CVE-2022-29057: Improper Neutralization of Input During Web Page Generation

A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiEDR version 5.1.0, 5.0.0 through 5.0.3 Patch 6 and 4.0.0 allows a remote authenticated attacker to perform a reflected cross site scripting attack XSS by injecting malicious payload into the...

PT-2022-19394

Name of the Vulnerable Software and Affected Versions Fortinet FortiEDR versions 4.0.0, 5.0.0 through 5.0.3 Patch 6, 5.1.0 Description The issue is related to improper neutralization of input during web page generation, also known as cross-site scripting. This allows a remote authenticated attack...

Fortinet FortiOS Buffer Overflow (FG-IR-21-206)

The remote host is running a version of FortiOS that is 6.0.x through 6.0.14, 6.2.x through 6.2.10, 6.4.x through 6.4.8, or 7.0.x through 7.0.2. It is, therefore, affected by a stack-based buffer overflow vulnerability. An authenticated, remote attacker can exploit this issue, via specially craft...

Fortinet FortiOS 7.0.x <= 7.0.5 / 6.4.x <= 6.4.9 XSS (FG-IR-21-057)

The remote host is running a version of FortiOS that is 7.0.x through 7.0.5 or 6.4.x through 6.4.9. It is, therefore, affected by a cross-site scripting XSS vulnerability due to improper neutralization of input during web page generation. An unauthenticated, remote attacker can exploit this, by...

Fortinet FortiOS Buffer Overflow (FG-IR-21-206)

The remote host is running a version of FortiOS that is 6.0.x through 6.0.14, 6.2.x through 6.2.10, 6.4.x through 6.4.8, or 7.0.x through 7.0.5. It is, therefore, affected by a buffer overflow vulnerability. An authenticated, remote attacker can exploit this issue, via the TFTP protocol with...

Fortinet FortiOS Integer Overflow (FG-IR-21-155)

An integer overflow vulnerability in the dhcpd daemon of FortiOS allows unauthenticated, adjacent attackers to cause a denial of service DoS condition. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. C Tenable, Inc...

Fortinet FortiADC SQL Injection Vulnerability

Fortinet FortiADC is an application delivery controller from Fortinet, Inc. Fortinet FortiADC suffers from a SQL injection vulnerability that stems from insufficient cleanup of user-supplied data in the FortiADC management interface. A remote attacker could exploit this vulnerability to send a...

Cisco and Fortinet Release Security Patches for Multiple Products

Cisco on Wednesday rolled out patches for 10 security flaws spanning multiple products, one of which is rated Critical in severity and could be weaponized to conduct absolute path traversal attacks. The issues, tracked as CVE-2022-20812 and CVE-2022-20813, affect Cisco Expressway Series and Cisco...

Fortinet FortiOS cross-site scripting vulnerability

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering, anti-spam, and other security features. A cross-site scripting vulnerabilit...

Fortinet FortiProxy buffer error vulnerability

Fortinet FortiProxy is a secure network proxy from Fortinet that protects employees from cyberattacks by combining multiple detection technologies such as Web filtering, DNS filtering, DLP, anti-virus, intrusion prevention, and advanced threat protection.FortiProxy helps reduce bandwidth...

Fortinet FortiManager buffer error vulnerability

Fortinet FortiManager is a centralized network security management platform from Fortinet. The platform supports centralized management of any number of Fortinet devices, and the ability to group devices into different management domains ADOM to further simplify multi-device security deployment a...

PT-2022-6091

Name of the Vulnerable Software and Affected Versions Fortinet FortiManager versions 6.0.x through 7.0.3 Fortinet FortiAnalyzer versions 6.0.x through 7.0.3 Description The issue exists due to improper neutralization of special elements used in an operating system command, allowing an attacker to...

Fortinet FortiClient path traversal vulnerability

Fortinet FortiClient is a structured agent from Fortinet, Inc. It is used to provide protection, compliance, and secure access in a single modular lightweight client. A path traversal vulnerability exists in Fortinet FortiClient that stems from an input validation error when processing a director...

Fortinet FortiNAC security vulnerability

Fortinet FortiNAC is a set of network access control solutions from the U.S. company Fita Fortinet. The product is primarily used for network access control and IoT security. A security vulnerability exists in Fortinet FortiNAC, which originates from a root account that accesses the MySQL databas...

Fortinet FortiDeceptor path traversal vulnerability

Fortinet FortiDeceptor is a cyber threat detection platform from the American company Fiat Fortinet. The platform exposes cyber threats, among other things, through spoofing techniques. Fortinet FortiDeceptor suffers from a path traversal vulnerability that stems from an input validation error wh...

Fortinet FortiVoice: Input validation vulnerability

Fortinet FortiVoice is a network communications solution from Fortinet, Inc. An input validation error vulnerability exists in Fortinet FortiVoice. An attacker could exploit this vulnerability by sending specially crafted traffic to an affected system, triggering an integer overflow and performin...

Fortinet FortiOS < 6.4 MitM (FG-IR-18-292)

An improper certificate validation vulnerability in FortiOS allows an adjacent, unauthenticated attacker to man-in-the-middle communication. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. C Tenable, Inc...

Fortinet FortiClient 6.0.x / 6.2.x / 6.4.x < 6.4.7 / 7.x < 7.0.1 Privilege Escalation (FG-IR-21-088)

The version of Fortinet FortiClient running on the remote host is affected by a privilege escalation vulnerability. An unsafe search path vulnerability in FortiClien Windows 7.0.0, 6.4.6 and below, 6.2.x, and 6.0.x may allow an attacker to perform a DLL Hijack attack on affected devices via a...

Vulnerability fixed in Fortinet products

Vulnerabilities have been fixed in several products from Fortinet. The vulnerabilities allow a malicious party to execute attacks that result in the following categories of damage: Cross-Site Scripting XSS. Manipulation of data Circumvention of security measure Remote code execution...

Fortinet FortiAP-U path traversal vulnerability

Fortinet FortiAP-U is a controller for managing wireless access point devices from Fortinet, Inc. A path traversal vulnerability exists in the Fortinet FortiAP-U that stems from an input validation error when processing a directory traversal sequence in certain CLI commands. A local attacker coul...