Latest fortinet fortimail Vulnerabilities

● CVE-2022-27488
A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7, 6.0.x, FortiMail version ...
Fortinet Fortiai=1.1.0
Fortinet Fortiai=1.5.3
Fortinet FortiMail>=6.0.0<=6.0.12
Fortinet FortiMail>=6.2.0<=6.2.9
Fortinet FortiMail>=6.4.0<=6.4.6
Fortinet FortiMail>=7.0.0<=7.0.3
and 12 more
● CVE-2023-36633
An improper authorization vulnerability [CWE-285] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to see and modify the title of address book folders...
Fortinet FortiMail>=6.0.0<7.0.6
Fortinet FortiMail>=7.2.0<7.2.3
● CVE-2023-45582
An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may allow an unauthenticated...
Fortinet FortiMail>=6.2.0<=6.2.9
Fortinet FortiMail>=6.4.0<=6.4.8
Fortinet FortiMail>=7.0.0<=7.0.6
Fortinet FortiMail>=7.2.0<=7.2.4
Fortinet FortiMail=7.4.0
● CVE-2023-36637
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiMail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated attacker to inject HTML tags in ...
Fortinet FortiMail>=7.0.1<=7.0.5
Fortinet FortiMail=7.2.0
Fortinet FortiMail=7.2.1
Fortinet FortiMail=7.2.2
● CVE-2023-36556
An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an authenticated attacker to login on other user...
Fortinet FortiMail>=6.0.0<=6.0.12
Fortinet FortiMail>=6.2.0<=6.2.9
Fortinet FortiMail>=6.4.0<=6.4.7
Fortinet FortiMail>=7.0.0<=7.0.5
Fortinet FortiMail=7.2.0
Fortinet FortiMail=7.2.1
and 1 more
● CVE-2022-29056
A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 through 6.2.4 and before 6.0.9 allows a remote unauthenticated at...
Fortinet FortiMail>=6.0.0<6.0.10
Fortinet FortiMail>=6.2.1<6.2.5
Fortinet FortiMail=6.4.0
● CVE-2022-39945
An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a spe...
Fortinet FortiMail>=6.0.0<=6.0.12
Fortinet FortiMail>=6.2.0<=6.2.9
Fortinet FortiMail>=6.4.0<=6.4.7
Fortinet FortiMail>=7.0.0<=7.0.3
Fortinet FortiMail=7.2.0
● CVE-2022-26122
An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and version 6.4.274 and below may allow an attacker...
Fortinet Antivirus Engine=0.4.23
Fortinet Antivirus Engine=2.0.49
Fortinet Antivirus Engine=2.0.60
Fortinet Antivirus Engine=4.4.54
Fortinet Antivirus Engine=6.33
Fortinet Antivirus Engine=6.137
and 18 more
● CVE-2022-26114
An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated attacker to trigger a cross-site scripting (...
Fortinet FortiMail<7.2.0
● CVE-2022-22299
A format string vulnerability [CWE-134] in the command line interpreter of FortiADC version 6.0.0 through 6.0.4, FortiADC version 6.1.0 through 6.1.5, FortiADC version 6.2.0 through 6.2.1, FortiProxy ...
Fortinet FortiADC>=6.0.0<=6.0.4
Fortinet FortiADC>=6.1.0<=6.1.6
Fortinet FortiADC=6.2.0
Fortinet FortiADC=6.2.1
Fortinet FortiMail>=6.4.0<=6.4.5
Fortinet FortiMail>=7.0.0<=7.0.2
and 14 more
● CVE-2021-32586
An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unauthenticated attacker to alter the environment of the underlying script interprete...
Fortinet FortiMail<=5.4.12
Fortinet FortiMail>=6.0.0<6.0.12
Fortinet FortiMail>=6.2.0<6.2.8
Fortinet FortiMail>=6.4.0<6.4.6
Fortinet FortiMail=7.0.0
● CVE-2021-36166
An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication token by means of the observation of cer...
