Fortinet FortiNAC (Network Access Control) 9.4.2

CPE Details

Fortinet FortiNAC (Network Access Control) 9.4.2
fortinet
fortinac
9.4.2
2023-02-22
18h14 +00:00
2023-02-23
14h56 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:fortinet:fortinac:9.4.2:*:*:*:*:*:*:*

Informations

Vendor

fortinet

Product

fortinac

Version

9.4.2

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2024-31488 2024-05-14 16h19 +00:00 An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 7.2.0 through 7.2.3 may allow a remote authenticated attacker to perform stored and reflected cross site scripting (XSS) attack via crafted HTTP requests.
9
Critical
CVE-2023-26206 2024-02-15 13h59 +00:00 An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9.1.0 - 9.1.10 and 7.2.0 allows an attacker to execute unauthorized code or commands via the name fields observed in the policy audit logs.
6.8
Medium
CVE-2023-33299 2023-06-23 07h46 +00:00 A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed.
9.8
Critical
CVE-2022-39946 2023-06-13 08h41 +00:00 An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8.6 all versions, 8.5 all versions may allow a remote attacker authenticated on the administrative interface to perform unauthorized jsp calls via crafted HTTP requests.
7.6
High
CVE-2023-22637 2023-05-03 21h27 +00:00 An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in License Management would permit an authenticated attacker to trigger remote code execution via crafted licenses.
9
Critical
CVE-2023-26203 2023-05-03 21h27 +00:00 A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions may allow an authenticated attacker to access to the database via shell commands.
7.8
High