Fortinet FortiOS CVE-2019-15703 Insufficient Entropy Vulnerability

Description Fortinet FortiOS is prone to an insufficent entropy vulnerability. Remote attackers can exploit this issue to perform side-channel attacks and obtain sensitive information. This aids in other attacks. Technologies Affected Fortinet FortiOS 2.36.0 Fortinet FortiOS 2.50.0 Fortinet Forti...

Fortinet FortiMail Multiple Remote Privilege Escalation Vulnerability

Description Fortinet FortiMail is prone to multiple remote prone privilege-escalation vulnerability. An attacker can exploit these issues to gain elevated privileges, obtain sensitive information or cause denial-of-service conditions. Technologies Affected Fortinet FortiMail 5.4.0 Fortinet...

Fortinet FortiOS SSL VPN Directory Traversal (CVE-2018-13379)

A directory traversal vulnerability exists in Fortinet FortiOS. Successful exploitation of this vulnerability could allow an attacker to access arbitrary files on the affected system...

The vulnerability in the web-management interface of the Fortinet FortiNAC device allows a perpetrator to execute a cross-site scripting attack.

The vulnerability in the Fortinet FortiNAC network access control web interface relates to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

APT Groups Exploiting Flaws in Unpatched VPNs, Officials Warn

State-sponsored advanced persistent threat APT groups are using flaws in outdated VPN technologies from Palo Alto Networks, Fortinet and Pulse Secure to carry out cyber attacks on targets in the United States and overseas, warned U.S. and U.K. officials. The National Security Agency NSA issued a...

VulnCheck KEV: CVE-2018-13379

Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests...

VulnCheck KEV: CVE-2018-13382

An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password...

VulnCheck KEV: CVE-2018-13383

A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users...

Fortinet FortiClient Enterprise Management Server Cross-Site Scripting Vulnerability

Fortinet FortiClient Enterprise Management Server EMS is a FortiClient Enterprise Manager from Fortinet. It is designed for scalable and centralized management of multiple FortiClients. A cross-site scripting vulnerability exists in Fortinet FortiClient EMS 6.2.0 and earlier versions, which stems...

Exploit for Path Traversal in Fortinet Fortiproxy

FortiOS-Credentia...

PT-2019-6280 · Fortinet · Forticlient Enterprise Management Server

Name of the Vulnerable Software and Affected Versions: Fortinet FortiClient Enterprise Management Server EMS affected versions not specified Description: The issue is related to the lack of protection measures for the web page structure during its creation, which can be exploited by a remote...

Fortinet FortiOS SSL VPN Directory Traversal Vulnerability (FG-IR-18-384) (Direct Check)

The remote host is running a version of FortiOS 5.6.3 prior to 5.6.8 or 6.0.x prior to 6.0.5. It is, therefore, affected by a directory traversal vulnerability in the SSL VPN web portal, due to improper sanitization of path traversal characters in URLs. An unauthenticated, remote attacker can...

CVE-2019-5590

The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands Cross Site Scripting via attack reports generated in HTML form...

CVE-2019-5590

The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands Cross Site Scripting via attack reports generated in HTML form...

Cross site scripting

The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands Cross Site Scripting via attack reports generated in HTML form...

CVE-2019-5590

The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands Cross Site Scripting via attack reports generated in HTML form...

CVE-2019-5590

CVE-2019-5590 affects Fortinet FortiWeb 6.0.2 and earlier. The root cause is that the URL part of the report message is not encoded, enabling Cross-Site Scripting (XSS) via HTML-formatted attack reports. Potential impact: attacker may cause client-side code execution in a user’s browser. Exploita...

CVE-2019-5590

The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands Cross Site Scripting via attack reports generated in HTML form...

Fortinet FortiOS (Mac OS X) 5.6.0 < 5.6.8 / 6.0.x < 6.0.5 multiple pre-auth XSS vulnerabilities on SSL VPN (FG-IR-18-383) (deprecated)

The plugin was deprecated due to checking hosts for FortiClient instead of FortiOS. Use fortiosFG-IR-18-383.nasl plugin ID 128278 instead. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2020/11/18. Deprecated by fortiosFG-IR-18-383.nasl include"compat.inc"; if description scriptid12827...

Fortinet FortiOS 5.6.0 < 5.6.8 / 6.0.x < 6.0.5 multiple pre-auth XSS vulnerabilities on SSL VPN (FG-IR-18-383)

A Cross-site Scripting XSS vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters. TRUSTED...