PT-2021-23054

Name of the Vulnerable Software and Affected Versions Fortinet FortiWLM versions 8.6.1 and below Description The issue is related to improper neutralization of input during web page generation, which can lead to cross-site scripting. This allows an attacker to store malicious JavaScript code in t...

CVE-2021-43067: Exposure of Sensitive Information to an Unauthorized Actor

A exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator version 6.4.0, version 6.3.2 and below, version 6.2.1 and below, version 6.1.2 and below, version 6.0.7 to 6.0.1 allows attacker to duplicate a target LDAP user 2 factors authentication token via crafted...

Fortinet FortiNAC 安全漏洞

Fortinet FortiNAC is a network access control solution from Fortinet, a US-based company. Fortinet FortiNAC has an elevation of privilege vulnerability that can be exploited to elevate privileges to root via the sudo command...

Fortinet FortiAuthenticator 信息泄露漏洞

Fortinet FortiAuthenticator is a centralized user identity management solution from Fortinet. An information disclosure vulnerability exists in Fortinet FortiAuthenticator that originates from the product allowing an LDAP user token to be copied to obtain sensitive information...

Fortinet FortiWeb 操作系统操作系统命令注入漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content.Fortinet FortiWeb A command injection...

CVE-2021-41015: Improper Neutralization of Input During Web Page Generation

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to SAML login handler...

Fortinet FortiWeb 输入验证错误漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure web applications and protect sensitive database content. An input validation error vulnerability...

CVE-2021-41014: Uncontrolled Resource Consumption

A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows an unauthenticated attacker to make the httpsd daemon unresponsive via huge HTTP packets...

Fortinet FortiClient 安全漏洞

Fortinet FortiClient is a mobile endpoint security solution from Fortinet. It provides IPsec and SSL encryption, WAN optimization, endpoint compliance and two-factor authentication when connected to a FortiGate firewall appliance. A security vulnerability exists in Fortinet FortiClient, which can...

PT-2021-7568

Name of the Vulnerable Software and Affected Versions Fortinet FortiNAC versions 8.8.9 and below Fortinet FortiNAC versions 9.1.3 and below Fortinet FortiNAC version 9.2.0 Description The issue is related to an incorrect permission assignment for a critical resource in Fortinet FortiNAC. This can...

Fortinet FortiClient 信任管理问题漏洞

Fortinet FortiClient is a mobile endpoint security solution from Fortinet, a US-based company. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to a FortiGate firewall appliance.Fortinet FortiClient has a security...

Fortinet FortiOS 安全漏洞

Fortinet FortiOS is a security operating system dedicated to the FortiGate network security platform from Fortinet, a US-based company. The system provides users with a variety of security features such as firewall, anti-virus, IPSec/SSLVPN, Web content filtering and anti-spam.Fortinet FortiOS ha...

Fortinet FortiOS 缓冲区错误漏洞

Fortinet FortiOS is a security operating system dedicated to the FortiGate network security platform from Fortinet, Inc. The system provides users with a variety of security features such as firewall, anti-virus, IPSec/SSLVPN, Web content filtering and anti-spam. An attacker could exploit this...

Fortinet FortiClient Dylib injection (FG-IR-21-079) (macOS)

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-079 advisory. - An improper control of generation of code vulnerability CWE-94 in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and...

Fortinet FortiClient Elevation of Privilege Vulnerability (CNVD-2021-102008)

FortiClient is a mobile endpoint security solution from Fortinet, Inc. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to a FortiGate firewall appliance.FortiClient is vulnerable to an elevation of privilege...

Fortinet FortiOS Remote Code Execution (CVE-2016-6909)

A remote code execution vulnerability exists in Fortinet FortiOS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

FBI issues flash alert after APT groups exploited VPN flaws

By Waqas With this; FatPipe joins the list of VPN providers that have faced a similar situation in the past, including Fortinet, Cisco, Pulse Secure, and Citrix. This is a post from HackRead.com Read the original post: FBI issues flash alert after APT groups exploited VPN flaws...

Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities

Summary Actions to Take Today to Protect Against Iranian State-Sponsored Malicious Cyber Activity • Immediately patch software affected by the following vulnerabilities: CVE-2021-34473, 2018-13379, 2020-12812, and 2019-5591. • Implementmulti-factor authentication. • Usestrong, unique passwords.v...

MuddyWater is taking advantage of old vulnerabilities

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. The Federal Bureau of Investigation FBI, the Cybersecurity and Infrastructure Security Agency CISA, the Australian Cyber Security Centre ACSC, and the United Kingdoms National Cyber Security Centre NCSC have issued a joint...

Exchange, Fortinet Flaws Being Exploited by Iranian APT, CISA Warns

A state-backed Iranian threat actor has been using multiple CVEs – including both serious Fortinet vulnerabilities for months and a Microsoft Exchange ProxyShell weakness for weeks – looking to gain a foothold within networks before moving laterally and launching BitLocker ransomware and other...