898 matches found
FortiClientMac - Privilege escalation by abusing a Symlink following vulnerability
A UNIX symbolic link Symlink Following CWE-61 vulnerability in FortiClient for MacOS may allow a local and unprivileged user to overwrite privileged shell scripts executed during the installation phase via escalating their privileges to root...
FortiSIEM - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Schedule in FortiSIEM may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack XSS by injecting malicious JavaScript code into the description field o...
FortiWeb Recursive URL Decoding is not enabled by default
FortiWeb's "Recursive URL Decoding" feature can detect URL-based attacks among which XSS and SQL injection attempts even when the malicious URL is recursively encoded. However, this feature is not enabled by default in FortiWeb's system settings for FortiWeb version 6.0.0 and below...
FortiWeb's cookie tampering protection can be bypassed by erasing the FortiWeb session cookie
An improper access control vulnerability in FortiWeb's Signed Security mode may allow an attacker to disable the cookie tampering protection offered by FortiWeb to sites FortiWeb protects, via deleting FortiWeb's session cookie...
DUHK Attack against Fortinet Products
When devices use ANSI X9.31 RNG which was removed from the list of FIPS-approved random number generation algorithms in January 2016 to generate cryptographic key under a static seed and under use with long-lived security tunnels like SSL/TLS/SSH/IPSec, such devices are vulnerable to the DUHK...
FortiAnalyzer and FortiManager stored XSS vulnerability in report filters
A cross-site-scripting vulnerablity in FortiAnalyzer/FortiManager in advanced settings page could allow an administrator to inject scripts in the add filter field...
XSS vulnerability in FortiProxy SSLVPN Portal
An improper neutralization of input during web page generation in the SSL VPN portal of FortiProxy may allow a remote authenticated attacker to perform a stored cross site scripting attack XSS...
Protect
Makers of popular WiFi hacking tool hashcat have discovered a way to improve password brute-forcing of the WPA/WPA2 wifi network security standards. By leveraging the PMKID served by access points in WPA/WPA2 enabled WiFi networks, attackers gain knowledge of a pre-shared key hash, which can be...
FortiWLC - Multiple Buffer Overflow vulnerabilities
Multiple instances of stack-based buffer overflow vulnerability CWE-121 in the command line interface of FortiWLC may allow a local, authenticated attacker to crash the access point being managed by the controller and potentially execute unauthorized code via a specifically crafted CLI command...
FortiClient local privilege escalation exploit chain
A researcher has disclosed several vulnerabilities against FortiClient for Windows, the combination of these vulnerabilities can turn into an exploit chain, which allows a user to gain system privileges on Microsoft Windows...
FortiADC-E remote network access vulnerability
...
FortiSIEM default SSH key for the "tunneluser" account is the same across all appliances
A use of hard-coded cryptographic key vulnerability in FortiSIEM may allow a remote unauthenticated attacker to obtain SSH access to the supervisor as the restricted user "tunneluser" by leveraging knowledge of the private key from another installation or a firmware image...
FortiClient SSLVPN Linux - Arbitrary write to log file
The first launch of FortiClient SSLVPN Linux creates a log file without any prior check. By previously creating a symbolic or hard link with the name of the log file to any file in the filesystem, an attacker may smash the latter existing file. This is due to the fact that the first launch of...
Fortinet Connect admin able to gain root access
A webui administrator may create a new theme that performs arbitrary code execution on the system...
FortiSOAR - HTML Injection Vulnerabilities
Improper neutralization of input during web page generation CWE-79 in FortiSOAR may allow an authenticated attacker to inject HTML tags via input fields of various components within FortiSOAR...
FortiWeb - arbitrary file/directory deletion
An improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability CWE-22 in FortiWeb management interface may allow an authenticated attacker to perform an arbitrary file and directory deletion in the device filesystem...
FortiWeb - Multiple vulnerabilities in the authentication mechanism of confd
Multiple vulnerabilities in the authentication mechanism of FortiWeb's confd, including an instance of concurrent execution using shared resource with improper synchronization CWE-362 and one of authentication bypass by capture-replay CWE-294, may allow a remote unauthenticated attacker to...
FortiClient for Windows Insecure Temporary File vulnerability
An Insecure Temporary File CWE-377 vulnerability in FortiClient for Windows may allow a local user to gain elevated privileges via exhausting the pool of temporary file names combined with a symbolic link attack...
