898 matches found
Protect
...
FortiClient NDIS Miniport Driver Null Pointer Dereference
There is a Null pointer dereference in the NDIS Miniport drivers in FortiClient on Windows, which may be leveraged by an unprivileged user to cause a Denial of Service BSOD...
Firewall information leak to regular SSL VPN web portal users
A SSL VPN user logged in via the web portal can access internal FortiOS configuration information eg: addresses via specifically crafted URLs...
FortiWLC file management OS Command Injection vulnerability
The FortiWLC file management AP script download webUI page is affected by an OS Command Injection vulnerability which may allow an authenticated admin user to execute arbitrary system console commands, and possibly subsequently "root" the device...
FortiWLC Undocumented Hardcoded Rsync Account
FortiWLC runs a rsyncd server, historically used for High-Availability purpose. This server comes with a hardcoded account, which has read/write privileges over various parts of the system...
FortiClient SSLVPN Linux client local privilege escalation vulnerability
...
Multiple Vulnerabilities in FortiManager
...
Multiple command injection vulnerabilities in webserver
...
FortiWeb - Stack-based buffer overflow in command line interpreter
Multiple stack-based buffer overflows CWE-121 in the command line interpreter of FortiWeb may allow an authenticated attacker to achieve arbitrary code execution via specially crafted commands...
FortiWeb - Stack-based buffer overflow due to type mismatch
A stack-based buffer overflow vulnerability CWE-121 in FortiWeb may allow an authenticated attacker to execute unauthorized code or commands via SAML login using a crafted certificate...
FortiWLC - Improper authenticated access control
An improper access control vulnerability CWE-284 in FortiWLC may allow an authenticated and remote attacker with low privileges to execute any command as an admin user with full access rights via bypassing the GUI restrictions...
Protect
FortiOS versions 6.2.4 and below...
XSS vulnerability in the UserID of Admin Users in FortiNAC
...
HTML Injection Vulnerability observed in FortiAnalyzer and FortiTester
...
XSS vulnerability in the Dashboard name parameter of FortiADC
An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to perform a cross site scripting attack XSS via the name parameter...
XSS Vulnerability in Disclaimer Description of a Replacement Message in FortiWeb
An improper neutralization of input vulnerability in FortiWeb may allow a remote authenticated attacker to perform a stored cross site scripting attack XSS via the Disclaimer Description of a Replacement Message...
Protect
A privilege escalation vulnerability in FortiOS may allow admin users to elevate their profile to superadmin, via restoring modified configurations...
XSS Vulnerability in FortiWeb Site Publisher
The Site Publisher functionality of FortiWeb has been found vulnerable to a Cross-Site Scripting vulnerability via an improperly sanitized parameter in a POST request...
FortiManager TLS certificate validation failure
FortiManager does not properly validate TLS certificates when probing for devices to administer. This leads to potential pre-shared secret exposure...
FortiManager and FortiAnalyzer Client Side XSS vulnerability
A client side XSS vulnerablity in FortiManager/FortiAnalyzer could allow malicious script being injected in the Web-UI; this potentially enables XSS attacks...
FortiNAC - Multiple reflected cross-site scripting vulnerabilities in portal UI
Multiple improper neutralization of input during web page generation 'Cross-site Scripting' vulnerabilities CWE-79 in FortiNAC portal UI may allow an attacker to perform an XSS attack via crafted HTTP requests...
FortiSOAR - OS Command Injection in Agent Password Field
An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in FortiSOAR may allow an authenticated attacker to execute unauthorized code or commands via crafted HTTP GET requests...
FortiMail - Unsafe handling of CGI environment parameters in web server framework
An improper input validation CWE-20 vulnerability in the web server CGI facilities of FortiMail may allow an unauthenticated attacker to alter the environment of the underlying script interpreter via specifically crafted HTTP requests...
ISC BIND vulnerabilities
Multiple Denial of Service DoS or process crash vulnerabilities CVE-2018-5737, CVE-2018-5736 are affecting ISC BIND...
FortiOS XSS via srcintf during Firewall Policy Creation
An XSS vulnerability caused by the scrintf parameter input during Firewall Policy Creation can be exploited to load and run a remote malicious Javascript in a logged in browser...
FortiWLM - SQL Injection in script handlers
An improper neutralization of special elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 in FortiWLM may allow an unauthenticated user to taint database data and extract sensitive informations via crafted HTTP requests to alarm and device handlers...
FortiMail - Improper use of cryptographic primitives in IBE KeyStore
Missing cryptographic steps in FortiMail IBE may allow an attacker who comes in possession of the encrypted master keys to compromise their confidentiality by observing a few invariant properties of the ciphertext...
FortiWLC - Improper access control
An improper access control CWE-284 vulnerability in FortiWLC may allow an unauthenticated and remote attacker to access certain areas of the web management CGI functionality by just specifying the correct URL. The vulnerability applies only to limited CGI resources and might allow the...
