Vulnerabilities (CVE)

Filtered by vendor Fortinet Subscribe
Filtered by product Forticlient Endpoint Management Server
Total 6 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2024-21753 1 Fortinet 1 Forticlient Endpoint Management Server 2024-09-25 N/A 6.0 MEDIUM
A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiClientEMS versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.13, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8, 1.2.1 through 1.2.5 allows attacker to perform a denial of service, read or write a limited number of files via specially crafted HTTP requests
CVE-2023-47534 1 Fortinet 1 Forticlient Endpoint Management Server 2024-03-15 N/A 8.8 HIGH
A improper neutralization of formula elements in a csv file in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, 7.0.0 through 7.0.10, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8 allows attacker to execute unauthorized code or commands via specially crafted packets.
CVE-2021-44172 1 Fortinet 1 Forticlient Endpoint Management Server 2024-02-28 N/A 5.3 MEDIUM
An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClientEMS versions 7.0.0 through 7.0.4, 7.0.6 through 7.0.7, in all 6.4 and 6.2 version management interface may allow an unauthenticated attacker to gain information on environment variables such as the EMS installation path.
CVE-2021-24019 1 Fortinet 1 Forticlient Endpoint Management Server 2024-02-28 7.5 HIGH 9.8 CRITICAL
An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks)
CVE-2021-41028 1 Fortinet 2 Forticlient, Forticlient Endpoint Management Server 2024-02-28 5.4 MEDIUM 7.5 HIGH
A combination of a use of hard-coded cryptographic key vulnerability [CWE-321] in FortiClientEMS 7.0.1 and below, 6.4.6 and below and an improper certificate validation vulnerability [CWE-297] in FortiClientWindows, FortiClientLinux and FortiClientMac 7.0.1 and below, 6.4.6 and below may allow an unauthenticated and network adjacent attacker to perform a man-in-the-middle attack between the EMS and the FCT via the telemetry protocol.
CVE-2020-15941 1 Fortinet 1 Forticlient Endpoint Management Server 2024-02-28 5.5 MEDIUM 5.4 MEDIUM
A path traversal vulnerability [CWE-22] in FortiClientEMS versions 6.4.1 and below; 6.2.8 and below may allow an authenticated attacker to inject directory traversal character sequences to add/delete the files of the server via the name parameter of Deployment Packages.