Filter by Date
- 2022
  - 1 09-2022
  - 1 04-2022
  - 4 02-2022
- 2021
  - 18 12-2021
  - 2 11-2021
  - 2 09-2021
  - 1 08-2021
  - 1 06-2021
  - 1 04-2021
  - 1 02-2021
  - 1 01-2021
- 2020
  - 3 03-2020
- 2019
  - 1 07-2019
  - 1 06-2019
- 2018
  - 1 03-2018
Filter by Severity
- 0 Critical
- 19 High
- 18 Medium
- 2 Low
- 0 Informational
Filter by Affected Product
- All
- 39 FortiWeb
- 4 FortiADC
- 3 FortiOS
- 3 FortiManager
- 3 FortiAnalyzer
- 3 FortiDDoS
- 3 FortiVoiceEnterprise
- 2 FortiProxy
- 2 FortiMail
- 2 FortiPortal
- 2 FortiSandbox
- 2 FortiWAN
- 2 FortiAuthenticator
- 2 FortiSwitch
- 2 FortiAP
- 2 FortiRecorder
- 2 FortiDDoS-F
- 2 FortiNDR
- 1 FortiClientWindows
- 1 FortiClientEMS
- 1 FortiSIEM
- 1 FortiWLC
- 1 FortiClientMac
- 1 FortiWLM
- 1 FortiTester
- 1 FortiDeceptor
- 1 FortiIsolator
- 1 FortiADCManager
- 1 AscenLink
- 1 FortiCache
- 1 FortiClientiOS
- 1 FortiWebManager
- 1 FortiClientAndroid
- 1 FortiWAN-Manager
- 1 Meru Controller
- 0 FortiNAC
- 0 FortiSOAR
- 0 FortiAP-S
- 0 FortiAP-U
- 0 FortiAP-W2
- 0 FortiClientLinux
- 0 FortiEDR
- 0 FortiExtender
- 0 FortiSIEMWindowsAgent
- 0 FortiAP-C
- 0 FortiAnalyzer-BigData
- 0 FortiDDoS-CM
- 0 FortiTokenAndroid
- 0 Meru AP
- 0 AV Engine
- 0 FSSO Windows CA
- 0 FSSO Windows DC Agent
- 0 FortiCloud
- 0 FortiDB
- 0 FortiFone
- 0 FortiGuard
- 0 FortiOS-6K7K
- 0 FortiSDNConnector
- 0 FortiSwitchManager
- 0 FortiTokenIOS
- 0 FortiTokenMobileWP

Refine Search

PSIRT Advisories

Monthly PSIRT Advisories

2022: Nov , Sep , Aug , Jul , Jun , May , Apr , Mar , Feb
2021: Dec , Nov , Oct , Sep , Aug , Jul , Jun , May , Apr , Mar , Feb , Jan
2020: Dec

The following is a list of advisories for issues resolved in Fortinet products. The resolution of such issues is coordinated by the Fortinet Product Security Incident Response Team (PSIRT), a dedicated, global team that manages the receipt, investigation, and public reporting of information about security vulnerabilities and issues related to Fortinet products and services.

For details of how to raise a PSIRT Issue with Fortinet, please see our PSIRT Policy here.

FortiWeb - Open redirect in redir handler due to direct input interpolation

An URL redirection to untrusted site ('Open Redirect') [CWE-601] vulnerability in FortiWeb may allow an authenticated atta...

FortiWeb 6.4.1, 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0

Dec 07, 2021 Severity light-circle-logo

Medium IR Number: FG-IR-21-168 CVE-2021-43064

FortiWeb - Path traversal in API controller

Multiple relative path traversal vulnerabilities [CWE-23] in the API of FortiWeb may allow an authenticated attacker to re...

FortiWeb 6.4.1, 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0

Dec 07, 2021 Severity light-circle-logo

High IR Number: FG-IR-21-156 CVE-2021-41026

FortiWeb - Reflected cross-site scripting in SAML login

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiWeb may allow an unauthentic...

FortiWeb 6.4.1, 6.4.0

Dec 07, 2021 Severity light-circle-logo

Medium IR Number: FG-IR-21-139 CVE-2021-41015

FortiWeb - Reflected cross-site scripting in error controllers

Multiple improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] in FortiWeb may all...

