CVE-2020-15937

An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack XSS via the IPS and WAF logs dashboard...

Cross site scripting

An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack XSS via the IPS and WAF logs dashboard...

CVE-2020-15937

An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack XSS via the IPS and WAF logs dashboard...

CVE-2020-15937

Fortinet FortiGate devices running FortiOS 6.2.x before 6.2.5 and 6.4.x before 6.4.1 are vulnerable to a stored cross‑site scripting (XSS) via the IPS/WAF logs dashboard caused by improper input neutralization. A remote attacker could exploit this via the logs dashboard. The connected documents p...

CVE-2020-15937

An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack XSS via the IPS and WAF logs dashboard...

CVE-2020-15937: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack XSS via the IPS and WAF logs dashboard...

FortiOS Path Traversal Credential Gatherer

Fortinet FortiOS versions 5.4.6 to 5.4.12, 5.6.3 to 5.6.7 and 6.0.0 to 6.0.4 are vulnerable to a path traversal vulnerability within the SSL VPN web portal which allows unauthenticated attackers to download FortiOS system files through specially crafted HTTP requests. This module exploits this...

XSS vulnerability in the Security Profiles comments section in FortiGate Cloud

An improper neutralization of input vulnerability in FortiGate Cloud may allow a remote authenticated attacker to perform a stored cross site scripting attack XSS via the comments section of the Security Profiles...

RZK Fortilogger Code Issue Vulnerability

RZK Fortilogger is a system from RZK Turkey that provides instant status tracking, logging, searching/filtering, reporting, and hotspotting for the FortiGate firewall on Windows systems. A security vulnerability exists in FortiLogger 4.4.2.2, which originates from being affected by arbitrary file...

Vulnerability fixed in FortiGate

A remotely authenticated malicious person is able to view the log entries of SSL VPN events from users in other VDOMs by executing "get vpn ssl monitor" from the command line. The sensitive data includes usernames, user groups and IP addresses. FortiGuard has made updates available to fix the...

Protect

An exposure of sensitive information to an unauthorized actor vulnerability in FortiGate may allow a remote authenticated attacker to read the SSL VPN events log entries of users in other VDOMs by executing "get vpn ssl monitor" from the CLI. The sensitive data includes usernames, user groups, a...

Fortinet Fortigate xss (FG-IR-20-068)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-20-068 advisory. - An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a...

Protect

An improper neutralization of input vulnerability in the FortiGate may allow a remote attacker to perform a stored cross site scripting attack XSS via the IPS and WAF logs dashboard...

Fortinet FortiGate Cross-Site Scripting Vulnerability

Fortinet FortiGate is a suite of network security platforms from the U.S.-based company Fiat Fortinet. The platform provides firewall, antivirus and intrusion prevention IPS, application control, anti-spam, wireless controller and WAN acceleration. FortiGate suffers from a cross-site scripting...

Hackers leak login credentials of vulnerable Fortinet SSL VPNs

By Sudais Asif A hacker using the alias "pumpedkicks" has published a large list of one-line exploits of around 50,000 Fortinet FortiGate IPs. Find out what happened. This is a post from HackRead.com Read the original post: Hackers leak login credentials of vulnerable Fortinet SSL VPNs...

Fortinet FortiOS Information Disclosure Vulnerability (CNVD-2020-62939)

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. A security vulnerability exists i...

CVE-2020-6648

A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an authenticated attacker to obtain sensitive information such as users passwords by connecting to FortiGate CLI and executi...

Fortinet FortiOS Buffer Overflow Vulnerability (CNVD-2020-63948)

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. A buffer error vulnerability exis...

Unspecified Vulnerability in Fortinet FortiGate (CNVD-2021-33534)

Fortinet FortiGate is a suite of network security platforms from the American company Fiat Fortinet. The platform provides firewall, antivirus and intrusion prevention IPS, application control, anti-spam, wireless controller and WAN acceleration. A security vulnerability exists in FortiGate...

FortiOS LCP Message Denial of Service Vulnerability

Fortinet FortiOS is a dedicated security operating system on the FortiGate network security platform. A denial-of-service vulnerability exists in Fortinet FortiOS handling of LCP messages, which can be exploited by a remote attacker to submit a special oversized LCP message request that can crash...