898 matches found
XSS vulnerability due to AngularJS Client-Side Template injection
...
Buffer overflow in execute extender command
...
FortiNAC - SSH Weak Key Exchange Algorithm
A use of a weak cryptographic algorithm vulnerability CWE-327 in FortiNAC may increase the chances of an attacker to have access to sensitive information or to perform man-in-the-middle attacks...
Http debug commands in FortiMail exposes users credentials to admins
...
FortiOS SSL Deep-Inspection possible Insecure Renegotiation
FortiOS SSL Deep-Inspection may enable insecure renegotiation between TLS clients and servers that support secure renegotiation, opening the door to potential Man-in-the-Middle attacks CVE-2009-3555 against the TLS connection, where an attacker could inject arbitrary data in the connection withou...
Remote Exploit Vulnerability in Bash - (Shellshock)
An exploit has been discovered in GNU Bourne Again Shell Bash versions 1.14.0 through 4.3. This vulnerability may allow an attacker to remotely execute arbitrary code by crafting special code within an environment variable string. Under certain circumstances, exploitation of this vulnerability ca...
FortiManager - Improper Inter ADOM access control
An improper access control vulnerability CWE-284 in FortiManager may allow an authenticated attacker with a restricted user profile to modify the VPN tunnel status of other VDOMs using VPN Manager...
Intel-SA-00086 Security Review Cumulative Update
Intel recently released a security update Intel-SA-00086, regarding Intel ME 11.x, SPS 4.0, and TXE 3.0 intel products...
Policy-based NGFW SSL VPN mode doesn't filter accesses via Bookmarks
...
FortiClient - Privilege escalation in FortiClient installer
An external control of file name or path vulnerability CWE-73 in FortiClient Windows may allow an unprivileged attacker to delete or execute files with admin rights via the MSI installer...
Improper authorization via prof-admin profile
...
FortiClient (Windows) - Improper write access over FortiClient pipe object
Multiple vulnerabilities including an incorrect permission assignment for critical resource CWE-732 vulnerability and a time-of-check time-of-use TOCTOU race condition CWE-367 vulnerability in FortiClientWindows may allow an attacker on the same file sharing network to execute commands via writin...
FortiMail - Administrative authentication bypass
An improper authentication vulnerability CWE-287 in FortiMail may allow a remote attacker to efficiently guess one administrative account's authentication token by means of the observation of certain system's properties...
Access to NULL pointer in SSL VPN portal
...
CVE-2015-1793 OpenSSL "Alternative Chains Certificate Forgery"
...
FortiGate Vulnerabilities in FortiManager Service
...
Header injection in proxy login page
...
Privilege escalation and DoS in FortiClient for Linux through local IPC socket
A privilege escalation vulnerability in FortiClient for Linux may allow a user with low privilege to run root system commands, overwrite system files or cause FortiClient processes to crash via injecting specially crafted client requests in the IPC socket of the FortiClient process...
FortiClient (Windows) - Arbitrary file creation from unprivileged users due to process impersonation
An incorrect authorization CWE-863 vulnerability in FortiClient Windows may allow a local low privileged attacker to perform arbitrary file creation in the device filesystem...
Protect
A buffer copy without checking size of input 'Classic Buffer Overflow'Â vulnerability CWE-120 in FortiAnalyzer, FortiManager, FortiOS and FortiProxy may allow a privileged attacker to execute arbitrary code or command via crafted CLI execute certificate remote, execute vpn certificate remote and...
Wind River VxWorks IPnet TCP/IP Stack Vulnerabilities (aka. URGENT/11)
11 zero day vulnerabilities aka. URGENT/11 were disclosed in VxWorks® TCP/IP stack IPnet:...
FortiPresence - Unpassworded remotely accessible Redis & MongoDB
A missing authentication for critical function vulnerability CWE-306 in FortiPresence on-prem infrastructure server may allow a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests...
FortiExtender - Arbitrary command execution because of missing CLI input sanitization
An improper neutralization of special elements used in a command vulnerability 'Command Injection' CWE-77 in FortiExtender may allow an authenticated user to raise its privileges to admin user via crafted arguments of the execute CLI command...
Protect
A use of hard-coded cryptographic key vulnerability CWE 321 in FortiOS SSLVPN may allow an attacker to retrieve the key by reverse engineering...
