Fortinet FortiAuthenticator Cross-Site Scripting Vulnerability

Fortinet FortiAuthenticator is a series of secure authentication solutions that identify and interface with FortiToken™ two-factor authentication tokens for secure remote access. A cross-site scripting vulnerability in Fortinet FortiAuthenticator 3.0.0 could allow a remote attacker to inject...

FortiOS CAPWAP server two vulnerabilities

...

Fortinet FortiAuthenticator Directory Traversal Vulnerability

Fortinet FortiAuthenticator is a series of secure authentication solutions that identify and interface with FortiToken™ two-factor authentication tokens for secure remote access. A directory traversal vulnerability in Fortinet FortiAuthenticator 3.0.0 allows a local user to read arbitrary files v...

Fortinet FortiOS Information Disclosure Vulnerability (CNVD-2015-00916)

Fortinet FortiOS is a set of security operating system developed by the U.S. company Fita Fortinet dedicated to the FortiGate platform, which provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering, anti-spam and other security features. An information disclosure vulnerabili...

KLA10494 Multiple vulnerabilities in Fortinet FortiAuthenticator

Multiple serious vulnerabilities have been found in Fortinet FortiAuthenticator. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, inject code and read arbitrary files. Below is a complete list of vulnerabilities 1. XSS vulnerability can be...

Fortinet FortiOS HTML Injection Vulnerability

Fortinet FortiOS is a set of security operating system developed by the U.S. company Fita Fortinet dedicated to the FortiGate platform, which provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering, anti-spam and other security features. An HTML injection vulnerability exist...

CVE-2015-1456

Fortinet FortiAuthenticator 3.0.0 logs the PostgreSQL usernames and passwords in cleartext, which allows remote administrators to obtain sensitive information by reading the log at debug/startup/...

CVE-2015-1455

Fortinet FortiAuthenticator 3.0.0 has a password of 1 slony for the slony PostgreSQL user and 2 www-data for the www-data PostgreSQL user, which makes it easier for remote attackers to obtain access via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Fortinet FortiAuthenticator 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the operation parameter to cert/scep/...

Command injection

Fortinet FortiAuthenticator 3.0.0 allows local users to bypass intended restrictions and gain privileges by creating /tmp/privexec/dbgcoreenableshellaccess and executing the "shell" command...

Command injection

Fortinet FortiAuthenticator 3.0.0 allows local users to read arbitrary files via the -f flag to the dig command...

Design/Logic Flaw

Fortinet FortiAuthenticator 3.0.0 has a password of 1 slony for the slony PostgreSQL user and 2 www-data for the www-data PostgreSQL user, which makes it easier for remote attackers to obtain access via unspecified vectors...

CVE-2015-1459

Summary: CVE-2015-1459 is a cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator 3.0.0, exploitable via the operation parameter in cert/scep/. The vulnerability is documented across multiple sources in the connected set (NVD/NVD-derived entry, Nessus plugin, and vendor advisori...

CVE-2015-1458

Fortinet FortiAuthenticator 3.0.0 is affected by a local privilege escalation (CVE-2015-1458) where an attacker can bypass restrictions and gain privileges by creating /tmp/privexec/dbgcore_enable_shell_access and executing the shell command. The issue is documented across multiple sources (NVD e...

CVE-2015-1456

Fortinet FortiAuthenticator 3.0.0 is affected. It logs PostgreSQL usernames and passwords in cleartext in debug/startup logs, enabling reading of sensitive credentials by remote admins. CVE-2015-1456 is referenced alongside multiple other FG-IR-15-003 disclosures. The issue is rated by NVD with C...

CVE-2015-1458

Fortinet FortiAuthenticator 3.0.0 allows local users to bypass intended restrictions and gain privileges by creating /tmp/privexec/dbgcoreenableshellaccess and executing the "shell" command...

CVE-2015-1457

Fortinet FortiAuthenticator 3.0.0 allows local users to read arbitrary files via the -f flag to the dig command...

CVE-2015-1459

Cross-site scripting XSS vulnerability in Fortinet FortiAuthenticator 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the operation parameter to cert/scep/...

CVE-2015-1455

Fortinet FortiAuthenticator 3.0.0 has a password of 1 slony for the slony PostgreSQL user and 2 www-data for the www-data PostgreSQL user, which makes it easier for remote attackers to obtain access via unspecified vectors...

CVE-2015-1457

CVE-2015-1457 affects Fortinet FortiAuthenticator 3.0.0, where local users can read arbitrary files via the -f flag to the dig command. Connected sources indicate multiple related advisories; one threat intel note lists affected products as FortiAuthenticator versions earlier than 3.2.1 and recom...