898 matches found
FortiWeb - Path traversal in API controller
A relative path traversal vulnerability CWE-23 in the API of FortiWeb may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests...
Protect
An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in FortiOS may allow a privileged attacker to disclose sensitive information via SNI Client Hello TLS packets...
FortiMail - reflected cross-site scripting vulnerability in FortiGuard URI protection
An improper neutralization of input during web page generation vulnerability 'Cross-site Scripting' CWE-79 in FortiMail may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests to the FortiGuard URI protection service...
FortiOS local privilege escalation via malicious use of USB storage devices
An admin user with superadmin privileges can execute an arbitrary binary contained on an USB drive plugged to a FortiGate, via linking the aforementioned binary to a command that is allowed to be run by the fnsysctl CLI command...
Anti brute-force bypass in administrative interface
...
FortiWeb - Path traversal in API handler
A relative path traversal vulnerability CWE-23 in FortiWeb may allow an authenticated attacker to obtain unauthorized access to files and data via specifically crafted HTTP GET requests...
Stored XSS in guest management page
...
Lack of certificate verification when establishing secure connections
...
Linux Kernel tty_ioctl Vulnerability
A race condition in the ttyioctl function in drivers/tty/ttyio.c in the Linux kernel may allow local users to obtain sensitive information from kernel memory or cause a denial of service...
FortiOS / FortiProxy - Path traversal vulnerability allows VDOM escaping
...
FortiWeb - Relative path traversal in web API
A path traversal vulnerability CWE-23 in the API of FortiWeb may allow a unauthenticated attacker to retrieve specific parts of files from the underlying file system via specially crafted web requests...
FortiMail - Cross-site scripting (XSS) in Webmail
An improper neutralization of input during web page generation vulnerability CWE-79 in FortiMail Webmail may allow an unauthenticated attacker to trigger a cross-site scripting XSS attack via sending specially crafted mail messages...
FortiWAN - Pervasive SQL injection
Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiWAN may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests...
Multiple Apache Vulnerabilties fixed in 2.4.46
...
OpenSSL Advisory - May 2016
OpenSSL released an update in May 2016 to address two high and four low severity vulnerabilities...
Access of NULL pointer in SSLVPNd
...
Protect
A clear text storage of sensitive information CWE-312 vulnerability in both FortiGate and FortiAuthenticator may allow a local unauthorized party to retrieve the Fortinet private keys used to establish secure communication with both Apple Push Notification and Google Cloud Messaging services, via...
Protect
A heap buffer overflow vulnerability in the FortiOS SSL VPN web portal may cause the SSL VPN web service termination for logged in users or potential remote code execution on FortiOS; this happens when an authenticated user visits a specifically crafted proxy-ed webpage, and this is due to a...
DoS in firmware upgrade function
...
FortiWeb & FortiADC - OS command injection in CLI
An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the command line interpreter of FortiWeb & FortiADC may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...
FortiWeb - header injection in FortiWeb API
An improper neutralization of CRLF sequences in HTTP headers 'HTTP Response Splitting' vulnerability CWE-113 In FortiWeb API may allow an authenticated and remote attacker to inject arbitrary headers...
FortiSOAR - PostgreSQL DB access to local users
A missing authentication for critical function CWE-306 vulnerabilty in FortiSOAR's Postgres database may allow a local attacker to access sensitive information via logging into the database using a privileged account without a password...
XSS vulnerability observed in the authentication replacement pages
...
FortiPortal - Insecure password generation
The use of a cryptographically weak pseudo-random number generator CWE-338 in the password reset feature of FortiPortal may allow a remote unauthenticated attacker to predict parts of or the whole newly generated password within a given time frame...
FortiPortal - Authentication bypass and remote code execution as root
A use of hard-coded credentials CWE-798 vulnerability in FortiPortal may allow a remote and unauthenticated attacker to execute unauthorized commands as root by uploading and deploying malicious web application archive files using the default hard-coded Tomcat Manager username and password.Â...
CVE-2015-0279: Expression Language Injection in FortiSIEM
An expression language injection vulnerability in FortiSIEM JBoss RichFaces library may allow a remote attacker to inject expression language EL expressions and execute arbitrary Java code via the do parameter...
CVE-2019-9506 Encryption Key Negotiation of Bluetooth (KNOB) Vulnerability
The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks aka "KNOB" that can decrypt traffic and inject arbitrary...