FortiWeb Recursive URL Decoding is not enabled by default
FortiWeb's "Recursive URL Decoding" feature can detect URL-based attacks among which XSS and SQL injection attempts even when the malicious URL is recursively encoded. However, this feature is not enabled by default in FortiWeb's system settings for FortiWeb version 6.0.0 and below...
FortiAnalyzer and FortiManager admin user avatar setting improper access control
An improper access control vulnerability exists in FortiAnalyzer and FortiManager, whereby a regular user of the GUI can edit the avatar picture of other users including with higher privileges with arbitrary content...
Use of hardcoded credentials for communication between Meru access points and FortiWLC
FortiWLC included two hardcoded accounts which were used by Meru Access Points to report core dumps; these accounts had read/write privileges over various parts of the system. Starting with FortiWLC 7.0.13 and FortiWLC 8.4.0, the accounts are now completely removed and do not persist over firmwar...
FortiWeb SNMPv3 user password viewable in HTML source code
The HTML source code of the FortiWeb SNMPv3 user edit webui page includes the user's password in cleartext...
FortiAnalyzer, FortiManager Open Redirect Vulnerability
The FortiAnalyzer and FortiManager WebUI accept a user-controlled input that specifies a link to an external site, and uses that link in a redirect...
FortiAnalyzer and FortiManager stored XSS vulnerability in report filters
A cross-site-scripting vulnerablity in FortiAnalyzer/FortiManager in advanced settings page could allow an administrator to inject scripts in the add filter field...
Multiple XSS vulnerabilities in FortiManager and FortiAnalyzer Web UI
...
FortiTester - Missing account lockout on telnet port
An improper restriction of excessive authentication attempts vulnerability CWE-307 in FortiTester Telnet port may allow an unauthenticated attacker to guess the credentials of an admin user via a brute force attack...
FortiSandbox, FortiWeb, FortiADC, FortiMail - Multiple cryptographic flaws allow for full LDAP and RADIUS passwords compromise
A missing cryptographic steps vulnerability CWE-325 in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox, FortiWeb, FortiADC, and FortiMail may allow an attacker in possession of the password store to compromise the confidentiality of the encrypted secrets.Â...
Protect
An improper access control vulnerability CWE-284 in FortiOS and FortiProxy autod daemon may allow an authenticated low-privileged attacker to escalate their privileges to superadmin via a specific crafted configuration of fabric automation CLI script and auto-script features...
FortiPortal - Unrestricted file upload vulnerability
An unrestricted file upload vulnerability CWE-434 in the web interface of FortiPortal may allow a low-privileged user to potentially tamper with the underlying system's files via the upload of specifically crafted files...
FortiClientMac - Privilege escalation by abusing a Symlink following vulnerability
A UNIX symbolic link Symlink Following CWE-61 vulnerability in FortiClient for MacOS may allow a local and unprivileged user to overwrite privileged shell scripts executed during the installation phase via escalating their privileges to root...
XSS vulnerability in the Description Area of the Admin Profile
An improper neutralization of input vulnerability in the Admin Profile of FortiAnalyzer may allow a remote authenticated attacker to perform a stored cross site scripting attack XSS via the Description Area...
Protect
Makers of popular WiFi hacking tool hashcat have discovered a way to improve password brute-forcing of the WPA/WPA2 wifi network security standards. By leveraging the PMKID served by access points in WPA/WPA2 enabled WiFi networks, attackers gain knowledge of a pre-shared key hash, which can be...
FortiOS CAPWAP server two vulnerabilities
...
FortiMail - Insecure PRNG in password and token generation scheme of IBE authentication
A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of FortiMail Identity Based Encryption service may allow an unauthenticated attacker to infer parts of users authentication tokens and reset their credentials...
FortiWLC - XSS vulnerability
An improper neutralization of input during web page generation in FortiWLC web interface may allow both authenticated remote attackers and non-authenticated attackers in the same network as the appliance to perform a stored cross site scripting attack XSS via injecting malicious payloads in...
XSS vulnerability in the URL Description of URL filter
An improper neutralization of input vulnerability in the URL Description of FortiIsolator may allow a remote authenticated attacker to perform a stored cross site scripting attack XSS via a parameter of the request...
FortiSIEM - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Schedule in FortiSIEM may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack XSS by injecting malicious JavaScript code into the description field o...
FortiWeb's cookie tampering protection can be bypassed by erasing the FortiWeb session cookie
An improper access control vulnerability in FortiWeb's Signed Security mode may allow an attacker to disable the cookie tampering protection offered by FortiWeb to sites FortiWeb protects, via deleting FortiWeb's session cookie...
DUHK Attack against Fortinet Products
When devices use ANSI X9.31 RNG which was removed from the list of FIPS-approved random number generation algorithms in January 2016 to generate cryptographic key under a static seed and under use with long-lived security tunnels like SSL/TLS/SSH/IPSec, such devices are vulnerable to the DUHK...