Fortinet FortiNAC (Network Access Control) 9.4.2

CPE Details

Fortinet FortiNAC (Network Access Control) 9.4.2
fortinet
fortinac
9.4.2
2023-02-22
18h14 +00:00
2023-02-23
14h56 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:fortinet:fortinac:9.4.2:*:*:*:*:*:*:*

Informations

Vendor

fortinet

Product

fortinac

Version

9.4.2

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2024-31488 2024-05-14 16h19 +00:00 An improper neutralization of inputs during web page generation vulnerability [CWE-79] in FortiNAC version 9.4.0 through 9.4.4, 9.2.0 through 9.2.8, 9.1.0 through 9.1.10, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 7.2.0 through 7.2.3 may allow a remote authenticated attacker to perform stored and reflected cross site scripting (XSS) attack via crafted HTTP requests.
9
Critique
CVE-2023-26206 2024-02-15 13h59 +00:00 An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9.1.0 - 9.1.10 and 7.2.0 allows an attacker to execute unauthorized code or commands via the name fields observed in the policy audit logs.
6.8
Moyen
CVE-2023-33299 2023-06-23 07h46 +00:00 A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed.
9.8
Critique
CVE-2022-39946 2023-06-13 08h41 +00:00 An access control vulnerability [CWE-284] in FortiNAC version 9.4.2 and below, version 9.2.7 and below, 9.1 all versions, 8.8 all versions, 8.7 all versions, 8.6 all versions, 8.5 all versions may allow a remote attacker authenticated on the administrative interface to perform unauthorized jsp calls via crafted HTTP requests.
7.6
Haute
CVE-2023-22637 2023-05-03 21h27 +00:00 An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions in License Management would permit an authenticated attacker to trigger remote code execution via crafted licenses.
9
Critique
CVE-2023-26203 2023-05-03 21h27 +00:00 A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all versions, 9.1 all versions, 8.8 all versions, 8.7 all versions may allow an authenticated attacker to access to the database via shell commands.
7.8
Haute