Fortinet FortiAP operating system command injection vulnerability

Fortinet FortiAP is a controller for managing wireless access point devices from Fortinet, Inc. A security vulnerability exists in Fortinet FortiAP, which can be exploited by an attacker to execute unauthorized commands by running the kdbg CLI command with specially crafted parameters...

Fortinet FortiSandbox competition condition issue vulnerability

Fortinet FortiSandbox is an APT Advanced Persistent Threat protection appliance from Fortinet. The appliance offers dual sandboxing technology, dynamic threat intelligence system, real-time control panel and reporting. Fortinet FortiSandbox suffers from a security vulnerability that stems from th...

PT-2021-7635

Name of the Vulnerable Software and Affected Versions Fortinet Single Sign-On FSSO Collector versions 5.0.295 and below Description The issue is related to an improper authentication mechanism in the FSSO Collector, which can be exploited by a remote attacker to gain access to the protected...

FortiManager and FortiAnalyzer - Buffer overflow vulnerability through the diagnose system geoip-city command

A buffer overflow vulnerability in FortiAnalyzer and FortiManager CLI may allow an authenticated, local attacker to perform a Denial of Service attack by running the diagnose system geoip-city command with a large ip value. Fortinet is not aware of any successful exploitation of this vulnerabilit...

TrickBot Botnet Found Deploying A New Ransomware Called Diavol

Threat actors behind the infamous TrickBot malware have been linked to a new ransomware strain named "Diavol," according to the latest research. Diavol and Conti ransomware payloads were deployed on different systems in a case of an unsuccessful attack targeting one of its customers earlier this...

Vulnerability fixed in Fortinet FortiClient for macOS

A vulnerability has been fixed in Fortinet FortiClient for macOS. By exploiting this vulnerability to gain root privileges on the vulnerable system. See also the page below from the discoverers of this vulnerability, for more information: https://www.zerodayinitiative.com/advisories/ZDI-21-693/...

Fortinet FortiClient Incorrect Permission Assignment Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Fortinet FortiClient on Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within...

Fortinet FortiClient backend link vulnerability

Fortinet FortiClient is a mobile endpoint security solution from Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to a FortiGate firewall appliance. A security vulnerability exists in Fortinet FortiClient...

CVE-2021-22130

A stack-based buffer overflow vulnerability in FortiProxy physical appliance CLI 2.0.0 to 2.0.1, 1.2.0 to 1.2.9, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 may allow an authenticated, remote attacker to perform a Denial of Service attack by running the diagnose sys cpuset with a large cpuset mask value...

Stack overflow

A stack-based buffer overflow vulnerability in FortiProxy physical appliance CLI 2.0.0 to 2.0.1, 1.2.0 to 1.2.9, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 may allow an authenticated, remote attacker to perform a Denial of Service attack by running the diagnose sys cpuset with a large cpuset mask value...

CVE-2021-22130

A stack-based buffer overflow vulnerability in FortiProxy physical appliance CLI 2.0.0 to 2.0.1, 1.2.0 to 1.2.9, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 may allow an authenticated, remote attacker to perform a Denial of Service attack by running the diagnose sys cpuset with a large cpuset mask value...

Fortinet Fortigate xss (FG-IR-20-199)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-20-199 advisory. - Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through...

Fortinet FortiWLC Access Control Vulnerability

The Fortinet FortiWLC is a wireless LAN controller from Fortinet, Inc. An access control error vulnerability exists in Fortinet FortiWLC, which stems from improperly restricted access. The following products and versions are affected: FortiWLC: 8.5.0, 8.5.1, 8.5.2, 8.5.3, 8.6.0...

Authorization

Two authorization bypass through user-controlled key vulnerabilities in the Fortinet FortiPresence 2.1.0 administration interface may allow an attacker to gain access to some user data via portal manager or portal users parameters...

CVE-2020-6641

CVE-2020-6641 concerns two authorization bypass vulnerabilities in the Fortinet FortiPresence 2.1.0 administration interface, caused by user-controlled key parameters. An attacker could gain access to some user data via portal manager or portal users parameters. Documented impact is partial confi...

CVE-2020-6641

Two authorization bypass through user-controlled key vulnerabilities in the Fortinet FortiPresence 2.1.0 administration interface may allow an attacker to gain access to some user data via portal manager or portal users parameters...

PT-2021-12498

Name of the Vulnerable Software and Affected Versions: Fortinet FortiPresence version 2.1.0 Description: The issue concerns authorization bypass vulnerabilities in the administration interface, potentially allowing attackers to access user data. This can be achieved through user-controlled key...

CVE-2020-6641: Authorization Bypass Through User-Controlled Key

Two authorization bypass through user-controlled key vulnerabilities in the Fortinet FortiPresence 2.1.0 administration interface may allow an attacker to gain access to some user data via portal manager or portal users parameters...

FortiProxy - Stack-based Buffer overflow vulnerability through the diagnose sys cpuset CLI command

A stack-based buffer overflow vulnerability in FortiProxy physical appliance CLI may allow an authenticated, remote attacker to perform a Denial of Service attack by running the diagnose sys cpuset with a large cpuset mask value. Fortinet is not aware of any successful exploitation of this...

Fortinet FortiGate cross-site scripting vulnerability

Fortinet FortiGate is a network security platform from Fortinet, Inc. The platform provides firewall, anti-virus and intrusion prevention IPS, application control, anti-spam, wireless controller, and WAN acceleration capabilities.A cross-site scripting vulnerability exists in Fortinet FortiGate...