Fortinet FortiClient 路径遍历漏洞

Fortinet FortiClient is a structured agent from Fortinet, Inc. It is used to provide protection, compliance, and secure access in a single modular lightweight client. A path traversal vulnerability exists in Fortinet FortiClient that stems from an input validation error when processing a director...

FortiClient (Windows) - Privilege Escalation via directory traversal attack

A relative path traversal vulnerability CWE-23 in FortiClient for Windows may allow a local unprivileged attacker to escalate their privileges to SYSTEM via the named pipe responsible for FortiESNAC service...

Fortinet FortiClient 6.0.x / 6.2.x / 6.4.x < 6.4.7 / 7.x < 7.0.1 Privilege Escalation (FG-IR-21-088)

The version of Fortinet FortiClient running on the remote host is affected by a privilege escalation vulnerability. An unsafe search path vulnerability in FortiClien Windows 7.0.0, 6.4.6 and below, 6.2.x, and 6.0.x may allow an attacker to perform a DLL Hijack attack on affected devices via a...

Fortinet FortiClient 安全漏洞

Fortinet FortiClient is a mobile endpoint security solution from Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to a FortiGate firewall appliance. A security vulnerability exists in Fortinet FortiClient...

FortiClient (Windows) - Arbitrary file write as SYSTEM

An execution with unnecessary privileges vulnerability CWE-250 in FortiClientWindows may allow a local attacker to perform an arbitrary file write on the system...

CVE-2021-43066

A external control of file name or path in Fortinet FortiClientWindows version 7.0.2 and below, version 6.4.6 and below, version 6.2.9 and below, version 6.0.10 and below allows attacker to escalate privilege via the MSI installer...

CVE-2021-44167

An incorrect permission assignment for critical resource vulnerability CWE-732 in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below may allow an unauthenticated attacker to access sensitive information in log files and directories via symbolic links...

CVE-2021-44167

An incorrect permission assignment for critical resource vulnerability CWE-732 in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below may allow an unauthenticated attacker to access sensitive information in log files and directories via symbolic links...

CVE-2021-44167

An incorrect permission assignment for critical resource vulnerability CWE-732 in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below may allow an unauthenticated attacker to access sensitive information in log files and directories via symbolic links...

Design/Logic Flaw

An incorrect permission assignment for critical resource vulnerability CWE-732 in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below may allow an unauthenticated attacker to access sensitive information in log files and directories via symbolic links...

CVE-2021-44167

An incorrect permission assignment for critical resource vulnerability CWE-732 in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below may allow an unauthenticated attacker to access sensitive information in log files and directories via symbolic links...

CVE-2021-44167

The CVE-2021-44167 case concerns FortiClient for Linux with improper permissions (CWE-732) that can allow an unauthenticated user to access sensitive data in log files and directories via symbolic links. The vulnerability affects FortiClient for Linux across multiple older branches (versions 6.0....

CVE-2021-44167

An incorrect permission assignment for critical resource vulnerability CWE-732 in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below may allow an unauthenticated attacker to access sensitive information in log files and directories via symbolic links...

Vulnerability fixed in FortiClient

A vulnerability has been fixed in FortiClient. The vulnerability allows a malicious person with access to the system to execute or delete files with admin rights. The vulnerability is located in the FortiClient MSI installer. Fortinet has released updates to fix the vulnerability. More informatio...

FortiClient - Privilege escalation in FortiClient installer

An external control of file name or path vulnerability CWE-73 in FortiClient Windows may allow an unprivileged attacker to delete or execute files with admin rights via the MSI installer...

Fortinet FortiClient 安全漏洞

Fortinet FortiClient is a mobile endpoint security solution from Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to a FortiGate firewall appliance. A security vulnerability exists in Fortinet FortiClient...

Fortinet FortiClient Privilege escalation in online installer due to incorrect working director (FG-IR-21-238)

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-238 advisory. - A improper initialization in Fortinet FortiClient Windows version 6.0.10 and below, version 6.2.9 and below, version 6.4....

Fortinet FortiClient for Windows权限提升漏洞

Fortinet FortiClient is a mobile endpoint security solution from Fortinet, Inc. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to a FortiGate firewall appliance. executable file in the FortiClient installer...

Vulnerabilities fixed in FortiClient

Vulnerabilities have been fixed in FortiClient for Linux and Windows. The vulnerabilities allow a local malicious agent to to gain access to system data and obtain elevated privileges. Fortinet has released updates to fix the vulnerability. More information can be found on the pages below:...

CVE-2021-22127

An improper input validation vulnerability in FortiClient for Linux 6.4.x before 6.4.3, FortiClient for Linux 6.2.x before 6.2.9 may allow an unauthenticated attacker to execute arbitrary code on the host operating system as root via tricking the user into connecting to a network with a malicious...