898 matches found
Protect
A debug functionality in FortiGate may allow a privileged user to execute unauthorized code or commands via specific chains of print str and cmd mem cli commands to, respectively, read and write hexadecimal values to any memory address...
Remote Exploit Vulnerability in Bash - (Shellshock)
An exploit has been discovered in GNU Bourne Again Shell Bash versions 1.14.0 through 4.3. This vulnerability may allow an attacker to remotely execute arbitrary code by crafting special code within an environment variable string. Under certain circumstances, exploitation of this vulnerability ca...
XSS vulnerability due to AngularJS Client-Side Template injection
...
FortiManager - Improper Inter ADOM access control
An improper access control vulnerability CWE-284 in FortiManager may allow an authenticated attacker with a restricted user profile to modify the VPN tunnel status of other VDOMs using VPN Manager...
Protect
When traffic other than HTTP/S eg: SSH traffic, etc... traverses the FortiOS on port 80/443, it is not redirected to the transparent proxy policy for processing, as it doesn't have a valid HTTP header...
Intel-SA-00086 Security Review Cumulative Update
Intel recently released a security update Intel-SA-00086, regarding Intel ME 11.x, SPS 4.0, and TXE 3.0 intel products...
Improper authorization via prof-admin profile
...
Buffer overflow in execute extender command
...
FortiClient - Privilege escalation in FortiClient installer
An external control of file name or path vulnerability CWE-73 in FortiClient Windows may allow an unprivileged attacker to delete or execute files with admin rights via the MSI installer...
FortiOS SSL Deep-Inspection possible Insecure Renegotiation
FortiOS SSL Deep-Inspection may enable insecure renegotiation between TLS clients and servers that support secure renegotiation, opening the door to potential Man-in-the-Middle attacks CVE-2009-3555 against the TLS connection, where an attacker could inject arbitrary data in the connection withou...
FortiClient (Windows) - Improper write access over FortiClient pipe object
Multiple vulnerabilities including an incorrect permission assignment for critical resource CWE-732 vulnerability and a time-of-check time-of-use TOCTOU race condition CWE-367 vulnerability in FortiClientWindows may allow an attacker on the same file sharing network to execute commands via writin...
Access to NULL pointer in SSL VPN portal
...
FortiMail - Administrative authentication bypass
An improper authentication vulnerability CWE-287 in FortiMail may allow a remote attacker to efficiently guess one administrative account's authentication token by means of the observation of certain system's properties...
Privilege escalation and DoS in FortiClient for Linux through local IPC socket
A privilege escalation vulnerability in FortiClient for Linux may allow a user with low privilege to run root system commands, overwrite system files or cause FortiClient processes to crash via injecting specially crafted client requests in the IPC socket of the FortiClient process...
Policy-based NGFW SSL VPN mode doesn't filter accesses via Bookmarks
...
CVE-2015-1793 OpenSSL "Alternative Chains Certificate Forgery"
...
FortiClient (Windows) - Arbitrary file creation from unprivileged users due to process impersonation
An incorrect authorization CWE-863 vulnerability in FortiClient Windows may allow a local low privileged attacker to perform arbitrary file creation in the device filesystem...
Header injection in proxy login page
...
Protect
A buffer copy without checking size of input 'Classic Buffer Overflow'Â vulnerability CWE-120 in FortiAnalyzer, FortiManager, FortiOS and FortiProxy may allow a privileged attacker to execute arbitrary code or command via crafted CLI execute certificate remote, execute vpn certificate remote and...
FortiGate Vulnerabilities in FortiManager Service
...
Lack of certificate verification when establishing secure connections with threat feed fabric connectors
...
XSS vulnerability in the Login page when FortiCloud Sign-in is used
...
FortiExtender - Arbitrary command execution because of missing CLI input sanitization
An improper neutralization of special elements used in a command vulnerability 'Command Injection' CWE-77 in FortiExtender may allow an authenticated user to raise its privileges to admin user via crafted arguments of the execute CLI command...
