3691 matches found
VulnCheck KEV: CVE-2019-5591
Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol LDAP server...
FBI-CISA Joint Advisory on Exploitation of Fortinet FortiOS Vulnerabilities
The Federal Bureau of Investigation FBI and CISA have released a Joint Cybersecurity Advisory CSA to warn users and administrators of the likelihood that advanced persistent threat APT actors are actively exploiting known Fortinet FortiOS vulnerabilities CVE-2018-13379, CVE-2020-12812, and...
The vulnerability affects the implementation of WPA/WPA2 protocols in Fortinet’s FortiOS operating systems and Fortinet FortiAP access point software. This allows attackers to gain unauthorized access to protected information.
The vulnerability of the implementations of WPA/WPA2 protocols in Fortinet’s FortiOS operating systems and Fortinet FortiAP access point software is related to insufficiently secure data encryption. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected...
Fortinet FortiOS <= 6.2.5 / 6.4 <= 6.4.2 Traffic Bypass (FG-IR-20-172)
The remote host is running a version of FortiOS prior or equal to 6.2.5, or 6.4 prior to 6.4.3. It is, therefore, affected by a traffic bypass vulnerability. When traffic other than HTTP/S eg: SSH traffic, etc... traverses the FortiGate in version below 6.2.5 and below 6.4.2 on port 80/443, it is...
Metasploit Wrap-Up
FortiOS Path Traversal Returning community contributor mekhalleh submitted a module targeting a path traversal vulnerability within the SSL VPN web portal in multiple versions of FortiOS. The flaw is leveraged to read the usernames and passwords of currently logged in users which are stored in...
The vulnerability in the web interface of FortiOS operating systems allows attackers to perform CSRF attacks.
The vulnerability in the FortiOS operating system web interface relates to the redirection of URLs to an unreliable website. Exploiting this vulnerability allows a malicious actor to perform CSRF attacks using a specially created request...
FortiOS Path Traversal Credential Gatherer
Fortinet FortiOS versions 5.4.6 to 5.4.12, 5.6.3 to 5.6.7 and 6.0.0 to 6.0.4 are vulnerable to a path traversal vulnerability within the SSL VPN web portal which allows unauthenticated attackers to download FortiOS system files through specially crafted HTTP requests. This module exploits this...
Fortinet FortiOS SSL VPN Buffer Overflow (CVE-2018-13381)
A buffer overflow vulnerability exists in Fortinet FortiOS. Successful exploitation of this vulnerability could result in a denial of service or execution of arbitrary code into the affected system...
VulnCheck KEV: CVE-2018-13374
Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server...
PT-2021-6855
Name of the Vulnerable Software and Affected Versions FortiOS versions prior to 7.0.1 Description A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS may allow an attacker to retrieve the key by reverse engineering. This issue is related to the use of a hard-coded...
Protect
When traffic other than HTTP/S eg: SSH traffic, etc... traverses the FortiOS on port 80/443, it is not redirected to the transparent proxy policy for processing, as it doesn't have a valid HTTP header...
Fortinet FortiOS < 6.0.11 / 6.2 < 6.2.5 / 6.4 < 6.4.2 Information Disclosure (FG-IR-20-103)
The remote host is running a version of FortiOS prior to 6.0.11, 6.2.x prior to 6.2.5, or 6.4.x prior to 6.4.2. It is, therefore, affected by an information disclosure vulnerability. A remote, authenticated attacker can exploit this, by executing 'get vpn ssl monitor', in order to read the SSL VP...
Fortinet FortiOS Information Disclosure Vulnerability
Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. An information disclosure...
PT-2021-30878
Name of the Vulnerable Software and Affected Versions FortiOS versions prior to 6.2.5 FortiOS version 6.0.10 and below Description The issue allows remote authenticated actors to read the SSL VPN events log entries of users in other VDOMs by executing get vpn ssl monitor from the CLI. The sensiti...
Fortinet Fortigate xss (FG-IR-20-068)
The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-20-068 advisory. - An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a...
Issues fixed in FortiOS
Fortinet has fixed multiple vulnerabilities in Fortinet products. The vulnerabilities allow a malicious person to execute attacks that potentially lead to: Cross-Site Scripting XSS. Circumvention of security measure Accessing sensitive data FortiNet has released updates to address the...
Fortinet FortiOS and Fortinet FortiClient Security Feature Issue Vulnerability
Fortinet FortiOS and Fortinet FortiClient are both products of the U.S. company Fita Fortinet.Fortinet FortiOS is a set of security operating system dedicated to the FortiGate network security platform. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and...
PT-2020-6791 · Fortinet · Fortios +1
Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS affected versions not specified Fortinet FortiClient for Mac affected versions not specified Description: The issue is related to a flaw in the Fortinet antivirus scanner, affecting FortiOS and FortiClient for Mac, which occu...
