CVE-2023-34992: Improper Neutralization of Special Elements used in an OS Command

A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet allows attacker to execute unauthorized code or commands via crafted API requests...

PT-2023-6016 · Fortinet · Fortinet Ips Engine +1

Name of the Vulnerable Software and Affected Versions: Fortinet IPS Engine versions 6.158, 7.166, 7.321 Description: The issue is related to an interpretation conflict in the Fortinet IPS Engine, which can be exploited by an attacker to evade IPS features. This can be achieved via crafted TCP...

Fortinet FortiWLM Operating System Command Injection Vulnerability

Fortinet FortiWLM is a wireless manager from Fortinet. A security vulnerability exists in Fortinet FortiWLM that stems from the presence of an operating system command injection vulnerability. The vulnerability allows an attacker to execute unauthorized code or commands via specially crafted http...

CVE-2023-34987: Improper Neutralization of Special Elements used in an OS Command

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters...

Fortinet FortiOS 安全漏洞

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. An Access Control Error...

CVE-2023-25604: Insertion of Sensitive Information into Log File

An insertion of sensitive information into log file vulnerability in Fortinet FortiGuest 1.0.0 allows a local attacker to access plaintext passwords in the RADIUS logs...

Fortinet FortiGuest Log Information Disclosure Vulnerability

Fortinet FortiGuest is a network visitor management solution from Fortinet that helps organizations manage and control visitor access on their networks. A security vulnerability exists in Fortinet FortiGuest that stems from sensitive information being written to log files. This allows a local...

Fortinet FortiManager Security Vulnerability

Fortinet FortiManager is a centralized network security management platform from Fortinet. The platform supports centralized management of any number of Fortinet devices and the ability to group devices into different administrative domains ADOMs to further simplify multi-device security deployme...

CVE-2023-44249: Authorization Bypass Through User-Controlled Key

An authorization bypass through user-controlled key CWE-639 vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 allows a remote attacker with low privileges to read sensitive information via crafted HTTP requests...

Rogue npm Package Deploys Open-Source Rootkit in New Supply Chain Attack

A new deceptive package hidden within the npm package registry has been uncovered deploying an open-source rootkit called r77, marking the first time a rogue package has delivered rootkit functionality. The package in question is node-hide-console-windows, which mimics the legitimate npm package...

Fortinet FortiProxy - SMTP password ciphertext exposure in Log (FG-IR-22-455)

The version of FortiProxy installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-455 advisory. - An insertion of sensitive information into log file vulnerability CWE-532 in FortiOS / FortiProxy log events may allow a...

PT-2023-6145 · Fortinet · Fortiwlm

Name of the Vulnerable Software and Affected Versions: Fortinet FortiWLM versions 8.5.0 through 8.5.4 Fortinet FortiWLM versions 8.6.0 through 8.6.5 Description: The issue exists due to improper neutralization of special elements used in an operating system command, allowing for os command...

PT-2023-6087 · Fortinet · Fortiwlm

Name of the Vulnerable Software and Affected Versions: Fortinet FortiWLM versions 8.5.0 through 8.5.4 Fortinet FortiWLM versions 8.6.0 through 8.6.5 Description: The issue is related to an improper neutralization of special elements used in an OS command, also known as 'OS command injection'. Thi...

Fortinet FortiClient Authorization Bypass RCE

The vulnerability of the Fortinet FortiClient security device for Windows relates to improper authentication. Exploiting this vulnerability allows an attacker to execute arbitrary code or commands using a specially created request...

Fortinet FortiClient Enterprise Management Server Unauthorized Access

The vulnerability of the server management interface for Fortinet FortiClient Enterprise Management Server EMS is related to insufficient protection of operational data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Fortinet Releases Security Updates for Multiple Products

Fortinet has released security updates to address vulnerabilities CVE-2023-29183 and CVE-2023-34984 affecting FortiOS, FortiProxy, and FortiWeb. A cyber threat actor can exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review...

Exploit for Improper Authentication in Fortinet Fortiproxy

CVE-2022-40684 CVE-2022-40684 - Auth bypass - Run exploit...

CVE-2023-36551

A exposure of sensitive information to an unauthorized actor in Fortinet FortiSIEM version 6.7.0 through 6.7.5 allows attacker to information disclosure via a crafted http request...

CVE-2023-34984

A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.6 through 6.3.23 allows attacker to execute unauthorized code or commands via specially crafted HTTP requests...

CVE-2023-34984

A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.6 through 6.3.23 allows attacker to execute unauthorized code or commands via specially crafted HTTP requests...