CVE-2016-8491

The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell...

CVE-2016-8491

The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell...

CVE-2016-8491

CVE-2016-8491 affects Fortinet FortiWLC: presence of a hardcoded account named 'core' that allows attackers to gain unauthorized read/write access via a remote shell. This is evidenced across multiple sources (Fortinet advisory FG-IR-16-065 and various CVE/NVD records) describing a hardcoded core...

Fortinet FortiGate ZebOS routing remote shell service enabled (FG-IR-15-020)

The Fortinet FortiGate device has the ZebOS routing remote shell service enabled. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if descriptio...

CVE-2016-7054: the OpenSSl 1.1.0 a and 1.1.0 b heap overflow exploit-vulnerability warning-the black bar safety net

A few days ago, Fortinet has published a entitled“OpenSSL ChaCha20-Poly1305 heap overflowCVE-2016-7054analysis”article. The OpenSSL library in a high risk heap overflow vulnerability was discovered, affecting 1. 1. 0a and 1. 1. 0 b version. Vulnerability code is in...

Fortinet FortiOS Information Disclosure Vulnerability (CNVD-2016-12205)

Fortinet FortiOS is a set of security operating system developed by the U.S. Fiat Fortinet company dedicated to FortiGate network security platform. The system provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering and anti-spam and other security features. An information...

Fortinet FortiOS 5.x < 5.4.2 Flow-mode Detection Bypass

The remote FortiGate device is running a version of FortiOS that is 5.x prior to 5.4.2. It is, therefore, affected by a security bypass vulnerability when reloading the scanning engine after an update that results in active network sessions no longer being monitored by flow-mode detection. An...

Fortinet FortiOS 4.3.x < 4.3.19 TLS and IPSEC Information Disclosure

The remote FortiGate device is running a version of FortiOS that is 4.3.x prior to 4.2.19. It is, therefore, affected by a flaw due to the implementation the ANSI X9.31 RNG that is used to decrypt TLS and IPSec traffic. A man-in-the-middle MitM attacker can exploit this to disclose sensitive...

Fortinet FortiOS Information Disclosure Vulnerability (CNVD-2016-11691)

Fortinet FortiOS is a set of security operating system developed by the U.S. Fiat Fortinet company dedicated to FortiGate network security platform. The system provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering and anti-spam and other security features. An information...

Fortinet FortiOS Security Bypass Vulnerability (CNVD-2016-11690)

Fortinet FortiOS is a set of security operating system developed by the U.S. Fiat Fortinet company dedicated to FortiGate network security platform. The system provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering and anti-spam and other security features. A security bypas...

Fortinet FortiClient Unsupported Version Detection (macOS)

According to its self-reported version number, the installation of Fortinet FortiClient on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities...

Fortinet FortiWLC Hard-Coded Security Bypass Vulnerability

Fortinet FortiWLC is a wireless controller from Fortinet. A security bypass vulnerability exists in the hardcoding of the Fortinet FortiWLC, which could be exploited by an attacker to gain access to the system and obtain sensitive information...

Fortinet FortiManager and Fortinet FortiAnalyzer Cross-Site Scripting Vulnerabilities

Fortinet FortiManager and Fortinet FortiAnalyzer are products of Fortinet, a centralized network security management solution; Fortinet FortiAnalyzer is a centralized network security reporting solution. Fortinet FortiManager is a centralized network security management solution; Fortinet...

Fortinet FortiAnalyzer XSS Vulnerability (FG-IR-16-051)

Fortinet FortiAnalyzer is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Fortinet FortiManager XSS Vulnerability (FG-IR-16-051)

Fortinet FortiManager is prone to a cross-site-scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Fortinet FortiWLC Security Bypass Vulnerability

Fortinet FortiWLC is a wireless controller from Fortinet. A security vulnerability exists in the rsyncd server in the Fortinet FortiWLC that stems from the program's use of hard-coded rsync accounts. A remote attacker could exploit the vulnerability to read or write arbitrary files...

Fortinet FortiWLC Information Disclosure Vulnerability

Fortinet FortiWLC is a wireless controller from Fortinet. A security vulnerability exists in Fortinet FortiWLC. An attacker can exploit this vulnerability by reading the pam.log file to obtain sensitive user credentials...

Cross site scripting

Cross-site scripting XSS vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3 allows remote administrators to inject arbitrary web script or HT...

CVE-2015-7363

CVE-2015-7363 covers a stored XSS in the Fortinet FortiManager/FortiAnalyzer advanced settings page through report filters. Affected are FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3. The vulnerability allows a remote administrat...

CVE-2015-7363

Cross-site scripting XSS vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3 allows remote administrators to inject arbitrary web script or HT...