5941 matches found
Fortinet Fortigate Authentication bypass in Node.js websocket module and CSF requests (FG-IR-24-535)
The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the FG-IR-24-535 advisory. - An Authentication Bypass Using an Alternate Path or Channel vulnerability CWE-288 affecting FortiOS 7.0.0 through...
Fortinet FortiClient CVE-2023-4863 - Heap overflow in Chrome/libwebp (FG-IR-23-381) (macOS)
The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-381 advisory. - Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to...
Fortinet FortiWeb sqli (FG-IR-24-465)
The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-465 advisory. - A improper neutralization of special elements used in an sql command 'sql injection' in Fortinet FortiWeb versions 6.3.17...
The vulnerability of the VCM software, a security tool from Fortinet for Linux systems, relates to insecure privilege management. This vulnerability allows an attacker to elevate their privileges to the root level.
The vulnerability of the VCM software, a security tool from Fortinet’s FortiClient for Linux, is related to insecure management of privileges. Exploiting this vulnerability allows an attacker, operating remotely, to elevate their privileges to the root level...
PT-2025-15434 · Fortinet · Forticlient
Name of the Vulnerable Software and Affected Versions: Fortinet FortiClient versions prior to 7.4.1 Description: The issue is related to an improper neutralization of input during web page generation, also known as Cross-site Scripting. This may allow the EMS administrator to send messages...
Fortinet FortiClient 7.0.x < 7.0.14 / 7.2.x < 7.2.7 / 7.4.x < 7.4.2 Information Disclosure (FG-IR-23-278)
The version of Fortinet FortiClient running on the remote host is prior to 7.0.14, 7.2.7, or 7.4.2. It is, therefore, affected by a an information disclosure vulnerability due to the use of a hard-coded cryptographic key to encrypt security sensitive data in configuration. An attacker with access...
The vulnerability of the Fortinet FortiClient security device, related to errors in the certificate validation process, allows a perpetrator to execute a type of “man-in-the-middle” attack.
The vulnerability of the Fortinet FortiClient security device is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to carry out a “man-in-the-middle” attack...
Fortinet FortiWLM Path Traversal Vulnerability (CNVD-2024-4963848)
Fortinet FortiWLM is a wireless manager from Fortinet, Inc. Fortinet FortiWLM suffers from a path traversal vulnerability that stems from the program failing to properly filter for specific elements in the path to a resource or file. An attacker could use this vulnerability to execute unauthorize...
Fortinet FortiManager Operating System Command Injection Vulnerability
Fortinet FortiManager is a centralized network security management platform from Fortinet. The platform supports centralized management of any number of Fortinet devices, and can group devices into different management domains ADOM to further simplify the deployment and management of multi-device...
The vulnerability of the Fortinet FortiManager software, a centralized device management tool, arises from the lack of measures to neutralize specific elements, allowing a perpetrator to execute arbitrary code.
The vulnerability of the Fortinet FortiManager device management software is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Fortinet Releases Security Updates for FortiManager
Fortinet released a security update to address a vulnerability in FortiManager. A remote cyber threat actor could exploit this vulnerability to take control of an affected system. Users and administrators are encouraged to review the following Fortinet Security Bulletin and apply the necessary...
Hackers Exploiting Critical Fortinet EMS Vulnerability to Deploy Remote Access Tools
A now-patched critical security flaw impacting Fortinet FortiClient EMS is being exploited by malicious actors as part of a cyber campaign that installed remote desktop software such as AnyDesk and ScreenConnect. The vulnerability in question is CVE-2023-48788 CVSS score: 9.3, an SQL injection bu...
The vulnerability of the imagename handler in the CGI script /ems/cgi-bin/ezrf-lighttpd.cgi of the graphical interface for managing WLAN access points and LAN switches in Fortinet FortiWLM allows a attacker to execute arbitrary code.
The vulnerability of the imagename handler in the CGI script /ems/cgi-bin/ezrf-lighttpd.cgi of the graphical interface for managing WLAN access points and LAN switches in Fortinet FortiWLM is related to an incorrect limitation on the path name to the restricted directory. Exploiting this...
Vulnerability fixed in FortiManager
Fortinet has fixed a vulnerability in FortiManager. The vulnerability is in the OS command injection in FortiManager, which allows authenticated remote attackers to execute unauthorized code via specially crafted FGFM requests. Fortinet has released updates to fix the vulnerability. See attached...
CVE-2023-48782
creationtimestamp| type| source ---|---|--- 2024-12-19 14:06:21+00:00| seen| https://t.me/truesecator/6558 2024-12-19 21:29:13+00:00| seen| https://www.darkreading.com/vulnerabilities-threats/fortinet-addresses-unpatched-critical-rce-vector 2025-09-15 13:28:31+00:00| seen|...
CVE-2021-32589
A Use After Free CWE-416 vulnerability in FortiManager version 7.0.0, version 6.4.5 and below, version 6.2.7 and below, version 6.0.10 and below, version 5.6.10 and below, version 5.4.7 and below, version 5.2.10 and below, version 5.0.12 and below and FortiAnalyzer version 7.0.0, version 6.4.5 an...
CVE-2021-32589
A Use After Free CWE-416 vulnerability in FortiManager version 7.0.0, version 6.4.5 and below, version 6.2.7 and below, version 6.0.10 and below, version 5.6.10 and below, version 5.4.7 and below, version 5.2.10 and below, version 5.0.12 and below and FortiAnalyzer version 7.0.0, version 6.4.5 an...
Attackers exploiting a patched FortiClient EMS vulnerability in the wild
Introduction During a recent incident response, Kaspersky's GERT team identified a set of TTPs and indicators linked to an attacker that infiltrated a company's networks by targeting a Fortinet vulnerability for which a patch was already available. This vulnerability is an improper filtering of S...
Fortinet Warns of Critical FortiWLM Flaw That Could Lead to Admin Access Exploits
Fortinet has issued an advisory for a now-patched critical security flaw impacting Wireless LAN Manager FortiWLM that could lead to disclosure of sensitive information. The vulnerability, tracked as CVE-2023-34990, carries a CVSS score of 9.6 out of a maximum of 10.0. It was originally fixed by...