CVE-2021-36178

A insufficiently protected credentials in Fortinet FortiSDNConnector version 1.1.7 and below allows attacker to disclose third-party devices credential information via configuration page lookup...

CVE-2021-36178

A insufficiently protected credentials in Fortinet FortiSDNConnector version 1.1.7 and below allows attacker to disclose third-party devices credential information via configuration page lookup...

PT-2021-21160

Name of the Vulnerable Software and Affected Versions Fortinet FortiSDNConnector versions 1.1.7 and below Description The issue allows an attacker to disclose third-party devices' credential information via a configuration page lookup due to insufficiently protected credentials. Recommendations F...

Fortinet FortiClientEms 代码问题漏洞

Fortinet FortiClientEms is a centralized central management system from Fortinet, Inc. A code issue vulnerability exists in Fortinet FortiClientEms, which can be exploited by attackers to gain administrator privileges by reusing an unexpired administrator user session ID...

Vulnerability fixed in Fortinet FortiSandbox

Fortinet has fixed a vulnerability in FortiSandbox. A authenticated malicious party could potentially abuse the vulnerability to execute arbitrary code. To do so, a rogue HTTP request must be sent to the FortiSandbox appliance. sent. Fortinet has released updates to fix the vulnerability in...

CVE-2021-36178: Insufficiently Protected Credentials

A insufficiently protected credentials in Fortinet FortiSDNConnector version 1.1.7 and below allows attacker to disclose third-party devices credential information via configuration page lookup...

Fortinet FortiAnalyzer 跨站脚本漏洞

Fortinet FortiAnalyzer is a set of centralized network security reporting solutions from the U.S. company Fiat Fortinet. The product is mainly used to collect network log data, and through the reporting suite of security events in the log, network traffic, Web content, etc. to analyze, report,...

Fortinet FortiSandbox 安全特征问题漏洞

Fortinet FortiSandbox is an APT Advanced Persistent Threat protection appliance from Fortinet. The appliance offers dual sandboxing technology, dynamic threat intelligence system, real-time control panel and reporting. A security signature issue vulnerability exists in Fortinet FortiSandbox that...

CVE-2021-24016

An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host...

CVE-2021-24017

An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via crafted requests to the request handler...

Authentication flaw

An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via crafted requests to the request handler...

CVE-2021-24017

An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via crafted requests to the request handler...

CVE-2021-24017

CVE-2021-24017 concerns Fortinet FortiManager. In versions 6.4.3 and below, and 6.2.6 and below, an improper authentication flaw allows an attacker to assign arbitrary Policy and Object modules via crafted requests to the request handler. The vulnerability description is supported by multiple con...

CVE-2021-24017

An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via crafted requests to the request handler...

CVE-2021-24016

An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host...

CVE-2021-24016

Fortinet FortiManager vulnerability CVE-2021-24016: An improper neutralization of formula elements in policy-name CSV/Excel fields can lead to arbitrary shell commands when a crafted IPv4 field is included and the exported configuration file is opened unsafely. Affected are FortiManager 6.4.3 and...

CVE-2021-24017: Improper Authentication

An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Object modules via crafted requests to the request handler...

Keep Attackers Out of VPNs: NSA, CISA Offer Guidance

Unsecured VPNs can be a hot mess: Just ask Colonial Pipeline which got pwned by the REvil ransomware crooks with an old VPN password or the 87,000 at least Fortinet customers whose credentials for unpatched SSL-VPNs were posted online earlier this month. Vulnerabilities in VPN servers are like...

Fortinet FortiManager and Fortinet FortiAnalyzer Cross-Site Scripting Vulnerability (CNVD-2022-58483)

Fortinet FortiManager is a centralized network security management platform. Fortinet FortiAnalyzer is a centralized network security reporting solution. Fortinet FortiManager and FortiAnalyzer have a cross-site scripting vulnerability that can be exploited by attackers to trick victims into...

A week in security (Sept 6 – Sept 12)

Last week on Malwarebytes Labs Apple delays plans to search devices for child abuse imagery. ProtonMail hands user’s IP address and device info to police, showing the limits of private email. Patch now! Netgear fixes serious smart switch vulnerabilities. Tor vs VPN—What is the difference? Windows...