679 matches found
CVE-2020-15937
An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack XSS via the IPS and WAF logs dashboard...
CVE-2020-15937
Fortinet FortiGate devices running FortiOS 6.2.x before 6.2.5 and 6.4.x before 6.4.1 are vulnerable to a stored cross‑site scripting (XSS) via the IPS/WAF logs dashboard caused by improper input neutralization. A remote attacker could exploit this via the logs dashboard. The connected documents p...
CVE-2020-15937
An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a remote attacker to perform a stored cross site scripting attack XSS via the IPS and WAF logs dashboard...
FortiOS Path Traversal Credential Gatherer
Fortinet FortiOS versions 5.4.6 to 5.4.12, 5.6.3 to 5.6.7 and 6.0.0 to 6.0.4 are vulnerable to a path traversal vulnerability within the SSL VPN web portal which allows unauthenticated attackers to download FortiOS system files through specially crafted HTTP requests. This module exploits this...
XSS vulnerability in the Security Profiles comments section in FortiGate Cloud
An improper neutralization of input vulnerability in FortiGate Cloud may allow a remote authenticated attacker to perform a stored cross site scripting attack XSS via the comments section of the Security Profiles...
RZK Fortilogger Code Issue Vulnerability
RZK Fortilogger is a system from RZK Turkey that provides instant status tracking, logging, searching/filtering, reporting, and hotspotting for the FortiGate firewall on Windows systems. A security vulnerability exists in FortiLogger 4.4.2.2, which originates from being affected by arbitrary file...
Vulnerability fixed in FortiGate
A remotely authenticated malicious person is able to view the log entries of SSL VPN events from users in other VDOMs by executing "get vpn ssl monitor" from the command line. The sensitive data includes usernames, user groups and IP addresses. FortiGuard has made updates available to fix the...
Protect
An exposure of sensitive information to an unauthorized actor vulnerability in FortiGate may allow a remote authenticated attacker to read the SSL VPN events log entries of users in other VDOMs by executing "get vpn ssl monitor" from the CLI. The sensitive data includes usernames, user groups, a...
Fortinet Fortigate xss (FG-IR-20-068)
The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-20-068 advisory. - An improper neutralization of input vulnerability in FortiGate version 6.2.x below 6.2.5 and 6.4.x below 6.4.1 may allow a...
Protect
An improper neutralization of input vulnerability in the FortiGate may allow a remote attacker to perform a stored cross site scripting attack XSS via the IPS and WAF logs dashboard...
Fortinet FortiGate Cross-Site Scripting Vulnerability
Fortinet FortiGate is a suite of network security platforms from the U.S.-based company Fiat Fortinet. The platform provides firewall, antivirus and intrusion prevention IPS, application control, anti-spam, wireless controller and WAN acceleration. FortiGate suffers from a cross-site scripting...
Hackers leak login credentials of vulnerable Fortinet SSL VPNs
By Sudais Asif A hacker using the alias "pumpedkicks" has published a large list of one-line exploits of around 50,000 Fortinet FortiGate IPs. Find out what happened. This is a post from HackRead.com Read the original post: Hackers leak login credentials of vulnerable Fortinet SSL VPNs...
Fortinet FortiOS Information Disclosure Vulnerability (CNVD-2020-62939)
Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. A security vulnerability exists i...
CVE-2020-6648
A cleartext storage of sensitive information vulnerability in FortiOS command line interface in versions 6.2.4 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an authenticated attacker to obtain sensitive information such as users passwords by connecting to FortiGate CLI and executi...
Fortinet FortiOS Buffer Overflow Vulnerability (CNVD-2020-63948)
Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. A buffer error vulnerability exis...
Unspecified Vulnerability in Fortinet FortiGate (CNVD-2021-33534)
Fortinet FortiGate is a suite of network security platforms from the American company Fiat Fortinet. The platform provides firewall, antivirus and intrusion prevention IPS, application control, anti-spam, wireless controller and WAN acceleration. A security vulnerability exists in FortiGate...
FortiOS LCP Message Denial of Service Vulnerability
Fortinet FortiOS is a dedicated security operating system on the FortiGate network security platform. A denial-of-service vulnerability exists in Fortinet FortiOS handling of LCP messages, which can be exploited by a remote attacker to submit a special oversized LCP message request that can crash...
Fortinet VPN with Default Settings Leave 200,000 Businesses Open to Hackers
As the pandemic continues to accelerate the shift towards working from home, a slew of digital threats have capitalized on the health concern to exploit weaknesses in the remote work infrastructure and carry out malicious attacks. Now according to network security platform provider SAM Seamless...
FortiGate SSL VPN "Breaching the Fort"
Security researchers at SAM Seamless Network published a blog post on September 24, 2020 stating that 200,000 businesses were exposed to Man-in-the-Middle MITM attacks against FortiGate SSL VPNs due to the VPN client’s failure to properly verify the server’s certificate out of the box. Instead,...