Fortinet Fortigate Read Only administrator can intercept sensitive data (FG-IR-22-380)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-380 advisory. - A cleartext transmission of sensitive information vulnerability CWE-319 in Fortinet FortiOS version 7.2.0 through 7.2.4,...

Fortinet Fortigate Out-of-bound write in CLI (FG-IR-22-494)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-494 advisory. - A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS versio...

Protect

A cleartext transmission of sensitive information vulnerability CWE-319 in FortiOS & FortiProxy may allow an authenticated attacker with readonly superadmin privileges to intercept traffic in order to obtain other adminstrators cookies via diagnose CLI commands...

Protect

An access of uninitialized pointer vulnerability CWE-824 in FortiOS administrative interface API may allow an authenticated attacker to repetitively crash the httpsd process via crafted HTTP or HTTPS requests...

Protect

An out-of-bounds write vulnerability CWE-787 in Command Line Interface of FortiOS and FortiProxy may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted commands...

Protect

A use of externally-controlled format string vulnerability CWE-134 in the Fclicense daemon of FortiOS may allow a remote authenticated attacker to execute arbitrary code or commands via specially crafted requests...

Protect

A relative path traversal vulnerability CWE-23 in FortiOS, FortiProxy & FortiSwitchManager administrative interface may allow a privileged attacker to delete arbitrary directories from the filesystem through crafted HTTP requests...

PT-2023-3229 · Fortinet · Fortiproxy +1

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 6.4.0 through 6.4.12 Fortinet FortiOS versions 7.0.0 through 7.0.11 Fortinet FortiOS versions 7.2.0 through 7.2.4 Fortiproxy versions 7.0.0 through 7.0.10 Fortiproxy versions 7.2.0 through 7.2.4 Description: A null...

Fortinet FortiWeb DoS in firmware upgrade function (FG-IR-22-375)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-375 advisory. - A loop with unreachable exit condition 'infinite loop' in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0....

Fortinet Fortigate Access of uninitialized pointer in administrative interface API (FG-IR-23-095)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-095 advisory. - A access of uninitialized pointer vulnerability CWE-824 in Fortinet FortiProxy version 7.2.0 through 7.2.3 and before 7.0.9...

PT-2023-3233 · Fortinet · Fortiproxy +1

Name of the Vulnerable Software and Affected Versions: FortiOS versions 6.0 through 7.2.3 FortiProxy versions 1.0 through 7.2.2 Description: The issue is related to an out-of-bounds write in memory, which can be exploited to allow an attacker to escalate their privileges. This can be achieved via...

Protect

A loop with unreachable exit condition 'Infinite Loop' vulnerability CWE-835 in FortiOS, FortiProxy and Fortiweb may allow an authenticated attacker to perform a denial of service via a specially crafted firmware image...

PT-2023-3236 · Fortinet · Fortiproxy +1

Name of the Vulnerable Software and Affected Versions: FortiOS versions 7.0.0 through 7.0.8 FortiOS versions 7.2.0 through 7.2.4 FortiProxy versions 7.0.0 through 7.0.8 FortiProxy versions 7.2.0 through 7.2.1 Description: The issue is related to the cleartext transmission of sensitive information...

PT-2023-3353 · Fortinet · Fortiproxy +2

Name of the Vulnerable Software and Affected Versions: FortiOS versions 7.2.0 through 7.2.4 FortiOS versions 7.0.0 through 7.0.11 FortiOS versions 6.4.0 through 6.4.12 FortiOS versions 6.2.0 through 6.2.14 FortiOS versions 6.0.0 through 6.0.16 FortiProxy versions 7.2.0 through 7.2.4 FortiProxy...

VulnCheck KEV: CVE-2023-27997

Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests...

Fortinet Fortigate Format String Bug in Fclicense daemon (FG-IR-23-119)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-119 advisory. - A use of externally-controlled format string in Fortinet FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through...

Fortinet Fortigate Null pointer dereference in sslvpnd proxy endpoint (FG-IR-23-125)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-125 advisory. - A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12,...

PT-2023-3075

Name of the Vulnerable Software and Affected Versions FortiOS versions prior to 7.2.5 FortiOS versions prior to 7.0.12 FortiOS versions prior to 6.4.13 FortiOS versions prior to 6.0.17 FortiProxy versions prior to 7.2.4 FortiProxy versions prior to 7.0.10 FortiProxy versions prior to 2.0.13...

Oracle Linux 7 : olcne (ELSA-2023-23649)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-23649 advisory. - CVE-2023-27496 - CVE-2023-27488 - CVE-2023-27493 - CVE-2023-27492 - CVE-2023-27491 - CVE-2023-27487 1.6.1-3 Tenable has extracted the preceding...

The vulnerability of the SSLVPN service on FortiOS operating systems and the proxy servers for protecting against Internet attacks by FortiProxy allows attackers to execute arbitrary commands.

The vulnerability of the SSLVPN service on FortiOS operating systems and FortiProxy proxy servers for protecting against Internet attacks is related to writing data beyond the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending special...