CVE-2019-16153

Fortinet FortiSIEM is affected by CVE-2019-16153 due to a hard-coded credential vulnerability in the FortiSIEM database component (versions 5.2.5 and below). An attacker could gain unauthorized access to the device database via static credentials. Red Hat/Symantec and Fortinet advisories corrobor...

CVE-2019-16153

A hard-coded password vulnerability in the Fortinet FortiSIEM database component version 5.2.5 and below may allow attackers to access the device database via the use of static credentials...

CVE-2019-16153

A hard-coded password vulnerability in the Fortinet FortiSIEM database component version 5.2.5 and below may allow attackers to access the device database via the use of static credentials...

Unspecified Vulnerability in Fortinet FortiSIEM

Fortinet FortiSIEM is a suite of security information and event management systems from the American company Fiat Fortinet. The system includes features such as asset discovery, workflow automation and unified management. A security vulnerability exists in FortiSIEM 5.2.6 and earlier versions tha...

Policy Compliance Library Updates, January 2020

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

Adobe Patches Five Critical Illustrator CC Flaws

Adobe has released patches for five critical vulnerabilities in Adobe Illustrator CC, its popular vector graphics editor tool, which if exploited could enable arbitrary code execution. Overall Adobe patched nine vulnerabilities as part of its regularly-scheduled updates on Tuesday, including five...

Fortinet FortiSIEM CVE-2019-16153 Hardcoded Credentials Vulnerability

Description Fortinet FortiSIEM is prone to a hard-coded credentials vulnerability. An attacker can exploit this issue to gain unauthorized access to the vulnerable device and perform unauthorized actions. Versions prior to Fortinet FortiSIEM 5.2.6 are vulnerable. Technologies Affected Fortinet...

Fortinet FortiAuthenticator WEB UI Cross-Site Scripting Vulnerability

Fortinet FortiAuthenticator WEB UI is a centralized user identity management solution of the U.S. Fiat Fortinet company's Web interface. A cross-site scripting vulnerability exists in the login page in Fortinet FortiAuthenticator WEB UI version 6.0.0. The vulnerability stems from the WEB...

Fortinet FortiSIEM 5.2.5 / 5.2.6 Hardcoded Key

Vendor: Fortinet Product: FortiSIEM Tested version: 5.2.5, 5.2.6. I haven't confirmed older versions, but there is a good chance they're also affected. CVE: Fortinet hands out their own CVEs according to Mitre, and since no human confirmation was received by Fortinet, no CVE was created yet. ==...

Fortinet FortiAuthenticator CVE-2019-16154 Cross Site Scripting Vulnerability

Description Fortinet FortiAuthenticator is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...

Fortinet FortiOS < 5.6.10 / 6.0 < 6.0.7 / 6.2.x < 6.2.1 Vulnerable Encryption (FG-IR-19-007)

The remote host is running a version of FortiOS that has not yet enabled private-data-encryption. A authorized remote user with access or knowledge of the standard encryption key could gain access and decrypt the FortiOS backup files and all non-administor passwords and private keys.' CVE-2019-66...

Fortinet FortiSIEM Information Disclosure Vulnerability

Fortinet FortiSIEM is a suite of security information and event management systems from the American company Fiat Fortinet. The system includes features such as asset discovery, workflow automation and unified management. An information disclosure vulnerability exists in Fortinet FortiSIEM 5.2.2...

FortiOS 6.0.6 / FortiClientWindows 6.0.6 / FortiClientMac 6.2.1 XOR Encryption Vulnerability

Fortinet products, including FortiGate and Forticlient, regularly send information to Fortinet servers using XOR "encryption" with a static key. FortiClientWindows versions 6.0.6 and below, and FortiClientMac versions 6.2.1 and below. After this advisory was released, Fortinet has confirmed that...

Fortinet FortiGate Cross-Site Scripting Vulnerability

Fortinet FortiGate is a suite of network security platforms from the American company Fiat Fortinet. The platform provides firewall, antivirus and intrusion prevention IPS, application control, anti-spam, wireless controller and WAN acceleration. A cross-site scripting vulnerability exists in...

FortiOS 6.0.6 / FortiClientWindows 6.0.6 / FortiClientMac 6.2.1 XOR Encryption

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: FortiGuard XOR Encryption product: Multiple Fortinet Products see Vulnerable / tested versions vulnerable version: Multiple see Vulnerable / tested versions fixed version...

Fortinet FortiOS < 6.0.7 / 6.2.x < 6.2.2 Multiple Vulnerabilities (FG-IR-19-184, FG-IR-19-236)

The remote host is running a version of FortiOS prior to 6.0.7 or 6.2.x prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities : - A Cross-site Scripting XSS vulnerability in the FortiGate DHCP monitor page alllows an unauthenticated attacker in the same network as the FortiGate t...

Fortinet FortiClient < 6.2.0 Information Disclosure MitM (FG-IR-18-100)

The remote host is running a version of Fortinet FortiClient prior to 6.2.0. It is, therefore, affected by an information disclosure man-in-the-middle vulnerability in the FortiGuard services communication protocol due to the use of a hardcoded cryptographic key. A remote attacker with knowledge ...

Fortinet FortiGate CVE-2019-6697 HTML Injection Vulnerability

Description Fortinet FortiGate is prone to an HTML injection vulnerability because it fails to sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based...

Fortinet FortiOS < 5.6.12 / 6.x < 6.0.8 Information Disclosure MitM (FG-IR-18-100)

The remote host is running a version of FortiOS prior to 5.6.12 or 6.x prior to 6.0.8. It is, therefore, affected by an information disclosure man-in-the-middle vulnerability in the FortiGuard services communication protocol due to the use of a hardcoded cryptographic key. A remote attacker with...

Fortinet FortiClient < 6.2.2 Information Disclosure MitM (FG-IR-18-100) (macOS)

The remote macOS host is running a version of Fortinet FortiClient prior to 6.2.2. It is, therefore, affected by an information disclosure man-in-the-middle vulnerability in the FortiGuard services communication protocol due to the use of a hardcoded cryptographic key. A remote attacker with...