,"A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive data via the redir parameter.",Fortinet,Fortinet Fortiweb,8.8,HIGH,0.0023399998899549246,false,false,false,false,,false,false,2021-01-14T16:06:03.000Z,0