CVE-2019-6695

CVE-2019-6695 affects Fortinet FortiManager VM image packages (versions 6.2.0, 6.0.6 and below). The root cause is lack of root file system integrity checking, which could let an attacker recreate the VM image and implant third‑party programs before boot. Documented impact is image-level tamperin...

CVE-2019-6695

Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-party programs by recreating the image through specific methods...

Fortinet FortiManager VM Input Validation Error Vulnerability

Fortinet FortiManager VM is a centralized network security management platform for virtual machines from Fortinet. The platform can group devices into different management domains ADOM for security deployment and management. An input validation error vulnerability exists in Fortinet FortiManager ...

The vulnerability of the software for centralized device management in Fortinet FortiManager lies in the lack of protection for administrative data, allowing a hacker to obtain the administrator password.

The vulnerability of the Fortinet FortiManager device management software lies in the lack of protection for administrative data. Exploiting this vulnerability allows a malicious actor, operating remotely, to obtain the administrator’s password by intercepting REST API JSON responses...

Fortinet FortiManager and Fortinet FortiAnalyzer Cross-Site Scripting Vulnerabilities (CNVD-2019-16608)

Fortinet FortiManager and Fortinet FortiAnalyzer are both products from Fortinet, Inc. Fortinet FortiManager is a centralized network security management platform. The platform supports centralized management of any number of Fortinet devices, and can be grouped into different management domains...

CVE-2018-13375

An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DHCP request containing malicious scripts in the HOSTNAME parameter. The malicious script code is executed while viewing the logs in...

CVE-2018-13375

An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DHCP request containing malicious scripts in the HOSTNAME parameter. The malicious script code is executed while viewing the logs in...

Design/Logic Flaw

An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DHCP request containing malicious scripts in the HOSTNAME parameter. The malicious script code is executed while viewing the logs in...

CVE-2018-13375

An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DHCP request containing malicious scripts in the HOSTNAME parameter. The malicious script code is executed while viewing the logs in...

CVE-2018-13375

CVE-2018-13375 is an XSS-style vulnerability in Fortinet products where FortiAnalyzer 5.6.0 and earlier and FortiManager 5.6.0 and earlier fail to properly neutralize script-related HTML tags in the DHCP HOSTNAME parameter. An attacker can inject malicious scripts via a DHCP request, and the scri...

CVE-2018-13375

An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DHCP request containing malicious scripts in the HOSTNAME parameter. The malicious script code is executed while viewing the logs in...

PT-2019-3149 · Fortinet · Fortimanager

Name of the Vulnerable Software and Affected Versions: FortiManager VM versions 6.2.0, 6.0.6 and below Description: The issue is due to insufficient input validation in the FortiManager VM application. This could allow a remote attacker to execute arbitrary code or commands. Additionally, the lac...

Fortinet FortiManager Unencrypted Password Vulnerability (FG-IR-18-051)

The version of FortiManager running on the remote device is 5.2.x and prior to 5.2.8 or 5.4.x and prior to 5.4.2. It is, therefore, affected by an information disclosure vulnerability due to a cleartext transmission of sensitive information in the REST API json responses. A user performing a man ...

Design/Logic Flaw

A cleartext transmission of sensitive information vulnerability in Fortinet FortiManager 5.2.0 through 5.2.7, 5.4.0 and 5.4.1 may allow an unauthenticated attacker in a man in the middle position to retrieve the admin password via intercepting REST API JSON responses...

CVE-2018-1360

A cleartext transmission of sensitive information vulnerability in Fortinet FortiManager 5.2.0 through 5.2.7, 5.4.0 and 5.4.1 may allow an unauthenticated attacker in a man in the middle position to retrieve the admin password via intercepting REST API JSON responses...

CVE-2018-1360

A cleartext transmission of sensitive information vulnerability in Fortinet FortiManager 5.2.0 through 5.2.7, 5.4.0 and 5.4.1 may allow an unauthenticated attacker in a man in the middle position to retrieve the admin password via intercepting REST API JSON responses...

CVE-2018-1360

A cleartext transmission of sensitive information vulnerability in Fortinet FortiManager 5.2.0 through 5.2.7, 5.4.0 and 5.4.1 may allow an unauthenticated attacker in a man in the middle position to retrieve the admin password via intercepting REST API JSON responses...

CVE-2018-1360

Fortinet FortiManager 5.2.x (<=5.2.7) and 5.4.x (

CVE-2018-1360

A cleartext transmission of sensitive information vulnerability in Fortinet FortiManager 5.2.0 through 5.2.7, 5.4.0 and 5.4.1 may allow an unauthenticated attacker in a man in the middle position to retrieve the admin password via intercepting REST API JSON responses...

FortiManager Unencrypted Password Vulnerability

A cleartext transmission of sensitive information vulnerability in FortiManager may allow an unauthenticated attacker in a man in the middle position to retrieve the admin password via intercepting REST API JSON responses...