FortiWeb 6.4.1, 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.1.2, 6.1.1, 6.1.0, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0

Dec 07, 2021 Severity light-circle-logo

Medium IR Number: FG-IR-21-118 CVE-2021-36188

FortiWeb - Reflected cross-site scripting vulnerability in login handler

An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiWeb may allow an unauthentic...

FortiWeb 6.4.1, 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0

Dec 07, 2021 Severity light-circle-logo

Medium IR Number: FG-IR-21-122 CVE-2021-43063

FortiWeb - Stack-based buffer overflow due to type mismatch

A stack-based buffer overflow vulnerability [CWE-121] in FortiWeb may allow an authenticated attacker to execute unauthori...

FortiWeb 6.4.1, 6.4.0

Dec 07, 2021 Severity light-circle-logo

Medium IR Number: FG-IR-21-134 CVE-2021-41027

FortiWeb - Stack-based buffer overflows in API controllers

Multiple stack-based buffer overflows [CWE-121] in the API controllers of FortiWeb may allow an authenticated attacker to ...

FortiWeb 6.4.1, 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0

Dec 07, 2021 Severity light-circle-logo

High IR Number: FG-IR-21-152 CVE-2021-36194

FortiWeb - Unauthorized user is granted access to the Reports available in the Log & Report section

An improper access control vulnerability [CWE-284] in the Report Browse section of FortiWeb's Log & Report may allow an un...

FortiWeb 6.4.1, 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0

Dec 07, 2021 Severity light-circle-logo

Medium IR Number: FG-IR-21-138 CVE-2021-41013

FortiWeb - heap-based buffer overflow in API v1.0 controller

A heap-based buffer overflow [CWE-122] vulnerability in FortiWeb may allow an authenticated attacker to execute arbitrary ...

FortiWeb 6.4.1, 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.16, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.7, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0

Dec 07, 2021 Severity light-circle-logo

High IR Number: FG-IR-21-188 CVE-2021-43071

FortiWeb - Stack-Based Buffer Overflow vulnerability

A stack-based buffer overflow [CWE-121] vulnerability in FortiWeb may allow an unauthenticated attacker to overwrite the c...

FortiWeb 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0

Nov 02, 2021 Severity light-circle-logo

High IR Number: FG-IR-21-119 CVE-2021-36186

FortiWeb - Uncontrolled resource consumption

An uncontrolled resource consumption vulnerability [CWE-400] in FortiWeb may allow an unauthenticated attacker to cause a ...

FortiWeb 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.1.2, 6.1.1, 6.1.0, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0

Nov 02, 2021 Severity light-circle-logo

Medium IR Number: FG-IR-21-039 CVE-2021-36187

FortiWeb - Multiple stack-based buffer overflow vulnerabilities in CLI command

Multiple stack-based buffer overflow vulnerabilities in FortiWeb CLI interface may allow an authenticated attacker to exec...

FortiWeb 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0

Sep 07, 2021 Severity light-circle-logo

High IR Number: FG-IR-20-206 CVE-2021-36179

FortiWeb - OS Command Injection because of missing input parameter sanitization

Multiple improper neutralization of special elements vulnerabilities [CWE-89] used in a command in FortiWeb may allow an a...

FortiWeb 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.4

Sep 07, 2021 Severity light-circle-logo

High IR Number: FG-IR-21-047 CVE-2021-36182

FortiWeb - OS command injection vulnerability

An OS command injection vulnerability in FortiWeb's management interface may allow a remote authenticated administrator to...

FortiWeb 6.4.1, 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0

Aug 18, 2021 Severity light-circle-logo

High IR Number: FG-IR-21-116 CVE-2021-22123

FortiWeb - OS command injection vulnerability

An OS command injection vulnerability in FortiWeb's management interface may allow a remote authenticated attacker to exec...

FortiWeb 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.1, 6.3.0, 6.2.3, 6.2.2, 6.2.1, 6.2.0

Jun 01, 2021 Severity light-circle-logo

High IR Number: FG-IR-20-120 CVE-2021-22123

1
2
3

1
2
3