Cross site request forgery (csrf)

The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.0.0 before 5.0.8 on FortiGate devices allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted request...

CVE-2014-2216

The CVE-2014-2216 vulnerability affects Fortinet FortiOS FortiGate devices where the FortiManager protocol service (on FortiOS versions prior to 4.3.16 and prior to 5.0.8 in the 5.0 branch) can be triggered by a crafted request, enabling remote attackers to cause a denial of service and possibly ...

CVE-2014-2216

The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.0.0 before 5.0.8 on FortiGate devices allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted request...

Fortinet FortiWeb 5.x < 5.2.1 Multiple XSS Vulnerabilities

The remote host is running FortiWeb 5.x prior to 5.2.1. It is, therefore, affected by multiple cross-site scripting XSS vulnerabilities in the web management interface URLs '/user/ldapuser/checkdlg' and '/user/radiususer/checkdlg' due to insufficient parameter input validation. Under specific...

Fortinet FortiClient OpenSSL Security Bypass

FortiClient, a client-based software solution intended to provide security features for enterprise computers and mobile devices, is installed on the remote Windows host. The installed FortiClient version uses a vulnerable OpenSSL library that contains a flaw with the handshake process. The flaw...

Fortinet OpenSSL Multiple Vulnerabilities

The firmware of the remote Fortinet host is running a version of OpenSSL that is affected by one or more of the following vulnerabilities : - An error exists in the function 'ssl3readbytes' that could allow data to be injected into other sessions or allow denial of service attacks. Note this issu...

FortiWeb Cross-Site Scripting Vulnerabilities

...

BitComet 0.60 Torrent File Handling Remote Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/16311/info BitComet is prone to a buffer-overflow vulnerability. This issue presents itself when the application attempts to process a malformed '.torrent' file. Exploitation of this issue could allow attacker-supplied...

Fortinet FortiWeb Web Application Firewall Policy Bypass

No description provided by source. BINAR10 Report on Fortinet Fortiweb Findings 02/05/2012 - Fortinet FortiWeb Web Application Firewall Policy Bypass - ============================================================ 1 Affected Product Fabricant: Fortinet Product name: FortiWeb Version: Latest update...

Fortinet Fortigate CRLF Characters URL Filtering Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/27276/info Fortinet Fortigate is prone to a vulnerability that can allow attackers to bypass the device's URL filtering. An attacker can exploit this issue to view unauthorized websites, bypassing certain security...

Fortinet FortiMail 400 IBE Multiple Vulnerabilities

No description provided by source...

Fortinet FortiGate 2.x/3.0 URL Filtering Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/16599/info Fortinet FortiGate is prone to a vulnerability that could allow users to bypass the device's URL filtering. FortiGate devices running FortiOS v2.8MR10 and v3beta are vulnerable to this issue. Other versions may...

Fortinet FortiWeb < 5.2.0 Multiple XSRF Vulnerabilities

The remote host running FortiWeb prior to 5.2.0. It is, therefore, affected by multiple cross-site request forgery XSRF vulnerabilities in the web UI due to a lack of XSRF token protection. A remote, unauthenticated attacker could potentially exploit this vulnerability to perform administrative...

CVE-2014-3115

Multiple cross-site request forgery CSRF vulnerabilities in the web administration console in Fortinet FortiWeb before 5.2.0 allow remote attackers to hijack the authentication of administrators via system/config/adminadd and other unspecified vectors...

CVE-2014-3115

Fortinet FortiWeb

CVE-2014-3115

Multiple cross-site request forgery CSRF vulnerabilities in the web administration console in Fortinet FortiWeb before 5.2.0 allow remote attackers to hijack the authentication of administrators via system/config/adminadd and other unspecified vectors...

Fortinet Fortiweb 5.1 contains a cross-site request forgery vulnerability

Overview Fortinet Fortiweb prior to version 5.2.0 do not sufficiently verify whether a valid request was intentionally provided by the user, which results in a cross-site request forgery CSRF vulnerability. CWE-352 Description CWE-352: Cross-Site Request Forgery CSRF Fortinet Fortiweb prior to...

Fortinet FortiMail < 4.3.4 / 5.0.0 Multiple XSS

The remote host is running FortiMail prior to 4.3.4 / 5.0.0. It is, therefore, affected by multiple cross-site scripting vulnerabilities due to a failure to sanitize user-supplied input in the web UI. Specifically, flaws exist in the 'ipmask', 'username', 'address', and 'url' parameters of the...

Fortinet FortiOS User Interface Default Credentials

The remote Fortinet FortiOS user interface uses a known set of default credentials. Knowing these, an attacker with access to the service can gain administrative access to the device. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Fortinet FortiOS < 4.3.13 / 5.0.3 Multiple XSRF

The remote host is running FortiOS prior to 4.3.13 / 5.0.3. It is, therefore, affected by multiple cross-site request forgery vulnerabilities in web UI pages because they are not protected by XSRF tokens. An attacker could potentially exploit this vulnerability to hijack an authenticated user's...