FortiMail - Multiple buffer overflows

Multiple instances of incorrect calculation of buffer size in FortiMail Webmail and Administrative interface may allow an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests...

FortiMail - Memory leak in Webmail

A missing release of memory after its effective lifetime vulnerability CWE-401 in FortiMail Webmail may allow an unauthenticated remote attacker to exhaust available memory via specifically crafted login requests...

FortiMail - Unauthenticated encryption in IBE leads to email plaintext recovery

A missing cryptographic step in FortiMail IBE may allow an unauthenticated attacker who intercepts the encrypted messages to manipulate them in such a way that makes the tampering and the recovery of the plaintexts possible...

FortiMail - Improper cryptographic operations in cookie encryption potentially prone to forgery

The combination of various cryptographic issues in the session management of FortiMail, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges...

FortiMail - Insecure PRNG in password and token generation scheme of IBE authentication

A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of FortiMail Identity Based Encryption service may allow an unauthenticated attacker to infer parts of users authentication tokens and reset their credentials...

FortiMail - SQL Injection vulnerabilities

Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail may allow a non-authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests...

FortiMail - OS Command injection

An improper neutralization of special elementsused in an OS Command vulnerability CWE-78 in FortiMail's administrative interface may allow an authenticated attacker to execute unauthorized commands via specifically crafted HTTP requests...

PT-2021-3853 · Fortinet · Fortimail

Name of the Vulnerable Software and Affected Versions: FortiMail versions prior to 7.0.0 Description: The issue is related to missing cryptographic steps in the Identity-Based Encryption service of FortiMail, which may allow an attacker to compromise the confidentiality of encrypted master keys b...

PT-2021-3854 · Fortinet · Fortimail

Name of the Vulnerable Software and Affected Versions: FortiMail affected versions not specified Description: The issue is related to errors in the code of the pseudorandom number generator in the FortiMail IBE Identity Based Encryption service. This could allow a remote attacker to gain...

PT-2021-3662 · Fortinet · Fortimail

Name of the Vulnerable Software and Affected Versions: FortiMail versions 6.2.0 through 6.2.6 FortiMail versions 6.4.0 through 6.4.4 Description: The issue is related to cryptographic problems in the session management of FortiMail, including the encryption construction of the session cookie. Thi...

The vulnerability of the FortiMail email security system, related to deficiencies in authentication procedures, allows attackers to escalate their privileges.

The vulnerability of the FortiMail email security system is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to enhance their privileges by requesting a password change through the user interface...

FortiMail software-version detection vulnerability

An exposure of sensitive information to an unauthorized actor vulnerability in FortiMail may allow a remote, unauthenticated attacker to obtain potentially sensitive software-version information by reading a JavaScript file...

Vulnerability fixed in Fortimail

A vulnerability has been fixed in Fortimail. An unauthenticated remote malicious party could potentially obtain sensitive software version information by reading a JavaScript file to be read. Fortinet has made updates available to fix the vulnerability fix in FortiMail. For more information see:...

Fortinet FortiMail Detection Consolidation

Consolidation of Fortinet FortiMail detections. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only include"pluginfeedinfo.inc"; if description...

FortiMail Unauthenticated Login Bypass Scanner

This module attempts to detect instances of FortiMail vulnerable against an unauthenticated login bypass CVE-2020-9294. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FortiMail Unauthenticated...

Fortinet FortiMail and FortiVoice Entreprise Authorization Issues Vulnerability

Fortinet FortiMail and FortiVoice Entreprise are both products of the U.S. Fiat Fortinet, Inc. FortiMail is a suite of e-mail security gateway products. FortiMail is an email security gateway product that provides email security and data protection, etc. FortiVoice Entreprise is an enterprise...

CVE-2020-9294

An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user interface...

CVE-2020-9294

An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user interface...

Authentication flaw

An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user interface...

CVE-2020-9294

An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user interface...