CVE-2019-15703

Fortinet FortiOS is affected by CVE-2019-15703 where insufficient entropy in the PRNG (DRBG) can theoretically allow recovery of a long-term ECDSA secret in a TLS client with RSA handshake and mutual ECDSA authentication, via flush+reload side-channel attacks in FortiGate VM models only. The vuln...

CVE-2019-6692

Fortinet FortiClient for Windows

CVE-2019-6692

A malicious DLL preload vulnerability in Fortinet FortiClient for Windows 6.2.0 and below allows a privileged attacker to perform arbitrary code execution via forging that DLL...

Unspecified Vulnerability in Fortinet FortiOS

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. A security vulnerability exists i...

Operating System (OS) Detection (PPTP)

PPTP service based Operating System OS detection. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fortinet FortiOS CVE-2019-15703 Insufficient Entropy Vulnerability

Description Fortinet FortiOS is prone to an insufficent entropy vulnerability. Remote attackers can exploit this issue to perform side-channel attacks and obtain sensitive information. This aids in other attacks. Technologies Affected Fortinet FortiOS 2.36.0 Fortinet FortiOS 2.50.0 Fortinet Forti...

Fortinet FortiMail Multiple Remote Privilege Escalation Vulnerability

Description Fortinet FortiMail is prone to multiple remote prone privilege-escalation vulnerability. An attacker can exploit these issues to gain elevated privileges, obtain sensitive information or cause denial-of-service conditions. Technologies Affected Fortinet FortiMail 5.4.0 Fortinet...

Fortinet FortiOS SSL VPN Directory Traversal (CVE-2018-13379)

A directory traversal vulnerability exists in Fortinet FortiOS. Successful exploitation of this vulnerability could allow an attacker to access arbitrary files on the affected system...

The vulnerability in the web-management interface of the Fortinet FortiNAC device allows a perpetrator to execute a cross-site scripting attack.

The vulnerability in the Fortinet FortiNAC network access control web interface relates to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

APT Groups Exploiting Flaws in Unpatched VPNs, Officials Warn

State-sponsored advanced persistent threat APT groups are using flaws in outdated VPN technologies from Palo Alto Networks, Fortinet and Pulse Secure to carry out cyber attacks on targets in the United States and overseas, warned U.S. and U.K. officials. The National Security Agency NSA issued a...

VulnCheck KEV: CVE-2018-13379

Fortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests...

VulnCheck KEV: CVE-2018-13383

A heap buffer overflow in Fortinet FortiOS and FortiProxy may cause the SSL VPN web service termination for logged in users...

VulnCheck KEV: CVE-2018-13382

An Improper Authorization vulnerability in Fortinet FortiOS and FortiProxy under SSL VPN web portal allows an unauthenticated attacker to modify the password...

Fortinet FortiClient Enterprise Management Server Cross-Site Scripting Vulnerability

Fortinet FortiClient Enterprise Management Server EMS is a FortiClient Enterprise Manager from Fortinet. It is designed for scalable and centralized management of multiple FortiClients. A cross-site scripting vulnerability exists in Fortinet FortiClient EMS 6.2.0 and earlier versions, which stems...

Exploit for Path Traversal in Fortinet Fortiproxy

FortiOS-Credentia...

PT-2019-6280 · Fortinet · Forticlient Enterprise Management Server

Name of the Vulnerable Software and Affected Versions: Fortinet FortiClient Enterprise Management Server EMS affected versions not specified Description: The issue is related to the lack of protection measures for the web page structure during its creation, which can be exploited by a remote...

Fortinet FortiOS SSL VPN Directory Traversal Vulnerability (FG-IR-18-384) (Direct Check)

The remote host is running a version of FortiOS 5.6.3 prior to 5.6.8 or 6.0.x prior to 6.0.5. It is, therefore, affected by a directory traversal vulnerability in the SSL VPN web portal, due to improper sanitization of path traversal characters in URLs. An unauthenticated, remote attacker can...

CVE-2019-5590

The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands Cross Site Scripting via attack reports generated in HTML form...

CVE-2019-5590

The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands Cross Site Scripting via attack reports generated in HTML form...

Cross site scripting

The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands Cross Site Scripting via attack reports generated in HTML form...