898 matches found
FGFM Authentication Weakening via CLI Configuration
...
Header injection in Web Filter warning page
...
SSL-VPN Reflected XSS
...
MFA Bypass in GUI
...
Authentication bypass in Node.js websocket module and CSF requests
...
Forgot password link doesn't expire after use
FortiCloud password reset link requested by the user takes one hour to expire even after password was changed successfully, thus allowing attackers to take over user's account if they somehow gain access to the reset link for the user's password...
FortiVoice 5.0 Filter Bypass & Persistent Web Vulnerabilities
A vulnerablity in FortiVoice 5.0 web-application could allow malicious script being injected in the affected module; this potentially enables XSS attacks...
Path traversal in CLI command allows deletion of root file system
...
Log Pollution via login page
...
FortiCloud XSS vulnerability in on-demand sandbox GUI
Before Dec 5th, 2017, a Cross-Site-Scripting XSS vulnerability in forticloud.com on-demand sandbox GUI may have allowed an authenticated user to inject arbitrary web code or HTML in the context of the victim's browser via the upload of a maliciously crafted file...
Header injection in captive portal authentication form
...
Heap-based buffer overflow in oftpd daemon
...
SQL Injection via JSON RPC API
...
Insufficient Session Expiration in SSLVPN using SAML authentication
...
ZTNA Server Improper Certificate Validation
...
Stack Buffer Overflow in Log Report
...
OS command injection in CLI
...
Missing Authentication for critical function in CAPWAP daemon
...
Insertion of Sensitive 2FA Information in logs and debug command
...
LDAP Clear-text credentials retrievable with IP modification
...
FortiOS / FortiProxy / FortiPAM / FortiSwitchManager - Format string vulnerability in CLI commands
...
SSLVPN DOS
...
Improper authentication following read-only user login
...
Multiple Cross Site Scripting on FortiCloud Web Interface Login
Before August, 2018, parameters at /loginmgrlogin in forticloud.com were vulnerable to a Cross-Site-Scripting XSS attack...
FortiCloud Cross Site Script Persistent Web Vulnerabilities
Forticloud online service before May 3, 2016 was exposed to cross site scripting web vulnerabilities, which could allow malicious script being injected in the affected module; this potentially enables XSS attacks...
Workflow session email approval process bypass
...
Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information
...
Buffer overread in authd and wad daemon
...
Command injection in CLI
...
Out-of-bounds access in CAPWAP daemon
...
Stack buffer overflow in fabric service
...
OS command injection in external connector
...
SQL injections in sdnproxy daemon
...
Real-time file system integrity checking write protection bypass
...
FortiCASB data pattern name XSS vulnerability
Failure to sanitize input in the customized data pattern webpage of FortiCASBÂ may allow an authenticated attacker to conduct a stored XSS attack via the name parameter...
Restricted CLI escape using Lua
...
Credential disclosure in LDAP configuration web page.
...
SSL-VPN Symlink Persistence Patch Bypass
...
SSRF in GUI console
...
Private key readable by admin
...
Open Redirect and XSS in Web Filter warning page
...
Buffer overflow in fgfmd
...
Privilege escalation in GUI websocket module
...
Unverified password change via set_password endpoint
...
Multiple format string vulnerabilities
...
Null pointer dereference leading to sslvpn DOS
...
Arbitrary file write on GUI
...