FortiClient Mac is vulnerable to a local denial of service

An improper access control vulnerability in FortiClientMac may allow an attacker to affect the application's performance via modifying the content of a file used by several FortiClientMac processes...

Uncontrolled Resource Consumption in SNMP

...

ZTNA Portal Improper Certificate Validation

...

FortiMail - Unsafe handling of CGI environment parameters in web server framework

An improper input validation CWE-20 vulnerability in the web server CGI facilities of FortiMail may allow an unauthenticated attacker to alter the environment of the underlying script interpreter via specifically crafted HTTP requests...

FortiSandbox - Session ID does not expire after logout

An insufficient session expiration vulnerability CWE-613 in FortiSandbox may allow an attacker to reuse the unexpired admin user session IDs to gain information about other users configured on the device, should the attacker be able to obtain that session ID via other, hypothetical attacks...

FortiManager & FortiAnalyzer - Improper validation of dispatcher socket parameters

A server-side request forgery SSRF CWE-918 vulnerability in FortiManager and FortiAnalyser GUI may allow a remote and authenticated attacker to access unauthorized  files and services on the system via specifically crafted web requests...

FortiMail - Improper cryptographic operations in cookie encryption potentially prone to forgery

The combination of various cryptographic issues in the session management of FortiMail, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges...

HTML Injection Vulnerability observed in FortiAnalyzer and FortiTester

...

XSS vulnerability in the Dashboard name parameter of FortiADC

An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to perform a cross site scripting attack XSS via the name parameter...

XSS Vulnerability in Disclaimer Description of a Replacement Message in FortiWeb

An improper neutralization of input vulnerability in FortiWeb may allow a remote authenticated attacker to perform a stored cross site scripting attack XSS via the Disclaimer Description of a Replacement Message...

FortiOS SSL VPN webportal user credentials present in plain text in client side javascript file

An information disclosure vulnerability exists in the SSL-VPN web portal of FortiOS: when pages bookmarked in the web portal use the Single sign-on SSO feature, the user's webportal's login and password are included in a javascript file sent client-side. The leaked credential may potentially be...

FortiWLC Undocumented Hardcoded core Account

FortiWLC comes with a hardcoded account named 'core' which is used by Meru Access Points to send core dumps to the FortiWLC and has read/write privileges over various parts of the system...

FortiWLC Undocumented Hardcoded Rsync Account

FortiWLC runs a rsyncd server, historically used for High-Availability purpose. This server comes with a hardcoded account, which has read/write privileges over various parts of the system...

FortiManager and FortiAnalyzer Client Side XSS vulnerability

A client side XSS vulnerablity in FortiManager/FortiAnalyzer could allow malicious script being injected in the Web-UI; this potentially enables XSS attacks...

FortiOS CAPWAP server two vulnerabilities

...

Heap-based buffer overflow in cw_acd daemon

...

Multiple command injection vulnerabilities in webserver

...

FortiSandbox, FortiWeb, FortiADC, FortiMail - Multiple cryptographic flaws allow for full LDAP and RADIUS passwords compromise

A missing cryptographic steps vulnerability CWE-325 in the function that encrypts users' LDAP and RADIUS credentials in FortiSandbox, FortiWeb, FortiADC, and FortiMail may allow an attacker in possession of the password store to compromise the confidentiality of the encrypted secrets.Â...

FortiWLM - stored cross-site scripting in hotspot profile controller

An improper neutralization of input during web page generation vulnerability 'Cross-site Scripting' CWE-79 in FortiWLM may allow an authenticated attacker to perform a stored cross site scripting attack XSS via storing malicious payloads and trigger the attack on victim's client via various...

Session ID does not expire after logout in FortiIsolator

An insufficient session expiration vulnerability in FortiIsolator may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

Protect

FortiOS versions 6.2.4 and below...

FortiAnalyzer and FortiManager admin user avatar setting improper access control

An improper access control vulnerability exists in FortiAnalyzer and FortiManager, whereby a regular user of the GUI can edit the avatar picture of other users including with higher privileges with arbitrary content...

Firewall information leak to regular SSL VPN web portal users

A SSL VPN user logged in via the web portal can access internal FortiOS configuration information eg: addresses via specifically crafted URLs...

FortiWLC file management OS Command Injection vulnerability

The FortiWLC file management AP script download webUI page is affected by an OS Command Injection vulnerability which may allow an authenticated admin user to execute arbitrary system console commands, and possibly subsequently "root" the device...

XSS Vulnerability in FortiWeb Site Publisher

The Site Publisher functionality of FortiWeb has been found vulnerable to a Cross-Site Scripting vulnerability via an improperly sanitized parameter in a POST request...

FortiManager TLS certificate validation failure

FortiManager does not properly validate TLS certificates when probing for devices to administer. This leads to potential pre-shared secret exposure...

