Product:

Fortimail

(Fortinet)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 33
Date Id Summary Products Score Patch Annotated
2021-07-09 CVE-2021-24020 A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed URLs by appending further data which allows bypass of signature verification. Fortimail 9.8
2021-07-09 CVE-2021-26100 A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an unauthenticated attacker who intercepts the encrypted messages to manipulate them in such a way that makes the tampering and the recovery of the plaintexts possible. Fortimail 7.5
2021-07-12 CVE-2021-26099 Missing cryptographic steps in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an attacker who comes in possession of the encrypted master keys to compromise their confidentiality by observing a few invariant properties of the ciphertext. Fortimail 4.9
2021-07-12 CVE-2021-26090 A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote attacker to exhaust available memory via specifically crafted login requests. Fortimail 7.5
2021-07-12 CVE-2021-24013 Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via specifically crafted web requests. Fortimail 6.5
2021-07-12 CVE-2021-24015 An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an authenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. Fortimail 8.8
2021-07-20 CVE-2021-26095 The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges. Fortimail 8.8
2021-12-08 CVE-2021-42757 A buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0 through 7.0.2, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments. Fortiadc, Fortianalyzer, Fortimail, Fortimanager, Fortindr, Fortios, Fortios\-6k7k, Fortiportal, Fortiproxy, Fortirecorder_firmware, Fortiswitch, Fortivoice, Fortiweb 6.7
2021-12-08 CVE-2021-32591 A missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox before 4.0.1, FortiWeb before 6.3.12, FortiADC before 6.2.1, FortiMail 7.0.1 and earlier may allow an attacker in possession of the password store to compromise the confidentiality of the encrypted secrets. Fortiadc, Fortimail, Fortisandbox, Fortiweb 5.3
2022-01-05 CVE-2020-15933 A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and below FortiMail versions 6.4.1 and 6.4.0 allows attacker to obtain potentially sensitive software-version information via client-side resources inspection. Fortimail 5.3