Fortinet FortiGate XSS Vulnerability (FG-IR-14-003)

FortiOS as used in FortiGate is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2015-1571

The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the FortinetFactory certificate and...

Design/Logic Flaw

DISPUTED The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the FortinetFactory certificate...

CVE-2015-1571

The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the FortinetFactory certificate and...

CVE-2015-1571

Fortinet FortiOS 5.0 Patch 7 (build 4457) CAPWAP DTLS uses the same Fortinet_Factory certificate and private key across different customer installations. This configuration could enable an attacker to perform a man‑in‑the‑middle by spoofing SSL servers leveraging the Fortinet_Factory cert. Some s...

PT-2015-3369 · Fortinet · Fortios

Name of the Vulnerable Software and Affected Versions: FortiOS version 5.0 Patch 7 build 4457 Description: The CAPWAP DTLS protocol implementation in FortiOS uses the same certificate and private key across different customers' installations. However, according to FG-IR-15-002, the Fortinet Facto...

Fortinet FortiOS HTML Injection Vulnerability

Fortinet FortiOS is a set of security operating system developed by the U.S. company Fita Fortinet dedicated to the FortiGate platform, which provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering, anti-spam and other security features. An HTML injection vulnerability exist...

Fortinet FortiOS Information Disclosure Vulnerability (CNVD-2015-00916)

Fortinet FortiOS is a set of security operating system developed by the U.S. company Fita Fortinet dedicated to the FortiGate platform, which provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering, anti-spam and other security features. An information disclosure vulnerabili...

CVE-2015-1451

Multiple cross-site scripting XSS vulnerabilities in Fortinet FortiOS 5.0 Patch 7 build 4457 allow remote authenticated users to inject arbitrary web script or HTML via the 1 WTP Name or 2 WTP Active Software Version field in a CAPWAP Join request...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Fortinet FortiOS 5.0 Patch 7 build 4457 allow remote authenticated users to inject arbitrary web script or HTML via the 1 WTP Name or 2 WTP Active Software Version field in a CAPWAP Join request...

Design/Logic Flaw

The Control and Provisioning of Wireless Access Points CAPWAP daemon in Fortinet FortiOS 5.0 Patch 7 build 4457 allows remote attackers to cause a denial of service locked CAPWAP Access Controller via a large number of ClientHello DTLS messages...

CVE-2015-1452

The CVE-2015-1452 issue affects Fortinet FortiOS 5.0 Patch 7 build 4457, specifically the CAPWAP daemon. An attacker can trigger a denial of service by sending a flood of ClientHello DTLS messages, which can lock the CAPWAP Access Controller. The available connected records confirm the affected c...

CVE-2015-1452

The Control and Provisioning of Wireless Access Points CAPWAP daemon in Fortinet FortiOS 5.0 Patch 7 build 4457 allows remote attackers to cause a denial of service locked CAPWAP Access Controller via a large number of ClientHello DTLS messages...

CVE-2015-1451

Multiple cross-site scripting XSS vulnerabilities in Fortinet FortiOS 5.0 Patch 7 build 4457 allow remote authenticated users to inject arbitrary web script or HTML via the 1 WTP Name or 2 WTP Active Software Version field in a CAPWAP Join request...

CVE-2015-1451

CVE-2015-1451 refers to multiple XSS vulnerabilities in Fortinet FortiOS 5.0 Patch 7 (build 4457) affecting the CAPWAP server. The issue allows remote authenticated users to inject arbitrary web script or HTML via the WTP Name or WTP Active Software Version fields in a CAPWAP Join request. Affect...

Fortinet FortiOS Denial of Service Vulnerability (CNVD-2015-00852)

Fortinet FortiOS is a set of security operating system developed by the U.S. company Fita Fortinet dedicated to the FortiGate platform, which provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering, anti-spam and other security features. The Fortinet FortiOS denial of servic...

Fortinet FortiOS Denial Of Service / Man-In-The-Middle

, , . '.' '. ', . , '. , .', , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' =''"''=. presents.. Fortinet FortiOS Multiple Vulnerabilities Affected Versions: Verified on FortiOS Firmware v5.0,build4457 GA Patch 7 PDF:...

Fortinet FortiOS < 4.3.16 / 5.x < 5.0.8 Multiple Vulnerabilities (FG-IR-14-006)

The remote host is running FortiOS prior to 4.3.16 or 5.x prior to 5.0.8. It is, therefore, affected by the following vulnerabilities : - A flaw exists within the FortiManager service when handling incoming requests. Using a specially crafted request, a remote attacker can exploit this to cause a...

FortiNet FortiGate and FortiWiFi appliances contain multiple vulnerabilities

Overview Fortinet FortiGate and FortiWiFi appliances are susceptible to man-in-the-middle attacks CWE-300 and a heap-based overflow vulnerability CWE-122. Description Fortinet FortiGate and FortiWiFi 4.00.6 and possibly earlier versions are susceptible to man-in-the-middle attacks CWE-300 and a...

CVE-2014-0351

The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.x before 5.0.8 on FortiGate devices does not prevent use of anonymous ciphersuites, which makes it easier for man-in-the-middle attackers to obtain sensitive information or interfere with communications by modifying the...