FortiClient SSLVPN 5.4 - Credentials Disclosure

''' Title : Extracting clear text passwords from running processesFortiClient CVE-ID : none Product : FortiClient SSLVPN Service : FortiTray.exe Affected : =5.4 Impact : Critical Remote : No Website link : http://forticlient.com/ Reported : 31/08/2016 Authors : Viktor Minin https://1-33-7.com...

Fortinet FortiGate RSA-CRT Key Leak Vulnerability (FG-IR-16-008)

FortiOS now includes for all SSL libraries a countermeasure against Lenstra SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

[SECURITY] Fedora 24 Update: NetworkManager-fortisslvpn-1.2.0-1.fc24

This package contains software for integrating VPN capabilities with the Fortinet compatible SSLVPN server with NetworkManager...

[SECURITY] Fedora 24 Update: NetworkManager-fortisslvpn-1.2.0-0.4.beta3.fc24

This package contains software for integrating VPN capabilities with the Fortinet compatible SSLVPN server with NetworkManager...

CVE-2015-7362

Fortinet FortiClient Linux SSLVPN before build 2313, when installed on Linux in a home directory that is world readable and executable, allows local users to gain privileges via the helper/subroc setuid program...

Design/Logic Flaw

Fortinet FortiClient Linux SSLVPN before build 2313, when installed on Linux in a home directory that is world readable and executable, allows local users to gain privileges via the helper/subroc setuid program...

CVE-2015-7362

CVE-2015-7362 affects Fortinet FortiClient Linux SSLVPN prior to build 2313. When installed in a home directory that is world-readable and -executable, local users can escalate privileges via the helper/subroc setuid program (local privilege escalation). Affected component is the FortiClient SSLV...

CVE-2015-7362

Fortinet FortiClient Linux SSLVPN before build 2313, when installed on Linux in a home directory that is world readable and executable, allows local users to gain privileges via the helper/subroc setuid program...

CVE-2015-7362: Undefined Security Weakness

Fortinet FortiClient Linux SSLVPN before build 2313, when installed on Linux in a home directory that is world readable and executable, allows local users to gain privileges via the helper/subroc setuid program...

PT-2016-3749

Name of the Vulnerable Software and Affected Versions Fortinet FortiClient Linux SSLVPN versions prior to build 2313 Description The issue allows local users to gain privileges via the helper/subroc setuid program when Fortinet FortiClient Linux SSLVPN is installed on Linux in a home directory th...

FortiClient SSLVPN Linux client local privilege escalation vulnerability

...

Cross site scripting

Cross-site scripting XSS vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-1880

Cross-site scripting XSS vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-1880: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2015-3367

Name of the Vulnerable Software and Affected Versions FortiOS versions 5.2.x through 5.2.2 Description The issue is related to a cross-site scripting XSS vulnerability in the sslvpn login page. This vulnerability is caused by insufficient protection of the web page structure, allowing remote...

Fortinet FortiADC sslvpn login page cross-site scripting vulnerability

Fortinet FortiADC is a load balancing service solution. A cross-site scripting vulnerability exists in the Fortinet FortiADC sslvpn login page, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive...

Novell Access Management SSLVPN Server Security Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/22787/info Novell Access Management SSLVPN Server is prone to a security-bypass vulnerability. A remote authenticated attacker can exploit this issue to access corporate resources normally restricted within VPN access...

Cisco IOS SSL VPN拒绝服务漏洞

CVECAN ID: CVE-2014-2112 Cisco IOS是多数思科系统路由器和网络交换机上使用的互联网络操作系统。 Cisco IOS 15.1-15.4版本内的SSL VPN功能存在安全漏洞，远程攻击者通过特制的HTTP请求，利用此漏洞可造成拒绝服务（内存耗尽）。 0 Cisco IOS 15.1-15.4 Cisco已经为此发布了一个安全公告（cisco-sa-20140326-ios-sslvpn）以及相应补丁:...

Juniper Secure Access crossite scripting

Crossite scripting in SSLVPN...

CVE-2012-3923

The SSLVPN implementation in Cisco IOS 12.4, 15.0, 15.1, and 15.2, when DTLS is not enabled, does not properly handle certain outbound ACL configurations, which allows remote authenticated users to cause a denial of service device crash via a session involving a PPP over ATM PPPoA interface, aka...