898 matches found
FortiAuthenticator - Command injection in CLI
An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the command line interpreter of FortiAuthenticator may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...
The password configured in the FortiWeb's Web Vulnerability Scan profile is visible in cleartext.
...
BlueBorne vulnerabilities and security flaws in Bluetooth stacks
A collection of Bluetooth implementation vulnerabilities known as "BlueBorne" has been released. These vulnerabilities collectively affect Windows, iOS, and Linux-kernel-based operating systems including Android and Tizen, and may in the worst case allow an unauthenticated attacker to perform...
Key Reinstallation Attacks: Cryptographic/protocol attack against WPA2
Several vulnerabilities affect the Wi-Fi Protected Access II WPA2 protocol, potentially enabling Man-in-the-Middle MitM attacks between Wifi Clients and Access Points running WPA2 . The impact includes decryption, packet replay, TCP connection hijacking and HTTP content injection...
Linux Kernel Dirty Cow Vulnerability
Linux Kernel Dirty Cow Vulnerability Announcement...
FortiAuthenticator multiple vulnerabilities
...
FortiADC - WAF XSS Injection Bypass
An improper handling of malformed request vulnerability CWE-228 in FortiADC may allow a remote attacker without privileges to bypass some Web Application Firewall WAF protection such as the SQL Injection and XSS filters via a malformed HTTP request...
Apache commons_text(CVE-2022-42889) and commons_configuration (CVE-2022-33980) vulnerability
...
FortiManager, FortiAnalyzer and FortiPortal - Multiple OS command injection vulnerabilities
Multiple OS command injection CWE-78 vulnerabilities in the command line interface of FortiManager, FortiAnalyzer, and FortiPortal may allow a local authenticated and unprivileged user to execute arbitrary shell commands as root via specifically crafted CLI command parameters...
FortiMail - Salted Digest vulnerable to length extension attacks
A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail may allow an unauthenticated attacker to tamper with signed URLs by appending further data which allows bypass of signature verification...
FortiSIEM Database hard-coded Credentials
A hard-coded password vulnerability in the FortiSIEM database component may allow attackers to access the device database via the use of static credentials...
Protect
Improper permission or value checking in the CLI console may allow a non-privileged user to obtain plaint text private keys of system's builtin local certificates via unsetting the keys encryption password or for user uploaded local certificates via setting an empty password. Note that backed up...
Multiple vulnerabilities in Linux kernels through 4.6.3
Of multiple vulnerabilities released affecting Linux kernels through 4.6.3, FortiOS was found vulnerable to the following two:...
RSA-CRT key leak under certain conditions
FortiOS now includes for all SSL libraries a countermeasure against Lenstra's fault attack on RSA-CRT optimization when a RSA signature is corrupted...
FortiADC - Path traversal vulnerability in CLI
A relative path traversal vulnerability CWE-23 in FortiADC may allow a privileged attacker to delete arbitrary directories from the underlying file system via crafted CLI commands...
FortiWeb - OS command injection in Web GUI
An improper neutralization of special elements used in an os command 'OS Command Injection' CWE-78 in FortiWeb may allow an authenticated attacker to execute arbitrary shell code as root user via crafted HTTP requests...
Evasion by manipulating MIME attachment
...
FortiSIEM - Glassfish local credentials stored in plain text
An improper authentification vulnerability CWE-287 in FortiSIEM may allow a local attacker with CLI access to perform operations on the Glassfish server directly via a hardcoded password...
OS command injection vulnerability in CLI
...
Protect
An improper validation of certificate with host mismatch CWE-297 vulnerability in FortiOS may allow the connection to a malicious LDAP server via options in GUI, leading to disclosure of sensitive information, such as AD credentials...
Protect
An improper input validation vulnerability in FortiOS admin webUI may allow an attacker to perform an URL redirect attack via a specifically crafted request to the admin initial password change webpage...
FortiOS DoS on webUI through 'params' JSON parameter
An authenticated user may pass a specially crafted payload to the 'params' parameter of the JSON web API URLs with /json , which can cause the web user interface to be temporarily unresponsive...
OpenSSL Advisory - December 2015
...
TLS FREAK Attack
...
