649 matches found
FortiNAC - java untrusted object deserialization RCE
A deserialization of untrusted data vulnerability CWE-502 in FortiNAC may allow an unauthenticated user to execute unauthorized code or commands via specifically crafted requests to the tcp/1050 service...
FortiManager & FortiAnalyzer - SSRF in FortiGuard Outbreak feature
A server-side request forgery SSRF vulnerability CWE-918 in FortiManager and FortiAnalyzer GUI may allow a remote and authenticated attacker to access unauthorized files and services on the system via specially crafted web requests...
FortiRecorder - DoS in login authentication mechanism
An uncontrolled resource consumption vulnerability CWE-400 in FortiRecorder login authentication mechanism may allow an unauthenticated attacker to make the device unavailable via crafted GET requests...
FortiWeb - Path traversal via browse report CGI component
A relative path traversal vulnerability CWE-23 in FortiWeb may allow an authenticated user to obtain unauthorized access to files and data via specifically crafted web requests...
FortiWAN - Stack-based buffer overflow in bmstatd
Multiple stack-based buffer overflow vulnerabilities CWE-121 both in network daemons and in the command line interpreter of FortiWAN may allow an unauthenticated attacker to potentially corrupt control data in memory and execute arbitrary code via specifically crafted requests...
FortiWeb - Reflected cross-site scripting in error controllers
Multiple improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 in FortiWeb may allow an unauthenticated user to inject malicious javascript code into the response webpage via crafted requests to device's error handlers...
FortiClient (MacOS) - Dylib injection Vulnerability observed in FortiClientMacOS
An improper control of generation of code vulnerability CWE-94 in FortiClient for MacOS may allow an authenticated attacker to hijack the MacOS camera via replacing the FortiClient camera handling library with a malicious one...
FortiSandbox - Unauthorized user able to download the device configuration file.
An improper access control vulnerability CWE-284 in FortiSandbox may allow an authenticated, unprivileged attacker to download the device configuration file via the recovery URL...
Protect
A buffer underwrite CWE-124 vulnerability in the firmware verification routine of FortiWeb, FortiOS, FortiSwitch, FortiADC, FortiAI, FortiManager, FortiAnalyzer, FortiProxy may allow an attacker located in the adjacent network to potentially execute arbitrary code via a specifically crafted...
FortiProxy SSL VPN user credential plaintext storage
...
The ROBOT Attack - Return of Bleichenbacher's Oracle Threat
A plaintext recovery of encrypted messages or a Man-in-the-middle MiTM attack on RSA PKCS 1 v1.5 encryption may be possible without knowledge of the server's private key...
OpenSSL Advisory - January 2016
OpenSSL released an update in January 2016 to address one high and one low severity vulnerabilities...
ZebOS routing remote shell service enabled
...
FSSO stack-based buffer overflow
...
Protect
A use of GET request method with sensitive query strings vulnerability CWE-598 in the FortiOS SSL VPN component may allow an attacker to view plaintext passwords of remote services such as RDP or VNC, if the attacker is able to read the GET requests to those services found in logs, referers,...
FortiADC - command injection in web interface
An improper neutralization of special elements used in an OS Command vulnerability CWE-78 in FortiADC may allow an authenticated attacker with access to the web GUI to execute unauthorized code or commands via specifically crafted HTTP requests...
FortiClient (Windows) - Privilege Escalation via directory traversal attack
A relative path traversal vulnerability CWE-23 in FortiClient for Windows may allow a local unprivileged attacker to escalate their privileges to SYSTEM via the named pipe responsible for FortiESNAC service...
FortiDDoS - Use of hardcoded key for the JWT token
A use of hard-coded cryptographic key vulnerability CWE-321 in FortiDDoS API may allow an attacker who managed to retrieve the key from one device to sign JWT tokens for any device...
FortiEDR - Denial of service due to folder access permission change
An improper control of a resource through its lifetime CWE-664 vulnerability in FortiEDR Collector may allow a privileged attacker to make the application unresponsive via changing its root directory access permission...
FortiClientEMS & FortiClient - Telemetry protocol is vulnerable to a MitM Vulnerability
A combination of a use of hard-coded cryptographic key vulnerability CWE-321 in FortiClientEMS and an improper certificate validation vulnerability CWE-297 in FortiClientWindows, FortiClientLinux and FortiClientMac may allow an unauthenticated and network adjacent attacker to perform a...
Protect
A buffer overflow CWE-121 in the TFTP client library of FortiOS, may allow an authenticated local attacker to achieve arbitrary code execution via specially crafted command line arguments...
FortiManager & FortiAnalyzer - Use after free vulnerability in fgfmsd daemon
A Use After Free CWE-416 vulnerability in FortiManager and FortiAnalyzer fgfmsd daemon may allow a remote, non-authenticated attacker to execute unauthorized code as root via sending a specifically crafted request to the fgfm port of the targeted device...
Protect
An improper following of a certificate's chain of trust vulnerability in FortiGate SSL-VPN may allow an LDAP user to connect to VPN with any certificate that is signed by a trusted Certificate Authority...
Protect
An external control of system vulnerability in FortiOS may allow an authenticated, regular user to change the routing settings of the device via connecting to the ZebOS component...
CVE-2015-3456 "VENOM" vulnerability
...
