Plain-text credentials in GET request via SSL VPN web portal

...

Improper authorization via prof-admin profile

...

PT-2023-6004 · Fortinet · Fortios

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 7.0.0 through 7.0.12 Fortinet FortiOS versions 7.2.0 through 7.2.5 Fortinet FortiOS version 7.4.0 Description: The issue is related to the use of the GET request method with sensitive query strings in Fortinet FortiO...

Fortinet FortiOS IPS Engine Security Vulnerability

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering, and antispam security features. A security vulnerability exists in the...

Fortinet FortiOS Security Vulnerabilities

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with a variety of security features such as firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam. A security vulnerabili...

Fortinet FortiOS and FortiProxy Resource Management Error Vulnerability

Fortinet FortiOS and Fortinet FortiProxy are both products of Fortinet, Inc. Fortinet FortiOS is a dedicated security operating system on the FortiGate network security platform. The system provides users with a variety of security features such as firewall, antivirus, IPSec/SSLVPN, Web content...

PT-2023-6005 · Fortinet · Fortios

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 7.0.0 through 7.0.11 Fortinet FortiOS versions 7.2.0 through 7.2.4 Description: The issue is related to an improper authorization vulnerability in Fortinet FortiOS, which may allow an attacker belonging to the...

Fortinet FortiOS Security Vulnerabilities

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering, and antispam security features. A security vulnerability exists in Fortinet...

Webproxy process denial of service

...

IPS Engine evasion using custom TCP flags

...

PT-2023-6002 · Fortinet · Fortiproxy +1

Name of the Vulnerable Software and Affected Versions: FortiOS versions 7.0.0 through 7.0.10 FortiOS versions 7.2.0 through 7.2.4 FortiProxy versions 7.0.0 through 7.0.8 FortiProxy versions 7.2.0 through 7.2.2 Description: A use after free vulnerability in FortiOS and FortiProxy may allow an...

REST API trusted host bypass

...

HTML injection in SAML and Security Fabric components

...

PT-2023-5999 · Fortinet · Fortios

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 7.2.0 through 7.2.4 Fortinet FortiOS version 7.4.0 Description: The issue is related to improper access control in the FortiOS REST API component, allowing an attacker to access restricted resources from non-trusted...

Fortinet FortiProxy's map server (FG-IR-22-468)

The version of FortiProxy installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-468 advisory. - An improper certificate validation vulnerability CWE-295 in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through...

Fortinet FortiProxy - SMTP password ciphertext exposure in Log (FG-IR-22-455)

The version of FortiProxy installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-455 advisory. - An insertion of sensitive information into log file vulnerability CWE-532 in FortiOS / FortiProxy log events may allow a...

The vulnerability of the graphical interface of FortiOS operating systems and the proxy server used for protecting against Internet attacks, FortiProxy, arises from the lack of measures taken to protect the structure of web pages. This allows attackers to execute arbitrary JavaScript code.

The vulnerability of the graphical interface of FortiOS operating systems and the proxy server used for protecting against Internet attacks FortiProxy exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to execute...

Fortinet Releases Security Updates for Multiple Products

Fortinet has released security updates to address vulnerabilities CVE-2023-29183 and CVE-2023-34984 affecting FortiOS, FortiProxy, and FortiWeb. A cyber threat actor can exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review...

Vulnerability fixed in FortiOS

Fortinet has fixed a vulnerability in FortiOS and FortiProxy. A malicious party could exploit the vulnerability to launch a Cross-Site Scripting attack. Such an attack can lead to execution of arbitrary code in the browser of the victim. Because the vulnerability is located in the guest-managemen...

CVE-2023-29183

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability CWE-79 in FortiProxy 7.2.0 through 7.2.4, 7.0.0 through 7.0.10 and FortiOS 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, 6.2.0 through 6.2.14 GUI may allow an authenticated...