- Filter by Date
- Filter by Severity
-
Filter by Affected Product
- All
- 47 FortiWeb
- 10 FortiOS
- 9 FortiManager
- 8 FortiAnalyzer
- 7 FortiADC
- 7 FortiSwitch
- 6 FortiMail
- 5 FortiSandbox
- 5 FortiWAN
- 5 FortiAP
- 5 FortiDDoS
- 5 FortiVoiceEnterprise
- 4 FortiClientWindows
- 4 FortiRecorder
- 3 FortiProxy
- 3 FortiPortal
- 3 FortiAuthenticator
- 3 FortiClientEMS
- 3 FortiClientMac
- 3 FortiAP-W2
- 3 FortiTester
- 3 FortiDB
- 3 AscenLink
- 3 FortiCache
- 3 FortiNDR
- 3 FortiClientAndroid
- 2 FortiSIEM
- 2 FortiAP-S
- 2 FortiDDoS-F
- 2 FortiClientiOS
- 2 FortiTokenIOS
- 2 SSL_VPN
- 1 FortiWLC
- 1 FortiWLM
- 1 FortiDeceptor
- 1 FortiADCManager
- 1 FortiIsolator
- 1 FortiTokenAndroid
- 1 FSSO Windows CA
- 1 FortiWAN-Manager
- 1 FortiWebManager
- 1 Meru Controller
- 1 FSSO (all dist.)
- 1 FortiExplorer Windows
- 1 FortiVoice
- 0 FortiNAC
- 0 FortiSOAR
- 0 FortiAP-U
- 0 FortiClientLinux
- 0 FortiEDR
- 0 Meru AP
- 0 FortiAP-C
- 0 FortiDDoS-CM
- 0 FortiExtender
- 0 FortiSIEMWindowsAgent
- 0 FortiAnalyzer-BigData
- 0 AV Engine
- 0 FSSO Windows DC Agent
- 0 FortiCloud
- 0 FortiFone
- 0 FortiGuard
- 0 FortiOS-6K7K
- 0 FortiSDNConnector
- 0 FortiSwitchManager
- 0 FortiTokenMobileWP
January
(1)
Refine Search
PSIRT Advisories
Monthly PSIRT Advisories
- 2023: Jan
- 2022: Dec , Nov , Sep , Aug , Jul , Jun , May , Apr , Mar , Feb
- 2021: Dec , Nov , Oct , Sep , Aug , Jul , Jun , May , Apr , Mar , Feb , Jan
- 2020: Dec
The following is a list of advisories for issues resolved in Fortinet products. The resolution of such issues is coordinated by the Fortinet Product Security Incident Response Team (PSIRT), a dedicated, global team that manages the receipt, investigation, and public reporting of information about security vulnerabilities and issues related to Fortinet products and services.
For details of how to raise a PSIRT Issue with Fortinet, please see our PSIRT Policy here.
A URL redirection to untrusted site ('Open Redirect') [CWE-601] in FortiWeb may allow an authenticated attacker to use the...
FortiWeb
6.4.1, 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.1.2, 6.1.1, 6.1.0, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0
Dec 07, 2021
Severity
Low
IR Number: FG-IR-21-133
CVE-2021-36191
An URL redirection to untrusted site ('Open Redirect') [CWE-601] vulnerability in FortiWeb may allow an authenticated atta...
FortiWeb
6.4.1, 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0
Dec 07, 2021
Severity
Medium
IR Number: FG-IR-21-168
CVE-2021-43064
Multiple relative path traversal vulnerabilities [CWE-23] in the API of FortiWeb may allow an authenticated attacker to re...
FortiWeb
6.4.1, 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0
Dec 07, 2021
Severity
High
IR Number: FG-IR-21-156
CVE-2021-41026
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiWeb may allow an unauthentic...
Multiple improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] in FortiWeb may all...
FortiWeb
6.4.1, 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.1.2, 6.1.1, 6.1.0, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0
Dec 07, 2021
Severity
Medium
IR Number: FG-IR-21-118
CVE-2021-36188
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiWeb may allow an unauthentic...
FortiWeb
6.4.1, 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0
Dec 07, 2021
Severity
Medium
IR Number: FG-IR-21-122
CVE-2021-43063
A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb may allow an authenticated attacker to execute unauthori...
Multiple stack-based buffer overflows [CWE-121] in the API controllers of FortiWeb may allow an authenticated attacker to ...
FortiWeb
6.4.1, 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0
Dec 07, 2021
Severity
High
IR Number: FG-IR-21-152
CVE-2021-36194
An improper access control vulnerability [CWE-284] in the Report Browse section of FortiWeb's Log & Report may allow an un...
FortiWeb
6.4.1, 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0
Dec 07, 2021
Severity
Medium
IR Number: FG-IR-21-138
CVE-2021-41013
A heap-based buffer overflow [CWE-122] vulnerability in FortiWeb may allow an authenticated attacker to execute arbitrary ...
FortiWeb
6.4.1, 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.16, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0
Dec 07, 2021
Severity
High
IR Number: FG-IR-21-188
CVE-2021-43071
A stack-based buffer overflow [CWE-121] vulnerability in FortiWeb may allow an unauthenticated attacker to overwrite the c...
FortiWeb
6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0
Nov 02, 2021
Severity
High
IR Number: FG-IR-21-119
CVE-2021-36186
An uncontrolled resource consumption vulnerability [CWE-400] in FortiWeb may allow an unauthenticated attacker to cause a ...
FortiWeb
6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.1.2, 6.1.1, 6.1.0, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0
Nov 02, 2021
Severity
Medium
IR Number: FG-IR-21-039
CVE-2021-36187
Multiple stack-based buffer overflow vulnerabilities in FortiWeb CLI interface may allow an authenticated attacker to exec...
FortiWeb
6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0
Sep 07, 2021
Severity
High
IR Number: FG-IR-20-206
CVE-2021-36179
Multiple improper neutralization of special elements vulnerabilities [CWE-89] used in a command in FortiWeb may allow an a...
FortiWeb
6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.4
Sep 07, 2021
Severity
High
IR Number: FG-IR-21-047
CVE-2021-36182
An OS command injection vulnerability in FortiWeb's management interface may allow a remote authenticated administrator to...
FortiWeb
6.4.1, 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0
Aug 18, 2021
Severity
High
IR Number: FG-IR-21-116
CVE-2021-22123