CVE-2019-5589: Untrusted Search Path

A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable...

PT-2019-17767

Name of the Vulnerable Software and Affected Versions FortiClient Online Installer versions prior to 6.0.6 Description The issue allows an unauthenticated, remote attacker with control over the directory where FortiClientOnlineInstaller.exe is located to execute arbitrary code on the system. This...

Fortinet FortiClient 6.2.x < 6.2.1 Missing Encryption Of Sensitive Data Vulnerability

The version of Fortinet FortiClient running on the remote host is prior to 6.2.1. It is, therefore, affected by a missing encryption of sensitive data vulnerability. An attacker can access VPN session cookie from an endpoint device running FortiClient. The attacker can steal the cookies only if...

Fortinet FortiClient 6.2.x < 6.2.1 Missing Encryption Of Sensitive Data Vulnerability (macOS)

The version of Fortinet FortiClient Mac running on the remote host is prior to 6.2.1. It is, therefore, affected by a missing encryption of sensitive data vulnerability. An attacker can access VPN session cookie from an endpoint device running FortiClient. The attacker can steal the cookies only ...

Fortinet FortiClient Code Execution Vulnerability

Fortinet FortiClient is a mobile endpoint security solution from Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance and two-factor authentication when connected to a FortiGate firewall appliance. A security vulnerability exists in Fortinet FortiClient...

PT-2019-5735

Name of the Vulnerable Software and Affected Versions FortiClient EMS online installer versions 6.2.1 and below Description The issue is related to an Unsafe Search Path vulnerability in the FortiClient EMS online installer. This vulnerability can be exploited by a local attacker who has control...

PT-2019-5736

Name of the Vulnerable Software and Affected Versions FortiClient for Windows versions 6.2.3 and below Description The issue is related to an Unsafe Search Path vulnerability, which may allow a local attacker to execute arbitrary code on the system. This can be achieved by uploading malicious...

Multiple VPN applications insecurely store session cookies

The Missing Encryption Of Sensitive Data vulnerability in FortiClient may allow an attacker to access VPN session cookie from an endpoint device running FortiClient. The attacker can steal the cookies only if endpoint device has been compromised in such a way that the attacker has access to...

FortiClient MAC Protection DoS

The vulnerability of the FortiClient for MAC protection tool is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to trigger a service failure using specially created files...

Fortinet FortiClient 6.0.1 < 6.0.5 Local DoS (macOS)

The version of Fortinet FortiClient Mac running on the remote host is prior to 6.0.5. It is, therefore, affected by a Denial of Service DoS vulnerability. An improper access control vulnerability in FortiClientMac may allow an attacker to affect the application's performance via modifying the...

Fortinet FortiClient Local Privilege Escalation

The version of Fortinet FortiClient running on the remote host is prior to 6.0.5. It is, therefore, affected by a privilege escalation vulnerability. An unauthenticated, remote attacker can exploit this to gain privileged or administrator access to the system. C Tenable Network Security, Inc...

Fortinet FortiClient NDIS Miniport Driver Null Pointer Dereference

The version of Fortinet FortiClient running on the remote host is prior to 6.0.3. It is, therefore, affected by a NULL pointer dereference flaw due to a failure to utilize necessary NULL checks before doing indirect function calls. An unauthenticated, local attacker can exploit this, via the NDIS...

CVE-2018-9190

A null pointer dereference vulnerability in Fortinet FortiClientWindows 6.0.2 and earlier allows attacker to cause a denial of service via the NDIS miniport driver...

CVE-2018-9190: NULL Pointer Dereference

A null pointer dereference vulnerability in Fortinet FortiClientWindows 6.0.2 and earlier allows attacker to cause a denial of service via the NDIS miniport driver...

PT-2019-6276

Name of the Vulnerable Software and Affected Versions FortiClient for Windows versions 6.0.2 and earlier Description The issue is related to a null pointer dereference vulnerability in the NDIS miniport driver of Fortinet FortiClient for Windows. This vulnerability can be exploited to cause a...

FortiClient NDIS Miniport Driver Null Pointer Dereference

There is a Null pointer dereference in the NDIS Miniport drivers in FortiClient on Windows, which may be leveraged by an unprivileged user to cause a Denial of Service BSOD...

FortiClient local privilege escalation exploit chain

A researcher has disclosed several vulnerabilities against FortiClient for Windows, the combination of these vulnerabilities can turn into an exploit chain, which allows a user to gain system privileges on Microsoft Windows...

Fortinet FortiClient 5.2.3 (Windows 10 x64 Creators) - Local Privilege Escalation Exploit

Exploit for windows platform in category local exploits include "stdafx.h" include include include include pragma comment lib,"psapi" PULONGLONG leakbuffer = PULONGLONGVirtualAllocLPVOID0x000000001a000000, 0x2000, MEMRESERVE | MEMCOMMIT, PAGEREADWRITE; ULONGLONG leakQWORDULONGLONG addr, HANDLE...

Fortinet FortiClient 5.2.3 (Windows 10 x64 Creators) - Local Privilege Escalation

Fortinet FortiClient 5.2.3 Windows 10 x64 Creators - Local Privilege Escalation include "stdafx.h" include include include include pragma comment lib,"psapi" PULONGLONG leakbuffer = PULONGLONGVirtualAllocLPVOID0x000000001a000000, 0x2000, MEMRESERVE | MEMCOMMIT, PAGEREADWRITE; ULONGLONG...

Fortinet FortiClient 5.2.3 (Windows 10 x64 Creators) - Local Privilege Escalation

include "stdafx.h" include include include include pragma comment lib,"psapi" PULONGLONG leakbuffer = PULONGLONGVirtualAllocLPVOID0x000000001a000000, 0x2000, MEMRESERVE | MEMCOMMIT, PAGEREADWRITE; ULONGLONG leakQWORDULONGLONG addr, HANDLE driver memsetLPVOID0x000000001a000000, 0x11, 0x1000;...