Known vulnerabilities in FortiNAC 8.7.2

Vendor: Fortinet, Inc
Software: FortiNAC
Version: 8.7.2
Software CPE: cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*
Website: https://www.fortinet.com/
Total vulnerabilities: 24
Public exploits: 2
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.4

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting FortiNAC version 8.7.2 FortiNAC 8.7.2 is affected by 24 vulnerabilities: 3 critical, 8 medium, 13 low Critical High Medium Low

Vulnerabilities (24)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU91785 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-31488		 CWE-79 Low
No
No
 9.4.5 11.06.2024 SB20240611285
#VU84867 - Improper Authentication
CVE-2022-45860		 CWE-287 Medium
No
No
 9.4.3 29.12.2023 SB2023050357
#VU84866 - Use of Hard-coded Credentials
CVE-2023-26203		 CWE-798 Low
No
No
 9.4.3 29.12.2023 SB2023050356
#VU84865 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-22637		 CWE-79 Low
No
No
 9.4.3 29.12.2023 SB2023050355
#VU77670 - Deserialization of Untrusted Data
CVE-2023-33299		 CWE-502 Critical
No
No
 9.1.10, 9.2.8, 9.4.3 23.06.2023 SB2023062334
#VU77198 - Resource Management Errors
CVE-2023-22633		 CWE-399 Medium
No
No
 9.1.9, 9.2.7, 9.4.2 13.06.2023 SB2023061328
#VU77197 - Improper Access Control
CVE-2022-39946		 CWE-284 Medium
No
No
 9.2.8, 9.4.3 13.06.2023 SB2023061327
#VU75739 - Insufficiently Protected Credentials
CVE-2022-45859		 CWE-522 Low
No
No
 9.2.7, 9.4.2 04.05.2023 SB2023050454
#VU75738 - Use of a Broken or Risky Cryptographic Algorithm
CVE-2022-45858		 CWE-327 Medium
No
No
 9.2.7, 9.4.2 04.05.2023 SB2023050454
#VU75737 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2022-43950		 CWE-601 Low
No
No
 9.4.2 04.05.2023 SB2023050445
#VU74978 - Missing Authorization
CVE-2022-43951		 CWE-862 Medium
No
No
 9.4.2 11.04.2023 SB2023041197
#VU73211 - Improper Privilege Management
CVE-2022-39953		 CWE-269 Low
No
No
 9.1.9, 9.2.7, 9.4.2 09.03.2023 SB2023030935
#VU73210 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-40676		 CWE-79 Low
No
No
 9.1.9, 9.2.6, 9.4.1 09.03.2023 SB2023030934
#VU72373 - External Control of File Name or Path
CVE-2022-39952		 CWE-73 Critical
Public exploit available
No
 9.1.8, 9.2.6, 9.4.1 19.02.2023 SB2023021902
#VU72372 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2022-40677		 CWE-78 Low
No
No
 9.1.8, 9.2.6, 9.4.1 19.02.2023 SB2023021902
#VU72371 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-38376		 CWE-79 Low
No
No
 9.4.2 19.02.2023 SB2023021904
#VU72370 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-22638		 CWE-79 Low
No
No
 9.4.2 19.02.2023 SB2023021904
#VU72369 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2022-39954		 CWE-611 Medium
No
No
 9.4.2 19.02.2023 SB2023021904
#VU72368 - Cryptographic Issues
CVE-2022-40675		 CWE-310 Medium
No
No
 9.4.2 19.02.2023 SB2023021904
#VU72367 - Insufficiently Protected Credentials
CVE-2022-40678		 CWE-522 Low
No
No
 9.1.8, 9.2.6, 9.4.1 19.02.2023 SB2023021902


Showing elements 1 - 20 out of 24