Bleichenbacher and Dictionary Attacks on IPsec IKE
Two new attacks on IPsec IKE Internet Key Exchange were recently disclosed 1, involving multiple ways to perform attacks against IKE signature based and PSK Pre-Shared Key authentications. The end goal is to crack IPsec VPN encrypted communications. The relevant CVEs are: CVE-2018-5389: Practical...
FortiPresence - Unpassworded remotely accessible Redis & MongoDB
A missing authentication for critical function vulnerability CWE-306 in FortiPresence on-prem infrastructure server may allow a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests...
Stored cross-site scripting in replacement messages visualization
...
Protect
An improper access control vulnerability CWE-284 in FortiOS may allow an authenticated attacker with a restricted user profile to gather sensitive information and modify the SSL-VPN tunnel status of other VDOMs using specific CLI commands...
Protect
A use of hard-coded cryptographic key vulnerability CWE 321 in FortiOS SSLVPN may allow an attacker to retrieve the key by reverse engineering...
OpenSSL Security Advisory [22 Sept 2016]
The OpenSSL project released an advisory on Sept 22nd, 2016, describing 1 High, 1 Medium and 12 Low severity vulnerabilities, as listed below: OCSP Status Request extension unbounded memory growth CVE-2016-6304 SSLpeek hang on empty record CVE-2016-6305 SWEET32 Mitigation CVE-2016-2183 OOB write ...
FortiNAC - argument injection in XML interface on port tcp/5555
An improper neutralization of special elements used in a command 'command injection' vulnerability CWE-77 in FortiNAC tcp/5555 service may allow an unauthenticated attacker to copy local files of the device to other local directories of the device via specially crafted input fields. To access the...
Open redirect in sslvpnd
...
FortiClient (Windows) - Arbitrary file write as SYSTEM
An execution with unnecessary privileges vulnerability CWE-250 in FortiClientWindows may allow a local attacker to perform an arbitrary file write on the system...
Access of uninitialized pointer in administrative interface API
...
Out-of-bound-write in sslvpnd
...
Protect
A format string vulnerability CWE-134 in the command line interpreter of FortiOS, FortiOS-6K7K, FortiProxy, FortiADC, and FortiMail may allow an authenticated user to execute unauthorized code or commands via specially crafted command arguments...
Multiple Apache Vulnerabilities fixed in 2.4.52
The Apache project released an advisory, describing the following vulnerabilities:...
Protect
Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiOS, FortiManager and FortiAnalyzer may allow an attacker with access to the CLI configuration or the CLI backup file to decrypt the sensitive data, via knowledge of the hard-coded key...
FortiClient - installer DLL Hijacking Vulnerability
Multiple unsafe search path vulnerabilities in FortiClient online installers may allow an attacker with control over the directory in which the installers reside to execute arbitrary code on the system via uploading malicious .dll files in that directory...
Wind River VxWorks IPnet TCP/IP Stack Vulnerabilities (aka. URGENT/11)
11 zero day vulnerabilities aka. URGENT/11 were disclosed in VxWorks® TCP/IP stack IPnet:...
Protect
FortiSwitch is vulnerable to multiple Cross-site Scripting XSS attacks present in the jQuery javascript library...
FortiNAC - SSL Renegotation leading to DoS
An improper permissions, privileges, and access controls vulnerability CWE-264 in FortiNAC may allow an unauthenticated attacker to perform a DoS attack on the device via client-secure renegotiation...
FortiWeb - SQL Injection in delete filter component
An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability CWE-89 in FortiWeb delete log filter component may allow a privileged attacker to execute SQL commands over the log database via specifically crafted strings parameters...
Read Only administrator can intercept sensitive data
...
SSH authentication bypass when RADIUS authentication is used
...
TCP Middlebox Reflection
...
Multiple vulnerabilities in PJSIP library
Some advisories were released affecting the version of PJSIP library used in some Fortinet products:...
FortiRecorder sets credentials of FortiCameras to static values
An Use of Hard-coded Credentials vulnerability in FortiRecorder may allow an unauthenticated attacker with knowledge of the aforementioned credentials and network access to FortiCameras to take control of those, provided they are managed by a FortiRecorder device...
FortiGate Cross-Site Scripting Vulnerability
...