CVE-2019-5590

The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands Cross Site Scripting via attack reports generated in HTML form...

CVE-2019-5590

The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands Cross Site Scripting via attack reports generated in HTML form...

CVE-2019-5590

CVE-2019-5590 affects Fortinet FortiWeb 6.0.2 and earlier. The root cause is that the URL part of the report message is not encoded, enabling Cross-Site Scripting (XSS) via HTML-formatted attack reports. Potential impact: attacker may cause client-side code execution in a user’s browser. Exploita...

Fortinet FortiOS 5.6.0 < 5.6.8 / 6.0.x < 6.0.5 multiple pre-auth XSS vulnerabilities on SSL VPN (FG-IR-18-383)

A Cross-site Scripting XSS vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or message handling parameters. TRUSTED...

Fortinet FortiOS (Mac OS X) 5.6.0 < 5.6.8 / 6.0.x < 6.0.5 multiple pre-auth XSS vulnerabilities on SSL VPN (FG-IR-18-383) (deprecated)

The plugin was deprecated due to checking hosts for FortiClient instead of FortiOS. Use fortiosFG-IR-18-383.nasl plugin ID 128278 instead. C Tenable Network Security, Inc. @DEPRECATED@ Disabled on 2020/11/18. Deprecated by fortiosFG-IR-18-383.nasl include"compat.inc"; if description scriptid12827...

WordPress Nextgen Gallery plugin <= 3.2.8 - SQL Injection vulnerability

SQL Injection vulnerability found by Tin Duong Fortinet FortiGuard Labs in WordPress Nextgen Gallery plugin versions = 3.2.8. Solution Update the WordPress Nextgen Gallery plugin to the latest available version at least 3.2.10...

Fortinet FortiNAC Cross-Site Scripting Vulnerability

Fortinet FortiNAC is a set of network access control solutions from the U.S. company Fita Fortinet. The product is mainly used for network access control and IoT security. A cross-site scripting vulnerability exists in Fortinet FortiNAC. The vulnerability stems from the lack of proper validation ...

CVE-2019-6695

Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-party programs by recreating the image through specific methods...

CVE-2019-6695

Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-party programs by recreating the image through specific methods...

Code injection

Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-party programs by recreating the image through specific methods...

Cross site scripting

An Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI...

CVE-2019-5594

An Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI...

CVE-2019-5594

The CVE-2019-5594 entry describes a reflected XSS in Fortinet FortiNAC admin webUI, exploitable without authentication via the search field. Affected versions are FortiNAC 8.3.0–8.3.6 and 8.5.0. The vulnerability arises from improper input neutralization during web page generation. Multiple conne...

CVE-2019-6695

CVE-2019-6695 affects Fortinet FortiManager VM image packages (versions 6.2.0, 6.0.6 and below). The root cause is lack of root file system integrity checking, which could let an attacker recreate the VM image and implant third‑party programs before boot. Documented impact is image-level tamperin...

CVE-2019-6695

Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below may allow an attacker to implant third-party programs by recreating the image through specific methods...

Fortinet FortiManager VM Input Validation Error Vulnerability

Fortinet FortiManager VM is a centralized network security management platform for virtual machines from Fortinet. The platform can group devices into different management domains ADOM for security deployment and management. An input validation error vulnerability exists in Fortinet FortiManager ...

FortiOS 5.6.3 - 5.6.7 FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure

FortiOS 5.6.3 - 5.6.7 FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure Exploit Title: FortiOS Leak file - Reading login/passwords in clear text. Google Dork: intext:"Please Login" inurl:"/remote/login" Date: 17/08/2019 Exploit Author: Carlos E. Vieira Vendor Homepage: https://www.fortinet.com/...

FortiOS 5.6.7 / 6.0.4 Credential Disclosure

Exploit Title: FortiOS Leak file - Reading login/passwords in clear text. Google Dork: intext:"Please Login" inurl:"/remote/login" Date: 17/08/2019 Exploit Author: Carlos E. Vieira Vendor Homepage: https://www.fortinet.com/ Software Link: https://www.fortinet.com/products/fortigate/fortios.html...

Fortinet FortiOS 5.6.3 - 5.6.7 / FortiOS 6.0.0 - 6.0.4 - Credentials Disclosure (Metasploit)

Exploit Title: Fortinet FortiOS Leak file - Reading login/passwords in clear text. Google Dork: intext:"Please Login" inurl:"/remote/login" Date: 17/08/2019 Exploit Author: Carlos E. Vieira Vendor Homepage: https://www.fortinet.com/ Software Link:...

Fortinet FortiOS Information Disclosure Vulnerability (CNVD-2019-27254)

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. An information disclosure...