CVE-2024-23109

An improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests...

Fortinet FortiSIEM 操作系统命令注入漏洞

Fortinet FortiSIEM is a suite of security information and event management systems from the American company Fiat Fortinet. The system includes features such as asset discovery, workflow automation and unified management. Fortinet FortiSIEM suffers from an operating system command injection...

PT-2024-1547

Name of the Vulnerable Software and Affected Versions Fortinet FortiSIEM versions 6.4.0 through 6.4.2 Fortinet FortiSIEM versions 6.5.0 through 6.5.2 Fortinet FortiSIEM versions 6.6.0 through 6.6.3 Fortinet FortiSIEM versions 6.7.0 through 6.7.8 Fortinet FortiSIEM versions 7.0.0 through 7.0.2...

Fortinet FortiSIEM 操作系统命令注入漏洞

Fortinet FortiSIEM is a suite of security information and event management systems from the American company Fiat Fortinet. The system includes features such as asset discovery, workflow automation and unified management. Fortinet FortiSIEM suffers from an operating system command injection...

Chinese Hackers Silently Weaponized VMware Zero-Day Flaw for 2 Years

An advanced China-nexus cyber espionage group previously linked to the exploitation of security flaws in VMware and Fortinet appliances has been attributed to the abuse of a critical vulnerability in VMware vCenter Server as a zero-day since late 2021. "UNC3886 has a track record of utilizing...

PT-2024-4054 · Fortinet · Fortiauthenticator

Name of the Vulnerable Software and Affected Versions: Fortinet FortiAuthenticator versions 6.4.9 and below Fortinet FortiAuthenticator versions 6.5.3 and below Fortinet FortiAuthenticator version 6.6.0 Description: The issue is related to an open redirect in the Fortinet FortiAuthenticator, whic...

The vulnerability of the Fortinet FortiPortal security analysis and management tool, related to access control deficiencies, allows attackers to escalate their privileges.

The vulnerability of the Fortinet FortiPortal security analysis and management tool is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to enhance their privileges by sending specially crafted HTTP requests remotely...

Fortinet FortiPortal Access Control Error Vulnerability

Fortinet FortiPortal is an advanced, feature-rich hosted security analysis and management support tool for Fortinet's FortiGate, FortiWiFi and FortiAP product lines, available as a virtual machine for MSPs. An Access Control Error vulnerability exists in Fortinet FortiPortal versions 7.0.0 throug...

Fortinet FortiPAM Resource Management Error Vulnerability

Fortinet FortiPAM is the United States of America Fitta Fortinet, a privilege access control platform. A resource management error vulnerability exists in Fortinet FortiPAM version 1.0, which stems from unrestricted resource allocation. An attacker could exploit this vulnerability to perform a...

Fortinet FortiVoice Path Traversal Vulnerability

Fortinet FortiVoice is a network communications solution from Fortinet, Inc. A path traversal vulnerability exists in FortiVoice fortivoice. The vulnerability stems from the program failing to properly filter for special elements in the path of a resource or file. An attacker could exploit this...

Fortinet FortiOS Privilage Escalation (FG-IR-23-315)

The version of FortiOS installed on the remote host is prior to tested version. It is, therefore, affected by an improper privilege management vulnerability CWE-269 in a FortiOS & FortiProxy HA cluster may allow an authenticated attacker to perform elevated actions via crafted HTTP or HTTPS...

Vulnerability fixed in Fortinet FortiOS and FortiProxy

Fortinet has fixed a vulnerability in FortiOS and FortiProxy. An authenticated malicious party can exploit the vulnerability to execute commands on the system that it is initially is not authorized to do. Fortinet has released an update to fix the vulnerability fix in FortiOS and FortiProxy. For...

CVE-2023-46712

A improper access control in Fortinet FortiPortal version 7.0.0 through 7.0.6, Fortinet FortiPortal version 7.2.0 through 7.2.1 allows attacker to escalate its privilege via specifically crafted HTTP requests...

CVE-2023-44250

An improper privilege management vulnerability CWE-269 in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0 through 7.4.1 allows an authenticated attacker to perform elevated actions via crafted HTTP or HTTPS requests...

Privilege escalation

An improper privilege management vulnerability CWE-269 in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0 through 7.4.1 allows an authenticated attacker to perform elevated actions via crafted HTTP or HTTPS requests...

Improper access control

A improper access control in Fortinet FortiPortal version 7.0.0 through 7.0.6, Fortinet FortiPortal version 7.2.0 through 7.2.1 allows attacker to escalate its privilege via specifically crafted HTTP requests...

Patch now! First patch Tuesday of 2024 is here

Microsoft has issued patches for 48 security vulnerabilities in the first Patch Tuesday of 2024. With a relatively low number of patches—and only two of them critical—this makes it a relatively quiet month, which is certainly not the norm in January. The Common Vulnerabilities and Exposures CVE...

CVE-2023-44250

An improper privilege management vulnerability CWE-269 in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0 through 7.4.1 allows an authenticated attacker to perform elevated actions via crafted HTTP or HTTPS requests...

CVE-2023-44250

CVE-2023-44250 describes an improper privilege management (CWE-269) in Fortinet FortiOS HA clusters (versions 7.4.0–7.4.1 and 7.2.5) and FortiProxy HA clusters (7.4.0–7.4.1). An authenticated attacker can perform elevated actions via crafted HTTP(S) requests. The CVSS v3.1 base score is 8.8 (Netw...

CVE-2023-44250

An improper privilege management vulnerability CWE-269 in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0 through 7.4.1 allows an authenticated attacker to perform elevated actions via crafted HTTP or HTTPS requests...