Stored cross-site scripting in replacement messages visualization
...
FortiNAC - argument injection in XML interface on port tcp/5555
An improper neutralization of special elements used in a command 'command injection' vulnerability CWE-77 in FortiNAC tcp/5555 service may allow an unauthenticated attacker to copy local files of the device to other local directories of the device via specially crafted input fields. To access the...
XSS vulnerability in the Login page when FortiCloud Sign-in is used
...
Lack of certificate verification when establishing secure connections with threat feed fabric connectors
...
Protect
Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiOS, FortiManager and FortiAnalyzer may allow an attacker with access to the CLI configuration or the CLI backup file to decrypt the sensitive data, via knowledge of the hard-coded key...
FortiClient - installer DLL Hijacking Vulnerability
Multiple unsafe search path vulnerabilities in FortiClient online installers may allow an attacker with control over the directory in which the installers reside to execute arbitrary code on the system via uploading malicious .dll files in that directory...
Bleichenbacher and Dictionary Attacks on IPsec IKE
Two new attacks on IPsec IKE Internet Key Exchange were recently disclosed 1, involving multiple ways to perform attacks against IKE signature based and PSK Pre-Shared Key authentications. The end goal is to crack IPsec VPN encrypted communications. The relevant CVEs are: CVE-2018-5389: Practical...
Open redirect in sslvpnd
...
FortiMail - Cross-site scripting (XSS) in Webmail
An improper neutralization of input during web page generation vulnerability CWE-79 in FortiMail Webmail may allow an unauthenticated attacker to trigger a cross-site scripting XSS attack via sending specially crafted mail messages...
FortiClient (Windows) - Arbitrary file write as SYSTEM
An execution with unnecessary privileges vulnerability CWE-250 in FortiClientWindows may allow a local attacker to perform an arbitrary file write on the system...
OpenSSL Security Advisory [22 Sept 2016]
The OpenSSL project released an advisory on Sept 22nd, 2016, describing 1 High, 1 Medium and 12 Low severity vulnerabilities, as listed below: OCSP Status Request extension unbounded memory growth CVE-2016-6304 SSLpeek hang on empty record CVE-2016-6305 SWEET32 Mitigation CVE-2016-2183 OOB write ...
FortiNAC - SSL Renegotation leading to DoS
An improper permissions, privileges, and access controls vulnerability CWE-264 in FortiNAC may allow an unauthenticated attacker to perform a DoS attack on the device via client-secure renegotiation...
Access of uninitialized pointer in administrative interface API
...
Multiple Apache Vulnerabilities fixed in 2.4.52
The Apache project released an advisory, describing the following vulnerabilities:...
FortiWeb - SQL Injection in delete filter component
An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability CWE-89 in FortiWeb delete log filter component may allow a privileged attacker to execute SQL commands over the log database via specifically crafted strings parameters...
Multiple vulnerabilities in PJSIP library
Some advisories were released affecting the version of PJSIP library used in some Fortinet products:...
Protect
An improper access control vulnerability CWE-284 in FortiOS may allow an authenticated attacker with a restricted user profile to gather sensitive information and modify the SSL-VPN tunnel status of other VDOMs using specific CLI commands...
FortiRecorder sets credentials of FortiCameras to static values
An Use of Hard-coded Credentials vulnerability in FortiRecorder may allow an unauthenticated attacker with knowledge of the aforementioned credentials and network access to FortiCameras to take control of those, provided they are managed by a FortiRecorder device...
Out-of-bound-write in sslvpnd
...
SSH authentication bypass when RADIUS authentication is used
...
Protect
A format string vulnerability CWE-134 in the command line interpreter of FortiOS, FortiOS-6K7K, FortiProxy, FortiADC, and FortiMail may allow an authenticated user to execute unauthorized code or commands via specially crafted command arguments...
Stored XSS in guest management page
...
Read Only administrator can intercept sensitive data
...
Unauthenticated access to static files containing logging information
...
FortiOS local privilege escalation via malicious use of USB storage devices
An admin user with superadmin privileges can execute an arbitrary binary contained on an USB drive plugged to a FortiGate, via linking the aforementioned binary to a command that is allowed to be run by the fnsysctl CLI command...