FortiWeb - Stack-based buffer overflow due to type mismatch

A stack-based buffer overflow vulnerability CWE-121 in FortiWeb may allow an authenticated attacker to execute unauthorized code or commands via SAML login using a crafted certificate...

FortiWLC - XSS vulnerability

An improper neutralization of input during web page generation in FortiWLC web interface may allow both authenticated remote attackers and non-authenticated attackers in the same network as the appliance to perform a stored cross site scripting attack XSS via injecting malicious payloads in...

Protect

...

XSS vulnerability in the UserID of Admin Users in FortiNAC

...

Protect

A privilege escalation vulnerability in FortiOS may allow admin users to elevate their profile to superadmin, via restoring modified configurations...

Use of hardcoded credentials for communication between Meru access points and FortiWLC

FortiWLC included two hardcoded accounts which were used by Meru Access Points to report core dumps; these accounts had read/write privileges over various parts of the system. Starting with FortiWLC 7.0.13 and FortiWLC 8.4.0, the accounts are now completely removed and do not persist over firmwar...

FortiOS XSS via srcintf during Firewall Policy Creation

An XSS vulnerability caused by the scrintf parameter input during Firewall Policy Creation can be exploited to load and run a remote malicious Javascript in a logged in browser...

FortiNAC - Multiple reflected cross-site scripting vulnerabilities in portal UI

Multiple improper neutralization of input during web page generation 'Cross-site Scripting' vulnerabilities CWE-79 in FortiNAC portal UI may allow an attacker to perform an XSS attack via crafted HTTP requests...

FortiWLM - SQL Injection in script handlers

An improper neutralization of special elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 in FortiWLM may allow an unauthenticated user to taint database data and extract sensitive informations via crafted HTTP requests to alarm and device handlers...

FortiWLC - Improper access control

An improper access control CWE-284 vulnerability in FortiWLC may allow an unauthenticated and remote attacker to access certain areas of the web management CGI functionality by just specifying the correct URL. The vulnerability applies only to limited CGI resources and might allow the...

FortiNDR - OS command injection due to improper input sanitization

An improper input validation in FortiNDR v1.4.0 may allow an authenticated user to gain system shell access via a malicious payload in the "diagnose" command...

XSS vulnerability in the Description Area of the Admin Profile

An improper neutralization of input vulnerability in the Admin Profile of FortiAnalyzer may allow a remote authenticated attacker to perform a stored cross site scripting attack XSS via the Description Area...

XSS vulnerability in the Anomaly Detection Parameter Name

An improper neutralization of input vulnerability in the Anomaly Detection interface of FortiWeb may allow a remote unauthenticated attacker to perform a cross site scripting attack XSS via a parameter of the request...

XSS vulnerability in the URL Description of URL filter

An improper neutralization of input vulnerability in the URL Description of FortiIsolator may allow a remote authenticated attacker to perform a stored cross site scripting attack XSS via a parameter of the request...

ISC BIND vulnerabilities

Multiple Denial of Service DoS or process crash vulnerabilities CVE-2018-5737, CVE-2018-5736 are affecting ISC BIND...

FortiWeb SNMPv3 user password viewable in HTML source code

The HTML source code of the FortiWeb SNMPv3 user edit webui page includes the user's password in cleartext...

FortiAnalyzer, FortiManager Open Redirect Vulnerability

The FortiAnalyzer and FortiManager WebUI accept a user-controlled input that specifies a link to an external site, and uses that link in a redirect...

Fortiweb path traversal vulnerability

A path traversal vulnerability allows an administrator account with read and write privileges to read arbitrary files using the autolearn feature...

Potential Cross Site Scripting Vulnerability in FortiDB

...

FortiTester - Missing account lockout on telnet port

An improper restriction of excessive authentication attempts vulnerability CWE-307 in FortiTester Telnet port may allow an unauthenticated attacker to guess the credentials of an admin user via a brute force attack...

Protect

An improper access control vulnerability CWE-284 in FortiOS and FortiProxy autod daemon may allow an authenticated low-privileged attacker to escalate their privileges to superadmin via a specific crafted configuration of fabric automation CLI script and auto-script features...

FortiPortal - Unrestricted file upload vulnerability

An unrestricted file upload vulnerability CWE-434 in the web interface of FortiPortal may allow a low-privileged user to potentially tamper with the underlying system's files via the upload of specifically crafted files...

FortiMail - Insecure PRNG in password and token generation scheme of IBE authentication

A use of a cryptographically weak pseudo-random number generator vulnerability in the authenticator of FortiMail Identity Based Encryption service may allow an unauthenticated attacker to infer parts of users authentication tokens and reset their credentials...

FortiClientMac - Privilege escalation by abusing a Symlink following vulnerability

A UNIX symbolic link Symlink Following CWE-61 vulnerability in FortiClient for MacOS may allow a local and unprivileged user to overwrite privileged shell scripts executed during the installation phase via escalating their privileges to root...