CVE-2013-1414

Multiple cross-site request forgery CSRF vulnerabilities in Fortinet FortiOS on FortiGate firewall devices before 4.3.13 and 5.x before 5.0.2 allow remote attackers to hijack the authentication of administrators for requests that modify 1 settings or 2 policies, or 3 restart the device via a...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Fortinet FortiOS on FortiGate firewall devices before 4.3.13 and 5.x before 5.0.2 allow remote attackers to hijack the authentication of administrators for requests that modify 1 settings or 2 policies, or 3 restart the device via a...

CVE-2013-1414

CVE-2013-1414 applies to Fortinet FortiOS on FortiGate devices. The issue is multiple CSRF vulnerabilities in the web UI that allow an attacker to hijack an administrator’s authenticated session and perform actions such as modifying settings, changing firewall policies, or reboot/shutdown command...

CVE-2013-1414: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Fortinet FortiOS on FortiGate firewall devices before 4.3.13 and 5.x before 5.0.2 allow remote attackers to hijack the authentication of administrators for requests that modify 1 settings or 2 policies, or 3 restart the device via a...

PT-2013-1314

Name of the Vulnerable Software and Affected Versions FortiOS versions prior to 4.3.13 FortiOS versions 5.x prior to 5.0.2 Description The issue is related to a lack of authentication check for HTTP requests in the web interface of the FortiOS operating system. This can be exploited by a remote...

CVE-2013-4604

Fortinet FortiOS before 5.0.3 on FortiGate devices does not properly restrict Guest capabilities, which allows remote authenticated users to read, modify, or delete the records of arbitrary users by leveraging the Guest role...

Design/Logic Flaw

Fortinet FortiOS before 5.0.3 on FortiGate devices does not properly restrict Guest capabilities, which allows remote authenticated users to read, modify, or delete the records of arbitrary users by leveraging the Guest role...

CVE-2013-4604

Fortinet FortiOS before 5.0.3 on FortiGate devices does not properly restrict Guest capabilities, which allows remote authenticated users to read, modify, or delete the records of arbitrary users by leveraging the Guest role...

CVE-2013-4604

Fortinet FortiOS prior to 5.0.3 on FortiGate devices is affected by CVE-2013-4604 due to improper restriction of the Guest user capabilities. This allows remote authenticated users with the Guest role to read, modify, or delete records of arbitrary users. The issue stems from insufficient access ...

PT-2013-5089

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions prior to 5.0.3 Description The issue allows remote authenticated users to read, modify, or delete the records of arbitrary users by leveraging the Guest role, due to improper restriction of Guest capabilities...

CVE-2013-4604: Undefined Security Weakness

Fortinet FortiOS before 5.0.3 on FortiGate devices does not properly restrict Guest capabilities, which allows remote authenticated users to read, modify, or delete the records of arbitrary users by leveraging the Guest role...

Fortigate UTM WAF Appliance - Multiple Web Vulnerabilities

Title: ====== Fortigate UTM WAF Appliance - Multiple Web Vulnerabilities Date: ===== 2012-09-06 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=557 VL-ID: ===== 557 Common Vulnerability Scoring System: ==================================== 5 Introduction: ============= T...

Fortigate UTM WAF Appliance - Multiple Vulnerabilities

Title: ====== Fortigate UTM WAF Appliance - Multiple Web Vulnerabilities Date: ===== 2012-09-06 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=557 VL-ID: ===== 557 Common Vulnerability Scoring System: ==================================== 5 Introduction: ============= T...

PT-2012-1200

Name of the Vulnerable Software and Affected Versions Fortinet FortiGate UTM WAF appliances with FortiOS versions prior to 4.3.6 Description The issue allows remote attackers to inject arbitrary web script or HTML via several vectors, including the Endpoint Monitor, Dialup List, or Log&Report...

CVE-2006-3222

The FTP proxy module in Fortinet FortiOS FortiGate before 2.80 MR12 and 3.0 MR2 allows remote attackers to bypass anti-virus scanning via the Enhanced Passive EPSV FTP mode...

CVE-2006-3222

The FTP proxy module in Fortinet FortiOS FortiGate before 2.80 MR12 and 3.0 MR2 allows remote attackers to bypass anti-virus scanning via the Enhanced Passive EPSV FTP mode...

CVE-2006-3222

The vulnerability CVE-2006-3222 affects Fortinet FortiOS FortiGate devices where the FTP proxy module (before 2.80 MR12 and 3.0 MR2) can bypass antivirus scanning by abusing Enhanced Passive (EPSV) FTP mode. Affected product: FortiGate/FortiOS FTP proxy. Root cause: FTP proxy mishandles EPSV in a...

CVE-2006-3222: Undefined Security Weakness

The FTP proxy module in Fortinet FortiOS FortiGate before 2.80 MR12 and 3.0 MR2 allows remote attackers to bypass anti-virus scanning via the Enhanced Passive EPSV FTP mode...

CVE-2005-3058

Fortinet FortiGate/FortiOS 2.8MR10 and FortiGate v3beta expose a vulnerability where remote attackers can bypass the URL blocker by using HTTP requests terminated with a line feed (LF) instead of CRLF or by requests without a Host header. This interpretation conflict in parsing HTTP requests is t...

CVE-2005-3057: Undefined Security Weakness

The FTP component in FortiGate 2.8 running FortiOS 2.8MR10 and v3beta, and other versions before 3.0 MR1, allows remote attackers to bypass the Fortinet FTP anti-virus engine by sending a STOR command and uploading a file before the FTP server response has been sent, as demonstrated using LFTP...