CVE-2016-8495

An improper certificate validation vulnerability in Fortinet FortiManager 5.0.6 through 5.2.7 and 5.4.0 through 5.4.1 allows remote attacker to spoof a trusted entity by using a man-in-the-middle MITM attack via the Fortisandbox devices probing feature...

CVE-2016-8495: Exposure of Sensitive Information to an Unauthorized Actor

An improper certificate validation vulnerability in Fortinet FortiManager 5.0.6 through 5.2.7 and 5.4.0 through 5.4.1 allows remote attacker to spoof a trusted entity by using a man-in-the-middle MITM attack via the Fortisandbox devices probing feature...

Fortinet Connect Elevation of Privilege Vulnerability

Fortinet Connect is a device-based and user-based policy deployment network security access device developed by Fiat Fortinet. A security vulnerability exists in Fortinet Connect that stems from the program failing to adequately validate uploaded files. The vulnerability can be exploited to execu...

Fortinet Connect admin able to gain root access

A webui administrator may create a new theme that performs arbitrary code execution on the system...

Fortinet FortiOS Local Admin Password Hash Leak Vulnerability (FG-IR-16-050)

Fortinet FortiOS is prone to a local admin password hash leak vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2016-8492

The implementation of an ANSI X9.31 RNG in Fortinet FortiGate allows attackers to gain unauthorized read access to data handled by the device via IPSec/TLS decryption...

CVE-2016-8492

The implementation of an ANSI X9.31 RNG in Fortinet FortiGate allows attackers to gain unauthorized read access to data handled by the device via IPSec/TLS decryption...

CVE-2016-8492

CVE-2016-8492 describes an information-disclosure vulnerability in Fortinet FortiGate/FortiOS where the ANSI X9.31 RNG is used in long‑lived security channels (IPSec/TLS), potentially allowing unauthorized read access to data. Connected sources confirm this relates to DUHK-style weaknesses in RNG...

CVE-2016-8492

The implementation of an ANSI X9.31 RNG in Fortinet FortiGate allows attackers to gain unauthorized read access to data handled by the device via IPSec/TLS decryption...

CVE-2016-8492

The implementation of an ANSI X9.31 RNG in Fortinet FortiGate allows attackers to gain unauthorized read access to data handled by the device via IPSec/TLS decryption...

Fortinet FortiOS 5.2.x < 5.2.10 / 5.4.1 < 5.4.2 Local Password Hash Disclosure (FG-IR-16-050)

The remote FortiGate device is running a version of FortiOS that is 5.2.x prior to 5.2.10, or else it is running version 5.4.1. It is, therefore, affected by a local information disclosure vulnerability due to a failure to properly protect password hashes stored on the device. A local attacker ca...

CVE-2016-8491

The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell...

Hardcoded credentials

The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell...

CVE-2016-8491

CVE-2016-8491 affects Fortinet FortiWLC: presence of a hardcoded account named 'core' that allows attackers to gain unauthorized read/write access via a remote shell. This is evidenced across multiple sources (Fortinet advisory FG-IR-16-065 and various CVE/NVD records) describing a hardcoded core...

CVE-2016-8491

The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell...

CVE-2016-8491

The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell...

PT-2017-9661

Name of the Vulnerable Software and Affected Versions Fortinet FortiWLC affected versions not specified Description The issue allows attackers to gain unauthorized read/write access via a remote shell due to the presence of a hardcoded account named core. Recommendations At the moment, there is n...

CVE-2016-8491: Use of Hard-coded Credentials

The presence of a hardcoded account named 'core' in Fortinet FortiWLC allows attackers to gain unauthorized read/write access via a remote shell...

Fortinet FortiGate ZebOS routing remote shell service enabled (FG-IR-15-020)

The Fortinet FortiGate device has the ZebOS routing remote shell service enabled. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if descriptio...

CVE-2016-7054: the OpenSSl 1.1.0 a and 1.1.0 b heap overflow exploit-vulnerability warning-the black bar safety net

A few days ago, Fortinet has published a entitled“OpenSSL ChaCha20-Poly1305 heap overflowCVE-2016-7054analysis”article. The OpenSSL library in a high risk heap overflow vulnerability was discovered, affecting 1. 1. 0a and 1. 1. 0 b version. Vulnerability code is in...