Fortinet Fortimail

An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references (IDOR).

Published: 2022-11-02T00:00:00.000Z
Updated: 2024-10-22T20:52:37.091Z

An improper neutralization of input during web page generation vulnerability [CWE-79] in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated attacker to trigger a cross-site scripting (XSS) attack via sending specially crafted mail messages.

Published: 2022-09-06T15:15:12.000Z
Updated: 2024-10-22T20:54:19.134Z

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the FortiGuard URI protection service.

Published: 2022-02-02T11:08:07.000Z
Updated: 2024-10-22T21:01:19.534Z

An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one administrative account's authentication token by means of the observation of certain system's properties.

Published: 2022-03-01T18:10:10.000Z
Updated: 2024-10-25T13:35:15.853Z

An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unauthenticated attacker to alter the environment of the underlying script interpreter via specifically crafted HTTP requests.

Published: 2022-03-01T18:20:10.000Z
Updated: 2024-10-25T13:35:06.205Z