Fortinet FortiOS < 6.0.10 / 6.2.x < 6.2.4 / 6.4.x < 6.4.1 Improper Authentication (FG-IR-19-283)

The remote host is running a version of FortiOS prior to 6.0.10, 6.2.x prior to 6.2.4, or 6.4.x prior to 6.4.1. It is, therefore, affected by an improper authentication vulnerability due to an issue with the 'username-case-sensitivity' CLI attribute for the SSL VPN. An unauthenticated, remote...

PT-2020-6794

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.0.10 and below FortiOS versions 6.2.2 and below FortiProxy versions 1.0.x FortiProxy versions 1.1.x FortiProxy versions 1.2.9 and below FortiProxy versions 2.0.0 and below Description A Stack-based Buffer Overflow...

Vulnerability fixed in FortiOS

A vulnerability has been fixed in FortiOS. The vulnerability allows an authenticated malicious party the ability to cause a denial-of-service denial-of-service. Fortinet has released updates to fix the vulnerability. More information can be found on the page below:...

FortiOS LCP Message Denial of Service Vulnerability

Fortinet FortiOS is a dedicated security operating system on the FortiGate network security platform. A denial-of-service vulnerability exists in Fortinet FortiOS handling of LCP messages, which can be exploited by a remote attacker to submit a special oversized LCP message request that can crash...

Vulnerabilities fixed in FortiOS

Vulnerabilities have been fixed in FortiOS. The vulnerabilities allow an authenticated remote malicious agent to opportunity to cause a denial-of-service via an SSL VPN. To exploit the vulnerability, a number of non-standard settings must have been made. FortiNet categorizes these vulnerabilities...

PT-2020-6796 · Fortinet · Forticlient +1

Name of the Vulnerable Software and Affected Versions: FortiOS versions 6.0.10 and below FortiOS versions 5.6.12 and below Description: The issue is related to a stack-based buffer overflow in the FortiClient NAC daemon fcnacd that can be exploited by a remote attacker authenticated to the SSL VP...

Vulnerability fixed in FortiOS

Fortinet has fixed a vulnerability in FortiOS. The vulnerability allows a malicious party to perform a Cross-Site Scripting XSS attack. The vulnerability arises from incorrect input validation when generating a Web page in the SSL VPN portal. Fortinet has released updates to fix the vulnerability...

PT-2020-22818

Name of the Vulnerable Software and Affected Versions FortiProxy versions 1.2.9 and below, version 2.0.0 FortiOS versions 5.6.12, 6.0.8 and below, 6.2.1 and below Description The issue is related to an improper neutralization of input during web page generation in the SSL VPN portal, which may...

Fortinet FortiOS Cross-Site Scripting (CVE-2017-14186)

A cross-site scripting vulnerability exists in Fortinet fortios x under 5.0. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the affected system...

XSS vulnerability in FortiOS SSLVPN Portal

...

CVE-2019-5591

A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server...

CVE-2019-5591

A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server...

Default configuration

A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server...

CVE-2019-5591

A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server...

CVE-2019-5591

A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server...

CVE-2019-5591

CVE-2019-5591 in FortiOS is a default-configuration vulnerability that allows an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating an LDAP server, enabling man‑in‑the‑middle credential exposure. A PoC (GitHub: fortios-ldap-mitm-poc-CVE-2019-5591) demo...

CVE-2019-5591

A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server. Recent assessments: ccondon-r7 at April 05, 2021 2:16pm UTC reported: One of three vulnerabilities CISA and the FBI have...

CVE-2019-5591: Missing Authentication for Critical Function

A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server...

Improper Check for Certificate Revocation (FG-IR-19-144)

The remote host is affected by an improper check for certificate revocation vulnerability. Certificates taken out of service could potentially be improperly re-used. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid139546; scriptversion"1.2";...

Fortinet FortiOS SSL VPN Authorization Issues Vulnerability

Fortinet FortiOS is a set of security operating systems dedicated to the FortiGate network security platform from the U.S. company Fiat Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam, etc. SSL VPN is one of the virtual private netwo...