FortiADC & FortiADC Manager - Command injection vulnerabilities in cli commands
Multiple improper neutralization of special elements used in an os command 'OS Command Injection' vulnerabilties CWE-78 in FortiADC & FortiADC Manager may allow a local authenticated attacker to execute arbitrary shell code as root user via crafted CLI requests...
FortiSIEM - Plaintext credentials storage in DB
A plaintext storage of a password vulnerability CWE-256 in FortiSIEM may allow an attacker able to access user DB content to impersonate any admin user on the device GUI...
FortiSOAR - Server-side Template Injection in playbook execution
An improper neutralization of special elements used in a template engine vulnerability CWE-1336 in FortiSOAR management interface may allow a remote and authenticated attacker to execute arbitrary code via a crafted payload...
FortiTester - Multiple command injection vulnerabilities in GUI and API
Multiple improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerabilities CWE-78 in FortiTester may allow an authenticated attacker to execute arbitrary commands in the underlying shell...
Protect
An improper access control vulnerability CWE-284 in FortiOS may allow an authenticated attacker with a restricted user profile to gather the checksum information about the other VDOMs via CLI commands...
FortiWeb - Incorrect handling of large requests leads to denial of service
An uncontrolled resource consumption vulnerability CWE-400 in FortiWeb may allow an unauthenticated attacker to cause a Denial of Service to the FortiWeb's HTTP daemon via sending a large amount of crafted HTTP requests...
FortiWeb - Stack-Based Buffer Overflow vulnerability
A stack-based buffer overflow CWE-121 vulnerability in FortiWeb may allow an unauthenticated attacker to overwrite the content of the stack and potentially execute arbitrary code by sending crafted HTTP requests with large request parameter values...
Protect
A format string vulnerability CWE-134 in the command line interpreter of FortiOS and FortiProxy may allow an authenticated user to execute unauthorized code or commands via specially crafted command arguments...
FortiWeb - Command injection in CLI backup functionality
An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in FortiWeb may allow a privileged attacker to execute arbitrary bash commands via crafted cli backup parameters...
FortiADC -- Read-Only user able to modify system files
An improper privilege management vulnerability CWE-269 in FortiADC may allow a remote authenticated attacker with restricted user profile to modify the system files using the shell access...
FortiNAC - SQL Injection
Multiple improper neutralization of special elements used in SQL commands 'SQL Injection' vulnerability CWE-89 in FortiNAC may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters...
FortiWeb - Open redirect due to missing domain whitelisting
A URL redirection to untrusted site 'Open Redirect' CWE-601 in FortiWeb may allow an authenticated attacker to use the device as proxy to reach any protected host via crafted HTTP requests...
FortiClientEMS - Authenticated Injection vulnerabilities
An improper neutralization of input vulnerability CWE-79 in FortiClientEMS may allow a remote authenticated attacker to inject malicious script/tags via the name parameter of various sections of the server...
FortiPortal - Use of a predictable salt and digest-based algorithm for password hashing
A use of one-way hash with a predictable salt CWE-760 vulnerability in the password storing mechanism of FortiPortal may allow an attacker already in possession of the password store to decrypt the passwords by means of precomputed tables...
FortiMail - Multiple buffer overflows
Multiple instances of incorrect calculation of buffer size in FortiMail Webmail and Administrative interface may allow an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests...
Protect
On May 11th, 2021, Mathy Vanhoef New York University Abu Dhabi published a new paper, Fragment and Forge: Breaking Wi-Fi Through Frame Aggregation and Fragmentation, on a number of vulnerabilities in the base 802.11 protocol 802.11 is the standard that Wi-Fi is built on. The paper discloses three...
FortiOS IKE VendorID version information disclosure
The FortiOS IKE packets which include the Vendor ID embed the FortiOS build version number...
SAM and LSAD remote protocols man in the middle vulnerability (Badlock)
The Security Account Manager Remote Protocol MS-SAMR and the Local Security Authority Domain Policy Remote Protocol MS-LSAD are both vulnerable to man in the middle attacks. These protocols are typically available on all Windows installations as well as every Samba server...
Multiple Vulnerabilities in OpenSSL
...
Protect
A NULL pointer dereference vulnerability CWE-476 in FortiOS may allow a remote unauthenticated attacker to crash the SSL-VPN daemon via specially crafted HTTP requests...
FortiADC - Command injection in external resource module
An improper neutralization of special elements used in an OS command vulnerability CWE-78 in FortiADC may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...
FortiNAC - Unauthenticated access to administrative operations
An improper authorization vulnerability CWE-285 in FortiNAC may allow an unauthenticated attacker to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests...
Protect
A key management error vulnerability CWE-320 affecting the RSA SSH host key in FortiOS may allow an unauthenticated attacker to perform a man in the middle attack...
FortiDeceptor - Path traversal vulnerability
Multiple relative path traversal vulnerabilities CWE-23 in FortiDeceptor management interface may allow a remote and authenticated attacker to retrieve and delete arbitrary files from the underlying filesystem via specially crafted web requests...
FortiAP-U - Relative path traversal vulnerability in CLI
A path traversal vulnerability CWE-22 in FortiAP-U CLI may allow an admin user to delete and access unauthorized files and data via specifically crafted CLI commands...