CVSSv3 Score:
6.7
An OS Command Injection vulnerability [CWE-78] in FortiWeb API may allow an authenticated attacked to execute arbitrary commands via a specialy crafted HTTP request.
Revised on 2026-03-10 00:00:00
CVSSv3 Score:
5.9
A Stack-based Buffer Overflow vulnerability [CWE-121] in FortiWeb may allow a remote authenticated attacker to execute arbitrary code or commands via crafted HTTP requests. Success of the attack is conditioned to bypassing stack protection and ASLR.
Revised on 2026...
Pascal Andrei, CSO at Airbus, knows that the aerospace and defense sector is facing a threat environment that is evolving faster than most organizations can track. From sub-tier suppliers quietly becoming entry points for state-backed attackers, to satellites emerging as targets in an increasingly c...
CVSSv3 Score:
2.5
A NULL Pointer Dereference vulnerability [CWE-476] in FortiWeb may allow an authenticated attacker to crash the HTTP daemon via crafted HTTP requests.
Revised on 2026-03-10 00:00:00
CVSSv3 Score:
4.6
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiSandbox LDAP Server feature may allow an authenticated privileged attacker to execute code via crafted requests.
Revised on 2026-03-10 00:00:00
Organizations invest heavily in advanced cybersecurity technologies such as endpoint detection, identity access management, zero trust architecture, and continuous monitoring. However, a significant number of security incidents still originate from physical security weaknesses rather than purely dig...
CVSSv3 Score:
6.8
An authentication bypass using an alternate path or channel vulnerability [CWE-288] in FortiManager and FortiAnalyzer multifactor authentication may allow an attacker with knowledge of the admins password to bypass multifactor authentication checks via submitting multipl...
CVSSv3 Score:
5.1
An Improper Access Control vulnerability [CWE-284] in FortiSwitchAXFixed may allow an authenticated admin to execute system commands via a specifically crafted SSH config file.
Revised on 2026-03-10 00:00:00
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added three security flaws to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The vulnerability list is as follows -
CVE-2021-22054 (CVSS score: 7.5) - A server-side request forge...
CVSSv3 Score:
7.4
A UNIX symbolic link (Symlink) Following vulnerability [CWE-61] in FortiClientLinux may allow a local and unprivileged user to escalate their privileges to root.
Revised on 2026-03-10 00:00:00
CVSSv3 Score:
6.3
An improper certificate validation [CWE-295] vulnerability in the FortiManager GUI may allow a remote unauthenticated attacker to view confidential information via a man in the middle [MiTM] attack.
Revised on 2026-03-10 00:00:00
Anthropic a décidé d'offrir un accès gratuit à son offre la plus complète, Claude Max 20x, aux développeurs de certains projets open source.
Le post Votre projet open source peut vous offrir Claude Max : êtes-vous éligible ? a été publié sur IT-Connect.
CVSSv3 Score:
3.8
A Cleartext Storage of Sensitive Information vulnerability [CWE-312] in FortiMail, FortiVoice and FortiRecorder debug logs may allow an authenticated malicious administrator to obtain user's secrets via CLI commands.
Revised on 2026-03-10 00:00:00
CVSSv3 Score:
6.5
A use of externally-controlled format string vulnerability [CWE-134] in FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud fazsvcd daemon may allow a remote privileged attacker with admin profile to execute arbitrary code or commands via specially cr...
Panda Technology embraced the Acronis Integrations Technology Ecosystem. By adopting Acronis Cyber Protect Cloud and integrating it with their PSA, RMM, security and identity systems, Panda Technology built a centralized operating environment where key workflows now run automatically. Panda Technolo...
CVSSv3 Score:
7.0
A Stack-based Buffer Overflow vulnerability [CWE-121] in FortiManager fgtupdates service may allow a remote unauthenticated attacker to execute unauthorized commands via crafted requests, if the service is enabled. The success of the attack depends on the ability to bypa...
CVSSv3 Score:
7.7
A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability [CWE-120] in FortiSwitchAXFixed may allow an unauthenticated attacker within the same adjacent network to execute unauthorized code or commands on the device via sending a crafted LLDP...
Many cybercrime investigations end with arrests or indictments that reveal little about the people behind the operations. When authorities do disclose demographic details, the pattern that emerges does not match the common assumption that cyber offenders are mostly very young. Analysis in the Securi...
CVSSv3 Score:
7.3
An Improper Control of Interaction Frequency vulnerability [CWE-799] in FortiWeb may allow a remote unauthenticated attacker to bypass the authentication rate-limit via crafted requests. The success of the attack depends on the attacker's resources and the password targe...
CVSSv3 Score:
6.0
An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability [CWE-88] in FortiDeceptor WEBUI may allow a privileged attacker with super-admin profile and CLI access to delete sensitive files via crafted HTTP requests.
Revised...