898 matches found
FortiAuthenticator Privilege Escalation Vulnerability
...
FortiClient (Mac) - update functionality may lead to privilege escalation vulnerability
A download of code without Integrity check vulnerability CWE-494 in FortiClientMac may allow a local attacker to escalate their privileges via modifying the installer upon upgrade...
FortiNAC : Wrong use of cryptographic primitives
A wrong use of cryptographic primitives vulnerability CWE-310 may allow an attacker to compromise FortiNAC's confidentiality and integrity via deciphering some traffic and/or forging specific packets...
Inter ADOM information leakage
...
FortiAnalyzer, FortiManager - bypass of client-side password change policy enforcement
An improper handling of insufficient permissions or privileges vulnerability CWE-280 in FortiAnalyzer and FortiManager may allow an authenticated attacker to bypass the device policy and force the password-change action for its user...
FortiWLM - reflected cross-site scripting vulnerability in cgi_bin handlers
An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability CWE-79 in FortiWLM may allow an authenticated user to perform an XSS attack via crafted HTTP GET requests...
Protect
An insufficient verification of data authenticity vulnerability CWE-345 in the user interface of FortiProxy and FortiGate SSL VPN portal may allow a remote, unauthenticated attacker to conduct a cross-site request forgery CSRF attack . Only SSL VPN in web mode or full mode are impacted by this...
FortiManager - ADOMs script information leaked in FortiGate CLI
An exposure of sensitive information to an unauthorized actor CWE-200 vulnerability in FortiManager may allow a FortiGate user to see scripts from other ADOMS...
FortiClientEMS - Session cookie does not expire after logout
An insufficient session expiration vulnerability CWE- 613 in FortiClientEMS may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...
FortiSandbox - Multiple path traversals
Improper limitation of a pathname to a restricted directory CWE-22 vulnerabilities in FortiSandbox may allow an authenticated user to obtain unauthorized access to files and data via specifially crafted web requests.c...
FortiWAN - OS command injection leads to privilege escalation
An OS command injection CWE-78 vulnerability in FortiWAN Command Line Interface may allow a local, authenticated and unprivileged attacker to escalate their privileges to root via executing a specially-crafted command...
Unquoted Service Path exploit in FortiClient
An unquoted service path vulnerability in the FortiClient FortiTray component may allow an attacker to gain elevated privileges via the FortiClientConsole executable service path...
Stored XSS vulnerability in traffic group interface
An improper neutralization of input vulnerability in the FortiADC may allow an attacker to execute a stored Cross Site Scripting XSS via a field in the traffic group interface...
Protect
Failure to sanitize input in the SSL VPN web portal may allow an attacker to perform a reflected Cross-site Scripting XSS attack via multiple parameters of the error page HTTP request...
Cross-Site-Scripting (XSS) vulnerabilty in Fortiweb reports
The URL part of the report message is not encoded in Fortinet FortiWeb which may allow an attacker to execute unauthorized code or commands Cross Site Scripting via attack reports generated in HTML format...
FortiWebManager 5.8.0 improperly handles admin login access
FortiWebManager 5.8.0 fails to check the admin password, granting access regardless the provided string...
FortiWeb Stored XSS vulnerability on webUI certificate view page
There exists a persistent Cross-site Scripting XSS vulnerability on FortiWeb's webUI Certificate View page, which can be triggered via malicious certificate import...
Unauthenticated XSS (Cross Site Scripting) in FortiMail
An unauthenticated XSS vulnerability could allow an attacker to execute arbitrary scripts in the security context of the browser of a victim logged in FortiMail, assuming the victim is social engineered into clicking an URL crafted by the attacker...
FortiManager and FortiAnalyzer Persistent XSS vulnerability
When a low privileged user uploads images in the report section, the filenames are not properly sanitized; this potentially enables stored XSS attacks...
FortiSwitch rest_admin account exposed under specific conditions
During an upgrade to version 3.4.1, a FortiSwitch device may let an attacker log in the restadmin account without a password, if all the conditions below are met: The FortiSwitch device is in FortiLink managed mode not the default mode The FortiSwitch device does not have a management FortiGate, ...
Potential Cross Site Scripting Vulnerability in FortiWeb
...
FortiSIEM - Use of a Broken or Risky Cryptographic Algorithm
A use of a broken or risky cryptographic algorithm CWE-327 in FortiSIEM may allow a remote unauthenticated attacker to perform brute force attacks on GUI endpoints via taking advantage of outdated hashing methods...
FortiSandbox - SQL injection in certificate downloading feature
An improper neutralization of special elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 in FortiSandbox may allow a remote and authenticated attacker with read permission to retrieve arbitrary files from the underlying Linux system via a crafted HTTP request...
Meru AP - Unrestricted execution of OS commands as root
An improper sanitization of commands elements OS Command Injection vulnerability CWE-78 in Meru AP may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted commands in Meru AP's CLI...
FortiWeb - OS Command Injection because of missing input parameter sanitization
Multiple improper neutralization of special elements vulnerabilities CWE-89 used in a command in FortiWeb may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests...