Heap buffer overflow in sslvpn pre-authentication
...
Protect
An improper certificate validation vulnerability CWE-295 in FortiOS may allow a network adjacent and unauthenticated attacker to man-in-the-middle the communication between the FortiGate and some peers such as private SDNs and external cloud platforms...
FortiProxy SSL VPN buffer overflow when parsing javascript href content
A heap buffer overflow vulnerability in the FortiProxy SSL VPN web portal may cause the SSL VPN web service termination for logged in users or potential remote code execution on FortiProxy. This happens when an authenticated user visits a specifically crafted proxied webpage and is due to a failu...
Cookie Parser Buffer Overflow Vulnerability
FortiGate FortiOS: 4.3.8 and below 4.2.12 and below 4.1.10 and below...
FortiWeb - Path traversal in API controller
Multiple relative path traversal vulnerabilities CWE-23 in the API of FortiWeb may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests...
XSS vulnerability in the ESS Profile and Radius Profile of FortiWLC
An improper neutralization of input vulnerability in FortiWLC may allow a remote authenticated attacker to perform a stored cross site scripting attack XSS via the ESS profile or the Radius Profile...
Protect
Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information URL/SPAM services in FortiOS 5.6, and URL/SPAM/AV services in FortiOS 6.0.; URL rating in FortiClient sent and...
HTTP/2 Multiple DoS Attacks (VU#605641)
Improper implementations of the HTTP/2 protocol can lead to a variety denial-of-service DoS attacks...
Protect
A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server...
Protect
A stack-based buffer overflow vulnerability CWE-121 in the command line interpreter of FortiOS and FortiProxy may allow an authenticated attacker to execute unauthorized code or commands via specially crafted command line arguments...
FortiDDoS - Use of hardcoded key for the JWT token
A use of hard-coded cryptographic key vulnerability CWE-321 in FortiDDoS API may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device...
FortiProxy SSL-VPN Improper Access Control vulnerability through the Quick connection functionality
...
Linux kernel - challenge ack information leak
net/ipv4/tcpinput.c in certain Linux kernel versions does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack...
FSSO stack-based buffer overflow
...
FortiWeb Cross-Site Request Forgery Vulnerability
...
Plain-text credentials in GET request via SSL VPN web portal
...
FortiRecorder - DoS in login authentication mechanism
An uncontrolled resource consumption vulnerability CWE-400 in FortiRecorder login authentication mechanism may allow an unauthenticated attacker to make the device unavailable via crafted GET requests...
Protect
An improper neutralization of special elements used in an os command CWE-78 vulnerability in FortiOS may allow an authenticated attacker to execute privileged commands on a linked FortiSwitch via diagnostic CLI commands...
Flaws over keytab encryption scheme
...
FortiADC - Unverified password change over the GUI
An unverified password change vulnerability CWE-620 in FortiADC may allow an authenticated attacker to bypass the Old Password check in the password change form for the account the attacker is logged into or for others accounts except admin when the attacker has Read Write access on System via a...
Protect
A buffer overflow CWE-121 in the TFTP client library of FortiOS, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments...
FortiProxy - Unauthenticated SSL VPN users password modification
An improper access control vulnerability in FortiProxy SSL VPN web portal may allow an unauthenticated and remote attacker to change local SSL-VPN users' passwords via specially crafted HTTP requests...
FortiAnalyzer could potentially be used in NTP amplification attacks
An insufficient control of network message volume CWE-406 vulnerability in FortiAnalyzer may allow an unauthenticated remote attacker to perform NTP amplification attacks thereby causing reflected denial of service on arbitrary targets via sending specially crafted mode 6 queries to the...
FortiPortal Multiple Vulnerabilities
Multiple vulnerabilities impacting FortiPortal were disclosed to Fortinet with details as follows:...
Glibc getaddrinfo() stack-overflow
...
FortiADC & FortiADC Manager - Command injection vulnerabilities in cli commands
Multiple improper neutralization of special elements used in an os command 'OS Command Injection' vulnerabilties CWE-78 in FortiADC & FortiADC Manager may allow a local authenticated attacker to execute arbitrary shell code as root user via crafted CLI requests...