RTI vulnerabilities and threats

565 threats

Severity	CVSS	Signals	Threat	Source	Published
High	7.8	KEVEPSS 96%	CVE-2017-8291 · Artifex Ghostscript Type Confusion Vulnerability High7.8KEVEPSS 96%2022-05-24CISA KEV CVE-2017-8291 is a high-severity vulnerability in Artifex Ghostscript that allows bypassing the -dSAFER security option and enables remote command execution. This occurs due to a type confusion issue involving .rsdparams and the "/OutputFile" parameter. The vulnerability has been exploited in the wild. KEVEPSS 96%Vulnerability CWE-704 #exploited-in-the-wild	CISA KEV	2022-05-24
Critical	9.1	KEVEPSS 81%	CVE-2018-13382 · Fortinet FortiOS and FortiProxy Improper Authorization Critical9.1KEVEPSS 81%2022-01-10CISA KEV CVE-2018-13382 is an improper authorization vulnerability in Fortinet FortiOS and FortiProxy SSL VPN web portal that allows an unauthenticated attacker to modify user passwords. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided in the input data. KEVEPSS 81%Vulnerability CWE-285 #exploited-in-the-wild	CISA KEV	2022-01-10
Medium	4.3	KEVEPSS 33%	CVE-2018-13383 · Fortinet FortiOS and FortiProxy Out-of-bounds Write Medium4.3KEVEPSS 33%2022-01-10CISA KEV CVE-2018-13383 is a heap buffer overflow vulnerability in Fortinet FortiOS and FortiProxy that can cause the SSL VPN web service to terminate for logged-in users. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information is provided in the available data. KEVEPSS 33%Vulnerability CWE-787 #exploited-in-the-wild	CISA KEV	2022-01-10
Low	3.3	KEVEPSS 0.9%	CVE-2021-44168 · Fortinet FortiOS Arbitrary File Download Low3.3KEVEPSS 0.9%2021-12-10CISA KEV CVE-2021-44168 is a vulnerability in Fortinet FortiOS where the 'execute restore src-vis' command allows arbitrary file download without integrity checking. This flaw enables attackers to download files from the system arbitrarily. The vulnerability has been exploited in the wild and is considered high severity. KEVEPSS 0.9%Vulnerability CWE-494 #exploited-in-the-wild	CISA KEV	2021-12-10
Medium	6.5	KEVEPSS 18%	CVE-2019-5591 · Fortinet FortiOS Default Configuration Vulnerability Medium6.5KEVEPSS 18%2021-11-03CISA KEV CVE-2019-5591 is a vulnerability in Fortinet FortiOS default configuration that allows an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. It is classified as high severity due to the potential exposure of sensitive data and active exploitation. KEVEPSS 18%Vulnerability CWE-306 #exploited-in-the-wild	CISA KEV	2021-11-03
High	7.5	KEVEPSS 45%	CVE-2020-12812 · Fortinet FortiOS SSL VPN Improper Authentication Vulnerability High7.5KEVEPSS 45%2021-11-03CISA KEV CVE-2020-12812 is an improper authentication vulnerability in Fortinet FortiOS SSL VPN that allows bypassing the second-factor authentication (FortiToken) by altering the case of the username during login. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. KEVEPSS 45%Vulnerability CWE-178 #exploited-in-the-wild	CISA KEV	2021-11-03
Critical	9.1	KEVMirageEPSS 99%	CVE-2018-13379 · Fortinet FortiOS SSL VPN Path Traversal Vulnerability Critical9.1KEVMirageEPSS 99%2021-11-03CISA KEV CVE-2018-13379 is a critical path traversal vulnerability in the Fortinet FortiOS SSL VPN web portal. It allows unauthenticated attackers to download FortiOS system files by sending specially crafted HTTP requests. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. KEVMirageEPSS 99%Vulnerability CWE-22 #exploited-in-the-wild	CISA KEV	2021-11-03

Page 29 of 29