AV Engine evasion via malformed RAR file
FortiClient and FortiOS AV engines may not immediately detect certain types of malformed or non-standard RAR archives, potentially containing malicious files...
Improper Authorization vulnerability in FortiADC
An improper authorization vulnerability in FortiADC may allow a remote authenticated user with low privileges to perform certain actions such as rebooting the system...
FortiSIEM is vulnerable to a CSRF attack
A Cross-Site Request Forgery CSRF vulnerability in the user interface of FortiSIEM could allow a remote, unauthenticated attacker to perform arbitrary actions using an authenticated user's session by persuading the victim to follow a malicious link...
XSS vulnerability in FortiNAC admin webUI search field
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" in FortiNAC admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI...
FortiClient Mac is vulnerable to a local denial of service
An improper access control vulnerability in FortiClientMac may allow an attacker to affect the application's performance via modifying the content of a file used by several FortiClientMac processes...
Uninitialized memory buffer leak in FortiOS explicit web proxy
An uninitialized memory buffer leak exists in FortiOS web proxy's disclaimer response web pages, potentially causing sensitive data to be displayed in the HTTP response...
FortiOS web GUI logindisclaimer redir parameter XSS vulnerability
A reflected XSS vulnerability exists in FortiOS web GUI "Login Disclaimer" redir parameter. It is potentially exploitable by a remote unauthenticated attacker, via sending a maliciously crafted URL to a victim who has an open session on the web GUI. Visiting that malicious URL may cause the...
FortiWLC XSS injection via crafted HTTP POST request
The FortiWLC admin webUI is affected by XSS vulnerabilities, potentially exploitable by an authenticated user, via non-sanitized parameters "refresh" and "branchtotable" present in HTTP POST requests. A successful attack would involve getting a targeted victim with an open session on the WebUI t...
FortiWLC Undocumented Hardcoded core Account
FortiWLC comes with a hardcoded account named 'core' which is used by Meru Access Points to send core dumps to the FortiWLC and has read/write privileges over various parts of the system...
Improper Guest User Permission Management Issue in FortiGate
...
FortiWeb - OS command injection due to unsafe input validation function
An improper neutralization of special elements used in an OS command vulnerability 'OS Command Injection' CWE-78 in FortiWeb may allow authenticated users to execute unauthorized code or commands via crafted HTTP GET requests to WAD configuration handlers...
FortiAuthenticator - Improper access control in HA service
An improper access control vulnerability CWE-284 in FortiAuthenticator HA service may allow an attacker on the same vlan as the HA management interface to make an unauthenticated direct connection to the FAC's database...
FortiManager & FortiAnalyzer - Improper validation of dispatcher socket parameters
A server-side request forgery SSRF CWE-918 vulnerability in FortiManager and FortiAnalyser GUI may allow a remote and authenticated attacker to access unauthorized  files and services on the system via specifically crafted web requests...
Potential sensitive information can be displayed in cleartext in FortiProxy CLI window
...
FortiSandbox reflected XSS in the file scan component
A reflected Cross-Site-Scripting XSS vulnerability in Fortinet FortiSandbox may allow an attacker to execute unauthorized code or commands via the backurl parameter in the file scan component...
FortiOS SSL VPN webportal user credentials present in plain text in client side javascript file
An information disclosure vulnerability exists in the SSL-VPN web portal of FortiOS: when pages bookmarked in the web portal use the Single sign-on SSO feature, the user's webportal's login and password are included in a javascript file sent client-side. The leaked credential may potentially be...
Gain Windows privileges with FortiClient vpn before logon and untrusted certificate
When the "VPN before logon" feature of FortiClient Windows is enabled disabled by default, and when the server certificate is not valid, it is possible for an attacker without a user account on the targeted Windows workstation to obtain SYSTEM level privileges, via exploiting the Windows "securi...
FortiADC Cross-Site Scripting Vulnerability
...
FortiWLM - stored cross-site scripting in hotspot profile controller
An improper neutralization of input during web page generation vulnerability 'Cross-site Scripting' CWE-79 in FortiWLM may allow an authenticated attacker to perform a stored cross site scripting attack XSS via storing malicious payloads and trigger the attack on victim's client via various...
Protect
A relative path traversal CWE-23 vulnerabiltiy in FortiOS and FortiProxy may allow an unauthenticated, unauthorized attacker to inject path traversal character sequences to disclose sensitive information of the server via the GET request of the login page...
FortiNAC - Privilege Escalation via exploiting the SUDO privileges.
A privilege escalation vulnerability in FortiNAC may allow an admin user to escalate the privileges to root via the sudo command...
FortiSandbox - Session ID does not expire after logout
An insufficient session expiration vulnerability CWE-613 in FortiSandbox may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users configured on the device, should the attacker be able to obtain that session ID via other, hypothetical attacks...
FortiMail - Improper cryptographic operations in cookie encryption potentially prone to forgery
The combination of various cryptographic issues in the session management of FortiMail, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges...
Session ID does not expire after logout in FortiIsolator
An insufficient session expiration vulnerability in FortiIsolator may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...