Design/Logic Flaw

A use of a broken or risky cryptographic algorithm CWE-327 in Fortinet FortiSIEM before 6.7.1 allows a remote unauthenticated attacker to perform brute force attacks on GUI endpoints via taking advantage of outdated hashing methods...

Design/Logic Flaw

A plaintext storage of a password vulnerability CWE-256 in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions may allow an attacker able to access user DB content to impersonate...

CVE-2023-26204

CVE-2023-26204 describes a plaintext storage of admin credentials in FortiSIEM, affecting Fortinet FortiSIEM versions 6.7, 6.6, 6.5, 6.4, 6.3, 6.2, 6.1, 5.4, and 5.3. The root cause is storage of passwords in plaintext (CWE-256), which may allow an attacker with access to the user database to imp...

CVE-2023-26204

A plaintext storage of a password vulnerability CWE-256 in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versions, 6.3 all versions, 6.2 all versions, 6.1 all versions, 5.4 all versions, 5.3 all versions may allow an attacker able to access user DB content to impersonate...

CVE-2022-43949

CVE-2022-43949 affects Fortinet FortiSIEM prior to 6.7.1, where the use of a broken or risky cryptographic algorithm (CWE-327) enables a remote unauthenticated attacker to perform brute force attacks on GUI endpoints by exploiting outdated hashing methods. The issue is documented across multiple ...

CVE-2022-43949

A use of a broken or risky cryptographic algorithm CWE-327 in Fortinet FortiSIEM before 6.7.1 allows a remote unauthenticated attacker to perform brute force attacks on GUI endpoints via taking advantage of outdated hashing methods...

CVE-2022-43949

A use of a broken or risky cryptographic algorithm CWE-327 in Fortinet FortiSIEM before 6.7.1 allows a remote unauthenticated attacker to perform brute force attacks on GUI endpoints via taking advantage of outdated hashing methods...

CVE-2022-42478

"CVE-2022-42478" affects FortiSIEM prior to 7.0.0 and describes an improper restriction of excessive authentication attempts that could let a non-privileged user brute‑force endpoints. The issue is tied to FortiSIEM’s authentication controls and may allow targeted endpoints to be attacked. The co...

CVE-2022-42478

An Improper Restriction of Excessive Authentication Attempts CWE-307 in FortiSIEM below 7.0.0 may allow a non-privileged user with access to several endpoints to brute force attack these endpoints...

CVE-2022-42478

An Improper Restriction of Excessive Authentication Attempts CWE-307 in FortiSIEM below 7.0.0 may allow a non-privileged user with access to several endpoints to brute force attack these endpoints...

Fortinet FortiSIEM 安全漏洞

Fortinet FortiSIEM is a suite of security information and event management systems from the American company Fiat Fortinet. The system includes features such as asset discovery, workflow automation and unified management. An access control error vulnerability exists in Fortinet FortiSIEM that ste...

Fortinet FortiSIEM 安全漏洞

Fortinet FortiSIEM is a suite of security information and event management systems from the American company Fiat Fortinet. The system includes features such as asset discovery, workflow automation, and unified management. A security vulnerability exists in Fortinet FortiSIEM that stems from...

Fortinet FortiSIEM 加密问题漏洞

Fortinet FortiSIEM is a suite of security information and event management systems from the American company Fiat Fortinet. The system includes features such as asset discovery, workflow automation and unified management. A security vulnerability exists in Fortinet FortiSIEM versions prior to 6.7...

FortiSIEM - Bruteforce of Exposed Endpoints

An improper restriction of excessive authentication attempts CWE-307 in FortiSIEM may allow a unauthenticated user with access to several endpoints to perform a brute force attack on these endpoints...

FortiSIEM - Plaintext credentials storage in DB

A plaintext storage of a password vulnerability CWE-256 in FortiSIEM may allow an attacker able to access user DB content to impersonate any admin user on the device GUI...

FortiSIEM - Use of a Broken or Risky Cryptographic Algorithm

A use of a broken or risky cryptographic algorithm CWE-327 in FortiSIEM may allow a remote unauthenticated attacker to perform brute force attacks on GUI endpoints via taking advantage of outdated hashing methods...

PT-2023-3351 · Fortinet · Fortisiem

Name of the Vulnerable Software and Affected Versions: FortiSIEM versions prior to 7.0.0 Description: The issue is related to an improper restriction of excessive authentication attempts, which may allow a non-privileged user with access to several endpoints to perform a brute force attack on the...

CVE-2022-0847 on Linux Kernel

A security advisory was released affecting a version of the Linux Kernel used in FortiAuthenticator, FortiProxy & FortiSIEM:...

The vulnerability of the command-line interface (CLI) of the security management system FortiSIEM, which allows a attacker to gain unauthorized access to protected information

The vulnerability of the command-line interface CLI of the security management system FortiSIEM is related to deficiencies in authentication procedures and the use of default credentials when connecting to the Glassfish server. Exploiting this vulnerability can allow an attacker to gain...

CVE-2022-26119

A improper authentication vulnerability in Fortinet FortiSIEM before 6.5.0 allows a local attacker with CLI access to perform operations on the Glassfish server directly via a hardcoded password...