Filtered by vendor Fortinet
Subscriptions
Filtered by product Fortimail
Subscriptions
Total
33 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-43062 | 1 Fortinet | 1 Fortimail | 2022-03-04 | 6.1 Medium |
| A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the FortiGuard URI protection service. | ||||
| CVE-2020-15933 | 1 Fortinet | 1 Fortimail | 2022-01-12 | 5.3 Medium |
| A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and below FortiMail versions 6.4.1 and 6.4.0 allows attacker to obtain potentially sensitive software-version information via client-side resources inspection. | ||||
| CVE-2021-24015 | 1 Fortinet | 1 Fortimail | 2021-07-14 | 8.8 High |
| An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an authenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. | ||||
| CVE-2021-24013 | 1 Fortinet | 1 Fortimail | 2021-07-13 | 6.5 Medium |
| Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via specifically crafted web requests. | ||||
| CVE-2021-26090 | 1 Fortinet | 1 Fortimail | 2021-07-13 | 7.5 High |
| A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote attacker to exhaust available memory via specifically crafted login requests. | ||||
| CVE-2021-22129 | 1 Fortinet | 1 Fortimail | 2021-07-12 | 8.8 High |
| Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests. | ||||
| CVE-2021-24007 | 1 Fortinet | 1 Fortimail | 2021-07-12 | 9.8 Critical |
| Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. | ||||
| CVE-2019-15707 | 1 Fortinet | 1 Fortimail | 2020-08-24 | 4.9 Medium |
| An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they should not be authorized for. | ||||
| CVE-2019-15712 | 1 Fortinet | 1 Fortimail | 2020-08-24 | 7.2 High |
| An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they should not be authorized for. | ||||
| CVE-2017-7732 | 1 Fortinet | 1 Fortimail | 2017-11-17 | N/A |
| A reflected Cross-Site Scripting (XSS) vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9 customized pre-authentication webmail login page allows attacker to inject arbitrary web script or HTML via crafted HTTP requests. | ||||
| CVE-2017-3125 | 1 Fortinet | 1 Fortimail | 2017-04-18 | N/A |
| An unauthenticated XSS vulnerability with FortiMail 5.0.0 - 5.2.9 and 5.3.0 - 5.3.8 could allow an attacker to execute arbitrary scripts in the security context of the browser of a victim logged in FortiMail, assuming the victim is social engineered into clicking an URL crafted by the attacker. | ||||
| CVE-2015-3293 | 1 Fortinet | 1 Fortimail | 2017-01-03 | N/A |
| FortiMail 5.0.3 through 5.2.3 allows remote administrators to obtain credentials via the "diag debug application httpd" command. | ||||
| CVE-2014-8617 | 1 Fortinet | 1 Fortimail | 2015-11-19 | N/A |
| Cross-site scripting (XSS) vulnerability in the Web Action Quarantine Release feature in the WebGUI in Fortinet FortiMail before 4.3.9, 5.0.x before 5.0.8, 5.1.x before 5.1.5, and 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via the release parameter to module/releasecontrol. | ||||