CVE-2017-17540

CVE-2017-17540 concerns Fortinet FortiWLC 8.3.3, where a hardcoded account creates unauthorized read/write access via a remote shell. Connected sources corroborate a hardcoded credential issue in FortiWLC 8.3.3 with remote shell access enabling reading/writing capabilities. The exact root cause, ...

CVE-2017-17539

The presence of a hardcoded account in Fortinet FortiWLC 7.0.11 and earlier allows attackers to gain unauthorized read/write access via a remote shell...

CVE-2017-17539

The presence of a hardcoded account in Fortinet FortiWLC 7.0.11 and earlier allows attackers to gain unauthorized read/write access via a remote shell...

CVE-2017-17540

The presence of a hardcoded account in Fortinet FortiWLC 8.3.3 allows attackers to gain unauthorized read/write access via a remote shell...

CVE-2017-17540

The presence of a hardcoded account in Fortinet FortiWLC 8.3.3 allows attackers to gain unauthorized read/write access via a remote shell...

Authentication flaw

Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2335 and below versions, due to the use of a static encryption key and weak...

CVE-2017-17543

Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2335 and below versions, due to the use of a static encryption key and weak...

CVE-2017-17543

Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2335 and below versions, due to the use of a static encryption key and weak...

CVE-2017-17543

Fortinet CVE-2017-17543 affects FortiClient for Windows (5.6.0 and earlier), FortiClient for macOS (5.6.0 and earlier), and FortiClient SSLVPN Client for Linux (4.4.2335 and earlier). The root cause is unsafe credential handling due to use of a static encryption key and weak encryption algorithms...

CVE-2017-17543

Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2335 and below versions, due to the use of a static encryption key and weak...

PyRoMine malware disables security & mines Monero using NSA exploits

By Waqas The IT security researchers at Fortinet have discovered a dangerous new This is a post from HackRead.com Read the original post: PyRoMine malware disables security & mines Monero using NSA exploits...

submission.fortinet.com XSS vulnerability

Open Bug Bounty ID: OBB-597411 Description| Value ---|--- Affected Website:| submission.fortinet.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Fortinet FortiWeb Access Control Error Vulnerability

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content. A...

Improper access control

An Improper Access Control vulnerability in Fortinet FortiWeb 5.6.0 up to but not including 6.1.0 under "Signed Security Mode", allows attacker to bypass the signed user cookie protection by removing the FortiWeb own protection session cookie...

CVE-2017-14191

An Improper Access Control vulnerability in Fortinet FortiWeb 5.6.0 up to but not including 6.1.0 under "Signed Security Mode", allows attacker to bypass the signed user cookie protection by removing the FortiWeb own protection session cookie...

CVE-2017-14191

Fortinet FortiWeb is affected by CVE-2017-14191. In FortiWeb 5.6.0 up to but not including 6.1.0, operating under Signed Security Mode, an improper access control vulnerability allows an attacker to bypass the cookie protection by removing FortiWeb’s own protection session cookie. Impact stated: ...

CVE-2017-14191

An Improper Access Control vulnerability in Fortinet FortiWeb 5.6.0 up to but not including 6.1.0 under "Signed Security Mode", allows attacker to bypass the signed user cookie protection by removing the FortiWeb own protection session cookie...

CVE-2017-14191

An Improper Access Control vulnerability in Fortinet FortiWeb 5.6.0 up to but not including 6.1.0 under "Signed Security Mode", allows attacker to bypass the signed user cookie protection by removing the FortiWeb own protection session cookie...

Value of Integrations Highlighted At Fortinet’s Accelerate 18 Conference

Changing the hearts and minds of security teams is no easy task. Everyone has been told for so long how to protect their environment, and more importantly how to buy the various tools needed to enable that protection. Collectively we’ve adopted the unintentional job of assuming all these things...

Fortinet FortiGate FortiDB Cross-Site Scripting Vulnerability

Fortinet FortiGate FortiDB is a scalable database security solution developed by the United States Fita Fortinet. A cross-site scripting vulnerability exists in the Java number format exception handling in Fortinet FortiGate FortiDB versions prior to 4.4.2. A remote attacker can exploit this...