AMD processors affected by vulnerabilities: Ryzenfall, Fallout, Chimera and Masterkey
A collection of AMD vulnerabilities known as "Ryzenfall, Fallout, Chimera, Masterkey" has been released. Attackers in possession of these vulnerabilities would receive additional capabilities, like persistence by malware injection, stealth, network credential theft and more. It affects AMD...
FortiManager & FortiAnalyzer - Privilege escalation vulnerability
A privilege chaining vulnerability CWE-268 in FortiManager and FortiAnalyzer may allow a local and authenticated attacker with a restricted shell to escalate their privileges to root due to incorrect permissions of some folders and executable files on the system...
FortiWAN - Pervasive OS command injection
Multiple improper neutralization of special elements used in an OS command vulnerabilities CWE-78 in FortiWAN Web GUI may allow an authenticated attacker to execute arbitrary commands on the underlying system's shell via specifically crafted HTTP requests...
FortiPortal - Improper thread synchronization for database operations
A concurrent execution using shared resource with improper Synchronization vulnerability 'Race Condition' CWE-362 in the customer database interface of FortiPortal may allow an authenticated, low-privilege user to bring the underlying database data into an inconsistent state via specific...
FortiSandbox - Buffer overflow due to use of size of source buffer in libc safe functions
A stack-based buffer overflow vulnerability CWE-121Â in the profile parser of FortiSandbox may allow an authenticated attacker to potentially execute unauthorized code or commands via specifically crafted HTTP requests...
Protect
Multiple integer overflow and out of bounds read/write vulnerabilities in the SSL VPN web-mode SSH client may allow an unauthenticated attacker to cause the SSL VPN user session to break Denial of service and possibly to run arbitrary code via specially crafted packets sent from a malicious SSH...
Meltdown and Spectre class vulnerabilities
New types of side channel attacks impact most processors including Intel, AMD, ARM, etc. These attacks allow malicious userspace processes to read kernel memory, thus potentially causing kernel sensitive information to leak...
FortiTester - Undocumented shell command
A hidden functionality vulnerability CWE-1242 in FortiTester CLI may allow a local, privileged user to obtain a root shell on the device via an undocumented command...
Protect
An Improper Authorization vulnerability in the SSL VPN web portal may allow an unauthenticated attacker to change the password of an SSL VPN web portal user via specially crafted HTTP requests...
Multiple Products SSH Undocumented Login Vulnerability
...
Proxy mode with deep inspection - Stack-based buffer overflow
...
FortiSandbox / FortiDeceptor - Improper profile-based access control over APIs
An improper privilege management vulnerability CWE-269 in FortiSandbox & FortiDeceptor may allow a remote authenticated attacker to perform unauthorized API calls via crafted HTTP or HTTPS requests...
FortiClient (Linux) - external access to confighandler webserver
An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in FortiClient for Linux may allow an unauthenticated attacker to access the confighandler webserver via external binaries...
FortiWLM - SQL Injection in AP report handlers
An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability CWE-89 in FortiWLM may allow an authenticated attacker to alter the query logic and execute arbitrary SQL statements via crafted HTTP requests to the AP monitor handlers...
FortiManager Unencrypted Password Vulnerability
A cleartext transmission of sensitive information vulnerability in FortiManager may allow an unauthenticated attacker in a man in the middle position to retrieve the admin password via intercepting REST API JSON responses...
FortiAP Bleeding Bit Vulnerability
Some FortiAP models are vulnerable to the Bleeding Bit Vulnerability CVE-2018-16986 present in the Texas Instruments WiFi chips...
FortiOS SSL Deep-Inspection Proxy Mode badssl.com Compliance
US-Cert published a document at which outlines some security flaws that may be introduced by the use of SSL Deep-Inspection.Â...
ntp-4.2.8p7 Security Vulnerability Announcement April 2016
ntp released an announcement on 26th April 2016, describing 4 low and 7 medium severity vulnerabilities, as listed below:...
SSL v3 "POODLE" Vulnerability
...
Existing websocket connection persists after deleting API admin
...
FortiNAC - Weak password hashing method in /etc/shadow
An insufficiently protected credentials vulnerability CWE-522 in FortiNAC may allow a local attacker with system access to retrieve users' passwords...
FortiAuthenticator - Reflected XSS in the password reset page
An improper neutralization of script-related HTML tags in a web page vulnerability CWE-80 in FortiAuthenticator may allow a remote unauthenticated attacker to trigger a reflected cross site scripting XSS attack via the "reset-password" page...
FortiWeb - Reflected cross-site scripting in SAML login
An improper neutralization of input during web page generation vulnerability CWE-79 in FortiWeb may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests to the SAML login webpage...