898 matches found
Incorrect user management behavior leads to passwordless admin
...
CVE-2022-22965 and CVE-2022-22963 vulnerabilities
Two distinct spring project vulnerabilities where released recently with critical CVSS score and classified as zero-Day attacks. The two vulnerabilities are currently known as : CVE-2022-22965 or Spring4Shell: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remot...
Kr00k vulnerability (CVE-2019-15126) in Broadcom and Cypress Wi-Fi chips
During the RSA conference of February 26th 2020, researchers Štefan Svorencík and Robert Lipovsky disclosed a vulnerability in the implementation of the wireless egress packet processing of certain Broadcom Wi-Fi chipsets. This vulnerability is referenced as CVE-2019-15126 and could allow an...
Protect
Failure to sanitize the login redir parameter in the SSL-VPN web portal may allow an attacker to perform a Cross-site Scripting XSS or an URL Redirection attack...
Protect
TCP stacks that lack RFC 5961 3.2 & 4.2 support or have it disabled at application level may allow remote attackers to guess sequence numbers and cause a denial of service connection loss to persistent TCP connections by repeatedly injecting a TCP RST or SYN packet...
Heap buffer underflow in administrative interface
...
FortiProxy - system file leak through SSL VPN special crafted HTTP resource requests
A path traversal vulnerability in the FortiProxy SSL VPN web portal may allow a non-authenticated, remote attacker to download FortiProxy system files through specially crafted HTTP resource requests...
Path traversal in execute command
...
Protect
An improper neutralization of input during web page generation vulnerability CWE-79 in FortiProxy and FortiOS web filter override form may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests...
Protect
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted...
Authentication bypass in administrative interface
...
Multiple vulnerabilities in Apache Airflow
Security advisories were released affecting the version of Apache Airflow library used in some Fortinet products:...
FortiManager/FortiAnalyzer - XSS Vulnerability in Report Templates
An improper neutralization of input during web page generation vulnerability CWE-79 in FortiManager and FortiAnalyzer report templates may allow a low privilege level attacker to perform an XSS attack via posting a crafted CKeditor "protected" comment as described in CVE-2020-9281...
Apache log4j2 log messages substitution (CVE-2021-44228)
Apache Log4j =2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when...
Flaws over DHCP and DNS keys encryption scheme
...
FortiOS TCP timestamp response
FortiOS by default enables TCP timestamp response, which may lead to information disclosure...
CVE-2015-4000 "Logjam" attack
...
Protect
A path traversal vulnerability in the FortiOS SSL VPN web portal may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests...
Ability to modify privileges from Custom to Read-Write
...
FortiAP & FortiAP-S & FortiAP-W2 & FortiAP-U - Command injection in CLI
An improper neutralization of special elements CWE-89 used in an OS command vulnerability CWE-78 in the command line interpreter of FortiAP, FortiAP-S, FortiAP-W2 and FortiAP-U may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing...
Protect
An exposure of sensitive information to an unauthorized actor vulnerability in FortiGate may allow a remote authenticated attacker to read the SSL VPN events log entries of users in other VDOMs by executing "get vpn ssl monitor" from the CLI. The sensitive data includes usernames, user groups, a...
Information disclosure in web proxy error pages
...
CVE-2022-0847 on Linux Kernel
A security advisory was released affecting a version of the Linux Kernel used in FortiAuthenticator, FortiProxy & FortiSIEM:...
FortiWeb is vulnerable to a blind SQL injection
A blind SQL injection in the user interface of FortiWeb may allow an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sending a request with a crafted Authorization header containing a malicious SQL statement...
FortiADC - OS command injection vulnerability in CLI
An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in FortiADC may allow an authenticated attacker to execute arbitrary shell code as root via CLI commands...
CVE-2015-0235 "GHOST" vulnerability
...
OpenSSL3 CVE-2022-3602 CVE-2022-3786 vulnerabilities
...
ROCA: Vulnerable RSA key pairs generation (CVE-2017-15361)
An old Infineon RSA library does not properly generate RSA key pairs, therefore enabling an attacker to potentially infer a private key from a public key...
FortiNAC - External Control of File Name or Path in keyUpload scriptlet
An external control of file name or path vulnerability CWE-73 in FortiNAC webserver may allow an unauthenticated attacker to perform arbitrary write on the system...
Protect
A security advisory was released affecting  the version of OpenSSL library used in some Fortinet products:...
SMTP password ciphertext exposure in Log
...
Protect
FortiGate's and FortiADC's read-only admins are able to point an LDAP server connectivity test request to a rogue LDAP server instead of the configured one, in order to obtain the LDAP server login credentials configured in the FortiGate...
CSV injection in macro name
...
Telnet on the SSL-VPN interface results in information leak
...
FortiManager --- Password observed in cleartext in the config conflict file
...
Format String Bug in Fclicense daemon
...
Arbitrary read/write vulnerability in administrative interface
...
FortiWeb - Stack-based buffer overflows in Proxyd
Multiple stack-based buffer overflow vulnerabilities CWE-121 in FortiWeb's proxy daemon may allow an unauthenticated remote attacker to achieve arbitrary code execution via specifically crafted HTTP requests...
Multiple products cross-site scripting vulnerabilities
...
Protect
Multiple Fortinet products may be affected by the following Linux Kernel vulnerability:...
FortiClient (Windows) - privilege escalation in online installer due to incorrect working directory
An improper initialization CWE-665 vulnerability in FortiClient Windows may allow a local attacker to gain administrative privileges via placing a malicious executable inside the FortiClient installer's directory...
Protect
An improper verification of cryptographic signature vulnerability CWE-347 in FortiOS, FortiWeb, FortiProxy and FortiSwitch may allow an attacker to decrypt portions of the administrative session management cookie if able to intercept the latter...
Protect
An improper authentication vulnerability in SSL VPN in FortiOS may result in a user being able to log in successfully without being prompted for the second factor of authentication FortiToken if they changed the case of their username...
REST API trusted host bypass
...
Apache Struts RCE Vulnerability
Multiple Remote Code Execution vulnerabilities CVE-2017-9805, CVE-2017-9804, CVE-2017-9793 are affecting Apache Struts...
Heap-based buffer overflow in sslvpnd
...
CVE-2004-1653 SSH port forwarding exposes unprotected internal services
An improper access control vulnerability in the admin SSH console of multiple products may allow an authenticated user to access internal only system services via using SSH local port forwarding. A successful attack needs an authenticated admin SSH user to set up a port bounce to product internal...
Protect
A debug functionality in FortiGate may allow a privileged user to execute unauthorized code or commands via specific chains of print str and cmd mem cli commands to, respectively, read and write hexadecimal values to any memory address...
Protect
When traffic other than HTTP/S eg: SSH traffic, etc... traverses the FortiOS on port 80/443, it is not redirected to the transparent proxy policy for processing, as it doesn't have a valid HTTP header...
CVE-2019-9193 PostgreSQL allows OS level commands via COPY SQL function
An OS command injection vulnerability in FortiAnalyzer, FortiAuthenticator and FortiManager may allow a privileged system administrator to run OS level commands on the system via injecting commands in SQL queries...