CVE-2024-23671

A improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4 allows attacker to execute unauthorized code or commands via crafted HTTP requests...

CVE-2023-47541

Fortinet FortiSandbox is affected by CVE-2023-47541, a path traversal flaw caused by improper limitation of a pathname to a restricted directory that allows a local attacker to execute unauthorized code or commands via the CLI. Affected FortiSandbox versions include 2.0.0–2.0.3, 2.1.0–2.1.3, 2.2....

CVE-2024-23671

CVE-2024-23671 describes a path traversal vulnerability in Fortinet FortiSandbox versions 4.0.0–4.0.4, 4.2.0–4.2.6, and 4.4.0–4.4.3 that allows an attacker to execute unauthorized code or commands via crafted HTTP requests. The root cause is improper limitation of a pathname to a restricted direc...

CVE-2023-47541

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0 all versions, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions,...

CVE-2023-45590

Fortinet FortiClientLinux contains an improper control of code generation (CWE-94) that can lead to remote code execution when a user visits a malicious website. Affected versions include FortiClientLinux 7.0.3–7.0.4, 7.0.6–7.0.10, and 7.2.0. Fortinet’s advisories and vendor-sec patches recommend...

CVE-2024-23662

An exposure of sensitive information to an unauthorized actor in Fortinet FortiOS at least version at least 7.4.0 through 7.4.1 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.15 and 6.4.0 through 6.4.15 allows attacker to information disclosure via HTTP requests...

CVE-2024-23662

An exposure of sensitive information to an unauthorized actor in Fortinet FortiOS at least version at least 7.4.0 through 7.4.1 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.15 and 6.4.0 through 6.4.15 allows attacker to information disclosure via HTTP requests...

CVE-2024-23662

CVE-2024-23662 is an information-disclosure vulnerability in Fortinet FortiOS that affects FortiOS versions 6.4.0–6.4.15, 7.0.0–7.0.15, 7.2.0–7.2.5, and 7.4.0–7.4.1, enabling an unauthenticated attacker to access sensitive data via HTTP requests. Connected sources provide concrete version ranges ...

Fortinet Releases Security Updates for Multiple Products

Fortinet released security updates to address vulnerabilities in multiple products, including OS and FortiProxy. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following advisories and...

Fortinet FortiProxy 安全漏洞

Fortinet FortiProxy is a secure network proxy from Fortinet that protects employees from cyberattacks by combining a variety of detection technologies such as Web filtering, DNS filtering, DLP, anti-virus, intrusion prevention, and advanced threat protection.FortiProxy helps reduce bandwidth...

Fortinet FortiManager 安全漏洞

Fortinet FortiManager is a centralized management appliance that provides a comprehensive network security management solution. A security vulnerability exists in Fortinet FortiManager, which can be exploited by a local attacker to submit a special template request that can be used to execute...

Fortinet FortiOS 格式化字符串错误漏洞

Fortinet FortiOS is a set of security operating system dedicated to the FortiGate network security platform from the American company Fiat Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering, and antispam security features. The Fortinet FortiOS is...

Fortinet FortiSandbox 路径遍历漏洞

Fortinet FortiSandbox is an APT Advanced Persistent Threat protection appliance from Fortinet. The appliance offers dual sandboxing technology, a dynamic threat intelligence system, real-time control panel and reporting, and more. A path traversal vulnerability exists in Fortinet FortiSandbox...

OS command injection on endpoint

...

PT-2024-3041 · Fortinet · Fortisandbox

Name of the Vulnerable Software and Affected Versions: Fortinet FortiSandbox versions 4.0.0 through 4.0.4 Fortinet FortiSandbox versions 4.2.0 through 4.2.6 Fortinet FortiSandbox versions 4.4.0 through 4.4.3 Description: The issue is related to an improper limitation of a pathname to a restricted...

Fortinet FortiClient Lack of configuration file validation (FG-IR-23-345) (macOS)

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the FG-IR-23-345 advisory. - An external control of file name or path vulnerability CWE-73 in FortiClientMac version 7.2.3 and below, version...

Fortinet FortiSandbox 路径遍历漏洞

Fortinet FortiSandbox is an APT Advanced Persistent Threat protection appliance from Fortinet. The appliance offers dual sandboxing technology, dynamic threat intelligence system, real-time control panel and reporting. A path traversal vulnerability exists in Fortinet FortiSandbox, which stems fr...

PT-2024-3551 · Fortinet · Fortios

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 6.4.0 through 6.4.15 Fortinet FortiOS versions 7.0.0 through 7.0.15 Fortinet FortiOS versions 7.2.0 through 7.2.5 Fortinet FortiOS versions 7.4.0 through 7.4.1 Description: The issue is related to the exposure of...

CVE-2023-41677: Insufficiently Protected Credentials

A insufficiently protected credentials in Fortinet FortiProxy 7.4.0, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, Fortinet FortiOS 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0.0 through 7.0.12, 6.4.0 through...

Fortinet FortiOS 信息泄露漏洞

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. An information disclosure...