Known vulnerabilities in FortiMail 6.4.3

Software: FortiMail
Version: 6.4.3
Software CPE: cpe:2.3:a:fortinet:fortinet_fortimail:*:*:*:*:*:*:*:*
Total vulnerabilities: 27
Public exploits: 3
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting FortiMail version 6.4.3 FortiMail 6.4.3 is affected by 27 vulnerabilities: 6 high, 14 medium, 7 low Critical High Medium Low

Vulnerabilities (27)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU113959 -
CVE-2024-40588
Low
No
No
7.4.4, 7.6.2 12.08.2025 SB2025081298
#VU107316 - Argument Injection or Modification
CVE-2024-56497
CWE-88 Low
No
No
6.4.8, 7.0.7, 7.2.5 09.04.2025 SB2025040982
#VU105618 - Stack-based buffer overflow
CVE-2024-46663
CWE-121 Low
No
No
7.4.4, 7.6.2 12.03.2025 SB2025031204
#VU93513 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2024-6387
CWE-362 High
Public exploit available
No
6.4.9, 7.0.8, 7.2.7, 7.4.3 01.07.2024 SB2024070144
SB2024070145
SB2024070152
and 89 more
#VU84453 - Cross-Site Request Forgery (CSRF)
CVE-2022-27488
CWE-352 Medium
No
No
6.4.7, 7.0.4 15.12.2023 SB2023121510
SB2023121511
SB2023121512
and 2 more
#VU83272 - Improper Authorization
CVE-2023-36633
CWE-285 Medium
No
No
7.0.6, 7.2.3, 7.4.0 20.11.2023 SB2023112013
#VU83269 - Improper Restriction of Excessive Authentication Attempts
CVE-2023-45582
CWE-307 Medium
No
No
6.4.9, 7.0.7, 7.2.5, 7.4.1 20.11.2023 SB2023112012
#VU81947 - Incorrect Authorization
CVE-2023-36556
CWE-863 Medium
No
No
6.4.8, 7.0.6, 7.2.3, 7.4.0 12.10.2023 SB2023101244
#VU68929 - Insufficient Verification of Data Authenticity
CVE-2022-26122
CWE-345 Medium
No
No
6.4.7, 7.0.3, 7.2.0 02.11.2022 SB2022110231
#VU68920 - Improper Access Control
CVE-2022-39945
CWE-284 Low
No
No
7.0.4, 7.2.1 02.11.2022 SB2022110219
#VU67038 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-26114
CWE-79 Medium
No
No
7.0.4, 7.2.0 06.09.2022 SB2022090660
#VU65981 - Use of Externally-Controlled Format String
CVE-2022-22299
CWE-134 Low
No
No
6.4.6, 7.0.3 02.08.2022 SB2022080233
SB2022080234
SB2022080235
and 1 more
#VU61391 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2022-0778
CWE-835 Medium
Public exploit available
No
- 15.03.2022 SB2022031520
SB2022031522
SB2022031611
and 238 more
#VU60933 - Improper input validation
CVE-2021-32586
CWE-20 Medium
No
No
6.0.12, 6.2.8, 6.4.6, 7.0.1 01.03.2022 SB2022030125
#VU60932 - Improper Authentication
CVE-2021-36166
CWE-287 High
No
No
6.0.12, 6.2.8, 6.4.6 01.03.2022 SB2022030125
#VU60216 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-43062
CWE-79 Medium
Public exploit available
No
6.2.8, 6.4.6, 7.0.2 01.02.2022 SB2022020174
#VU58633 - Missing Required Cryptographic Step
CVE-2021-32591
CWE-325 Medium
No
No
- 07.12.2021 SB2021120720
SB2021120721
#VU54791 - Missing Required Cryptographic Step
CVE-2021-26099
CWE-325 Low
No
No
7.0.0 13.07.2021 SB2021071352
#VU54790 - Missing Required Cryptographic Step
CVE-2021-26100
CWE-325 Medium
No
No
7.0.0 13.07.2021 SB2021071352
#VU54728 - Memory corruption
CVE-2021-22129
CWE-119 High
No
No
6.0.11, 6.2.7, 6.4.5 13.07.2021 SB2021071352


Showing elements 1 - 20 out of 27