Database/Control plane, storage & DevOps
Fortinet FortiOS/FortiProxy: Auth bypass via an alternate path
CVSS 9.8CVE-2022-40684Control plane, storage & DevOpsKnown exploitedcurated
Impact
Auth bypass via an alternate path -> unauthenticated operations on the admin interface
Who can reach it
Network (remote)
What to do
Control-plane: firmware + audit for attacker-added admin accounts and SSH keys
References
Related entries
- Fortinet FortiOS/FortiProxy: Auth bypass via crafted Node.js websocket requestsCVE-2024-55591 · Fortinet FortiOS/FortiProxyCritical
- Fortinet FortiOS: SSL-VPN heap-based buffer overflowCVE-2022-42475 · Fortinet FortiOSCritical
- Linux NFS server (nfsd, nfssvc_decode_writeargs): The NFSv2/v3 write argument decoder has no lower bound on the lengthCVE-2022-49280 · Linux NFS server (nfsd, nfssvc_decode_writeargs)Critical
- AMD SMM Supervisor (AMD-SB-7011): The highest-scored AMD platform CVE in this database at 9.8 critical. A flaw in theCVE-2023-20596 · AMD SMM Supervisor (AMD-SB-7011)Critical
- Fortinet FortiOS / FortiProxy SSL-VPN: A heap-based buffer overflow in the SSL-VPN daemon lets a remoteCVE-2023-27997 · Fortinet FortiOS / FortiProxy SSL-VPNCritical
- Progress MOVEit Transfer: Unauthenticated SQL injection into the web appCVE-2023-34362 · Progress MOVEit TransferCritical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.