CVE-2020-15936

Fortinet FortiGate has a CVE-2020-15936 vulnerability due to improper input validation that enables disclosure of sensitive information via SNI Client Hello TLS packets. Affected versions are FortiGate 6.4.3 and below, 6.2.5 and below, 6.0.11 and below, and 5.6.13 and below. The issue is document...

CVE-2022-22300

A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.11, FortiAnalyzer version 6.2.0 through 6.2.9, FortiAnalyzer version 6.4.0 through 6.4.7, FortiAnalyzer version 7.0.0 through 7 .0.2,...

CVE-2022-22300

CVE-2022-22300 affects Fortinet FortiAnalyzer and FortiManager across multiple release lines (FortiAnalyzer 5.6.0–5.6.11, 6.0.0–6.0.11, 6.2.0–6.2.9, 6.4.0–6.4.7, 7.0.0–7.0.2; FortiManager 5.6.0–5.6.11, 6.0.0–6.0.11, 6.2.0–6.2.9, 6.4.0–6.4.7, 7.0.0–7.0.2). The root cause is improper handling of in...

CVE-2022-22300

A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.11, FortiAnalyzer version 6.2.0 through 6.2.9, FortiAnalyzer version 6.4.0 through 6.4.7, FortiAnalyzer version 7.0.0 through 7 .0.2,...

CVE-2021-43075

CVE-2021-43075 affects Fortinet FortiWLM (FortiWLM) where an improper neutralization of special elements used in OS commands allows an attacker to execute arbitrary commands via crafted HTTP requests to the alarm dashboard and controller configuration handlers. Affected versions include 8.6.2 and...

CVE-2021-43075

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to...

CVE-2021-43075

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to...

Fortinet FortiWLM SQL注入漏洞

Fortinet FortiWLC is a wireless LAN controller from Fortinet, Inc. An SQL injection vulnerability exists in Fortinet FortiWLC, which stems from insufficient cleaning of user-supplied data in the AP monitoring handler, and could be exploited to send specially crafted requests to affected...

Fortinet FortiGate 输入验证错误漏洞

Fortinet FortiGate, a next-generation firewall product developed by Fortinet, is vulnerable to an input validation error that could be exploited to disclose sensitive information via SNI client Hello TLS packets...

Fortinet FortiWLM 操作系统命令注入漏洞

A command injection vulnerability exists in Fortinet FortiWLC, a wireless LAN controller from Fortinet, which stems from a failure to properly validate input data in the alert dashboard and controller configuration handler. HTTP requests and execute arbitrary operating system commands on the targ...

Fortinet FortiPortal 安全特征问题漏洞

Fortinet FortiPortal is an advanced, feature-rich managed security analysis and management support tool for Fortinet's FortiGate, FortiWiFi, and FortiAP product lines, available as a virtual machine for use by MSPs. versions, a security feature issue vulnerability exists that stems from the use o...

Fortinet FortiGate 信息泄露漏洞

Fortinet FortiGate is a network security platform from Fortinet, Inc. The platform provides firewall, anti-virus and intrusion prevention IPS, application control, anti-spam, wireless controller, and WAN acceleration.Fortinet fortimanager has an access control error vulnerability that is caused b...

Fortinet FortiOS 7.0.x < 7.0.2 Path Traversal (FG-IR-21-181)

The remote host is running a version of FortiOS that is 7.0.x prior to 7.0.2. It is, therefore, affected by a path traversal vulnerability that may allow an unauthenticated, unauthorized attacker to inject path traversal character sequences to disclose sensitive information of the server via the...

Iranian Hackers Targeting VMware Horizon Log4j Flaws to Deploy Ransomware

A "potentially destructive actor" aligned with the government of Iran is actively exploiting the well-known Log4j vulnerability to infect unpatched VMware Horizon servers with ransomware. Cybersecurity firm SentinelOne dubbed the group "TunnelVision" owing to their heavy reliance on tunneling...

Fortinet Fortimail 7.0.1 - Reflected Cross-Site Scripting Vulnerability

Exploit Title: Fortinet Fortimail 7.0.1 - Reflected Cross-Site Scripting XSS Google Dork: inurl:/fmlurlsvc/ Exploit Author: Braiant Giraldo Villa Contact: @ironfortress Twitter Vendor Homepage: https://www.fortinet.com/products/email-security Software Link:...

Fortinet Fortimail 7.0.1 - Reflected Cross-Site Scripting (XSS)

Exploit Title: Fortinet Fortimail 7.0.1 - Reflected Cross-Site Scripting XSS Google Dork: inurl:/fmlurlsvc/ Date: 01-Feb-2022 Exploit Author: Braiant Giraldo Villa Contact: @ironfortress Twitter Vendor Homepage: https://www.fortinet.com/products/email-security Software Link:...

Fortinet Fortimail 7.0.1 Cross Site Scripting

Exploit Title: Fortinet Fortimail 7.0.1 - Reflected Cross-Site Scripting XSS Google Dork: inurl:/fmlurlsvc/ Date: 01-Feb-2022 Exploit Author: Braiant Giraldo Villa Contact: @ironfortress Twitter Vendor Homepage: https://www.fortinet.com/products/email-security Software Link:...

Fortinet FortiWeb OS Command Injection Vulnerability

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. fortinet FortiWeb An operating system comman...

Fortinet FortiWeb Buffer Overflow Vulnerability (CNVD-2022-19074)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. Versions prior to 6.4.2 contain a buffer...

Fortinet FortiWeb OS Command Injection Vulnerability (CNVD-2022-09243)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure web applications and protect sensitive database content. A security vulnerability exists that stems...