Null Pointer Dereference in Log Report
...
Unquoted Service Path Exploit observed in FortiSIEMWindowsAgent
An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the AoWinAgt executable service path...
XSS vulnerability in the FortiManager via the buffer parameter
An improper neutralization of input vulnerability in FortiManager GUI may allow an authenticated attacker to perform an XSS Cross Site Scripting attack via the buffer parameter...
Format String Vulnerability in CAPWAP fast-failover mode
...
XSS vulnerability in FortiOS SSLVPN Portal
...
XSS vulnerability in FortiClientEMS
An Improper Neutralization of Input During Web Page Generation in FortiClientEMS may allow a remote attacker to execute unauthorized code by injecting malicious payload in the user profile of a FortiClient instance being managed by the vulnerable system...
Protect
...
Protect
FortiOS Explicit Web Proxy by default allows non-standard HTTP traffic.Â...
Potential Man-In-The Middle Vulnerability in FortiClient VPN
...
Script Code Injection Vulnerability in FortiMail
...
Cron Job Injection in Remote Backup
...
Blacknurse ICMP DoS attack
BlackNurse is a Denial of Service attack consisting in flooding the target with ICMP Type 3 Code 3 packets. The latter type of packets generally consumes more CPU to be processed than the "traditional" ICMP packets used in classical ping-flood attacks Type 8 Code 0. As such, Blacknurse aims at...
Potential Cross-Site Vulnerabilities in FortiGate
...
XSS vulnerability in the Security Profiles comments section in FortiGate Cloud
An improper neutralization of input vulnerability in FortiGate Cloud may allow a remote authenticated attacker to perform a stored cross site scripting attack XSS via the comments section of the Security Profiles...
Cross Site Scripting Vulnerability in FortiWeb
...
BranchScope: New CPU Side-Channel Attack
A new side-channel attack that takes advantage of the speculative execution feature of modern processors to recover data from targeted users' CPUs has been disclosed It targets the "branch prediction" operations —which is the same part of a CPU speculative execution process as the one targeted ...
FortiClient Unencrypted Password Vulnerability
One of the processes in FortiClient stores VPN credentials unencrypted in memory. A malicious attacker who compromised the workstation could dump the credentials...
Potential Policy Bypass in FortiWeb Web Application Firewall
...
Protect
Multiple information exposure vulnerabilities in FortiOS may allow an unauthenticated attacker to perform some information gathering via parsing the HTTP headers, web portal certificate, and error messages. The exposed information includes the FortiGate's model, serial number and internal IP...
VPNFilter botnet
On May 23, 2018, Talos disclosed in a blog post the discovery of a modular malware system they deemed "VPNFilter", affecting multiple network devices wordwide, and embedding Botnet capabilities...
FortiClient SSLVPN Linux - Root privilege escalation with subproc
Fortinet is pleased to thank Grzegorz Wrobel of STMSolutions for reporting this vulnerability under responsible disclosure...
"POODLE has friends" vulnerability
...
Potential Buffer Overflow During HTTP Session Authentication
...
Exposure of sensitive information in RADIUS Accounting-Request
...
XSS vulnerability in the URL of the FortiGateCloud Login Page
An improper neutralization of input vulnerability in the FortiGateCloud login page may allow a remote unauthenticated attacker to perform a reflected cross site scripting attack XSS via a specifically crafted login request...
Protect
Certificates taken out of service could potentially be improperly re-used.Â...
Multiple VPN applications insecurely store session cookies
The Missing Encryption Of Sensitive Data vulnerability in FortiClient may allow an attacker to access VPN session cookie from an endpoint device running FortiClient. The attacker can steal the cookies only if endpoint device has been compromised in such a way that the attacker has access to...
IPMI network LAN interface failover operational risk
Some models of FortiAnalyzer and FortiManager have a default setting of "Failover", for remote IPMI access; this means that if no cable is plugged in the IPMI port, the IPMI implementation will request an IP address on the regular LAN port of the device, via DHCP requests...
FortiDDoS Command Injection Vulnerability Announcement
A vulnerability in FortiDDoS allows escalation of privilege via remote OS injection through crafted URLs sent to the GUI. The user is required to be logged in for an exploit to work...
FortiWeb multiple vulnerabilities
...