Fortinet FortiMail<=5.4.12
Fortinet FortiMail>=6.0.0<6.0.12
Fortinet FortiMail>=6.2.0<6.2.8
Fortinet FortiMail>=6.4.0<6.4.6
Fortinet FortiMail=7.0.0
● CVE-2021-43062
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 a...
Fortinet FortiMail>=6.2.0<6.2.8
Fortinet FortiMail>=6.4.0<6.4.6
Fortinet FortiMail>=7.0.0<7.0.2
● CVE-2020-15933
A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and below FortiMail versions 6.4.1 and 6.4.0 allows attacker to ob...
Fortinet FortiMail<=6.0.9
Fortinet FortiMail=6.2.0
Fortinet FortiMail=6.2.1
Fortinet FortiMail=6.2.2
Fortinet FortiMail=6.2.3
Fortinet FortiMail=6.2.4
and 2 more
● CVE-2021-32591
A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0....
Fortinet FortiADC>=5.0.0<=5.4.4
Fortinet FortiADC>=6.0.0<=6.0.3
Fortinet FortiADC>=6.1.0<=6.1.3
Fortinet FortiADC=6.2.0
Fortinet FortiADC=6.2.1
Fortinet FortiMail
and 16 more
● CVE-2021-42757
A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specia...
Fortinet FortiADC>=5.0.0<=6.1.5
Fortinet FortiADC>=6.2.0<=6.2.2
Fortinet FortiAnalyzer>=6.0.0<=6.4.7
Fortinet FortiAnalyzer>=7.0.0<=7.0.2
Fortinet FortiMail>=5.4.0<=6.2.7
Fortinet FortiMail>=6.4.0<=6.4.6
and 26 more
● CVE-2021-26095
The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may all...
Fortinet FortiMail>=6.2.0<=6.2.6
Fortinet FortiMail>=6.4.0<6.4.5
● CVE-2021-24015
An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an authenticated attacker to execute unauthorized...
Fortinet FortiMail>=5.4.0<=5.4.12
Fortinet FortiMail>=6.0.0<6.0.11
Fortinet FortiMail>=6.2.0<6.2.7
Fortinet FortiMail>=6.4.0<6.4.4
● CVE-2021-24013
Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via specifically crafted web requests.
Fortinet FortiMail>=5.4.0<=5.4.12
Fortinet FortiMail>=6.0.0<6.0.11
Fortinet FortiMail>=6.2.0<6.2.7
Fortinet FortiMail>=6.4.0<6.4.4
● CVE-2021-26090
A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote attacker to exhaust a...
Fortinet FortiMail>=6.2.0<=6.2.6
Fortinet FortiMail>=6.4.0<6.4.5
● CVE-2021-26099
Missing cryptographic steps in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an attacker who comes in possession of the encrypted master keys to compromise their confidenti...
Fortinet FortiMail>=5.0<7.0.0
● CVE-2021-24007
Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to execute unauthorized code or commands via speci...
Fortinet FortiMail<=5.4.12
Fortinet FortiMail>=5.6.1<6.0.11
Fortinet FortiMail>=6.2.0<6.2.7
Fortinet FortiMail>=6.4.0<6.4.4
● CVE-2021-26100
A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an unauthenticated attacker who intercepts the encrypted messages to manipulate them in such a...
Fortinet FortiMail<7.0.0
● CVE-2021-24020
A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed UR...
Fortinet FortiMail>=6.2.0<=6.2.7
Fortinet FortiMail>=6.4.0<6.4.5
● CVE-2020-9294
An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a le...
Fortinet FortiMail<=5.4.10
Fortinet FortiMail>=6.0.0<=6.0.7
Fortinet FortiMail>=6.2.0<=6.2.2
Fortinet FortiVoice>=6.0.0<=6.0.1
Fortinet FortiVoice>=6.0.0<=6.0.1
● CVE-2019-15712
An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they should not be authorized for.
Fortinet FortiMail<=5.4.10
Fortinet FortiMail>=6.0.0<=6.0.6
Fortinet FortiMail=6.2.0
● CVE-2019-15707
An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they should not be authorize...
Fortinet FortiMail<=5.4.10
Fortinet FortiMail>=6.0.0<=6.0.6
Fortinet FortiMail=6.2.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203