Fortinet Fortiportal

A concurrent execution using shared resource with improper Synchronization vulnerability ('Race Condition') in the customer database interface of FortiPortal before 6.0.6 may allow an authenticated, low-privilege user to bring the underlying database data into an inconsistent state via specific coordination of web requests.

Published: 2021-11-02T17:22:57.000Z
Updated: 2024-10-25T13:48:42.993Z

Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privileged user to induce a denial of service via multiple HTTP requests.

Published: 2021-11-02T18:10:57.000Z
Updated: 2024-10-25T13:47:06.458Z

A memory allocation with excessive size value vulnerability in the license verification function of FortiPortal before 6.0.6 may allow an attacker to perform a denial of service attack via specially crafted license blobs.

Published: 2021-11-02T18:15:44.000Z
Updated: 2024-10-25T13:46:54.266Z

An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow an attacker who controls the producer of XML reports consumed by FortiPortal to trigger a denial of service or read arbitrary files from the underlying file system by means of specifically crafted XML documents.

Published: 2021-11-02T17:35:11.000Z
Updated: 2024-10-25T13:48:33.136Z

The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6.0.6 may allow a remote unauthenticated attacker to predict parts of or the whole newly generated password within a given time frame.

Published: 2022-03-01T18:05:10.000Z
Updated: 2024-10-25T13:35:25.926Z