CVE-2021-22189

Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that could result in authentication issues...

Fortinet FortiProxy SSL VPN 安全漏洞

Fortinet FortiProxy SSL VPN is a software application from Fortinet. It provides an intrusion detection feature. A security vulnerability exists in FortiProxy SSL VPN that can be exploited by an attacker to obtain the credentials of logged in SSL VPN users...

PT-2021-14900 · Gitlab +1 · Gitlab Ce/Ee +2

Name of the Vulnerable Software and Affected Versions: Gitlab CE/EE versions 13.7 and later Description: The issue is related to the validation of certificates for the Fortinet OTP, which could result in authentication issues. Recommendations: For Gitlab CE/EE versions 13.7 and later, update to a...

Gitlab 信任管理问题漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A trust management issue vulnerability exists in Gitlab...

FortiProxy SSL VPN user credential plaintext storage

...

FortiOS Path Traversal Credential Gatherer

Fortinet FortiOS versions 5.4.6 to 5.4.12, 5.6.3 to 5.6.7 and 6.0.0 to 6.0.4 are vulnerable to a path traversal vulnerability within the SSL VPN web portal which allows unauthenticated attackers to download FortiOS system files through specially crafted HTTP requests. This module exploits this...

ASUS RT-AX86U Buffer Overflow (CVE-2020-36109)

A buffer overflow vulnerability exists in Fortinet ASUS RT-AX86U. Successful exploitation of this vulnerability could result in a denial of service or execution of arbitrary code into the affected system...

Fortinet FortiOS SSL VPN Buffer Overflow (CVE-2018-13381)

A buffer overflow vulnerability exists in Fortinet FortiOS. Successful exploitation of this vulnerability could result in a denial of service or execution of arbitrary code into the affected system...

VulnCheck KEV: CVE-2018-13374

Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server...

CVE-2020-6649

An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

Session fixation

An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

CVE-2020-6649

CVE-2020-6649 affects FortiIsolator 2.0.1 and earlier. Insufficient session expiration could let an attacker reuse unexpired admin session IDs to gain admin privileges if the session ID is obtained (as noted in Fortinet advisory FG-IR-20-011). Affected version lineage: FortiIsolator 2.0.1 and bel...

CVE-2020-6649

An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

CVE-2020-6649

An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

Fortinet FortiWeb Cross-Site Scripting Vulnerability (CNVD-2021-12664)

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content. A...

Fortinet FortiWeb Stack Buffer Overflow Vulnerability

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content. A...

Fortinet FortiWeb 跨站脚本漏洞

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content. A...

Fortinet FortiOS < 6.0.11 / 6.2 < 6.2.5 / 6.4 < 6.4.2 Information Disclosure (FG-IR-20-103)

The remote host is running a version of FortiOS prior to 6.0.11, 6.2.x prior to 6.2.5, or 6.4.x prior to 6.4.2. It is, therefore, affected by an information disclosure vulnerability. A remote, authenticated attacker can exploit this, by executing 'get vpn ssl monitor', in order to read the SSL VP...

Fortinet FortiOS Information Disclosure Vulnerability

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. An information disclosure...

Fortinet FortiWeb 缓冲区错误漏洞

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content. A...