898 matches found
FortiSandbox - Race condition vulnerability in command shell
A concurrent execution using shared resource with improper synchronization 'race condition' in the command shell of FortiSandbox may allow an authenticated attacker to bring the system into an unresponsive state via specifically orchestrated sequences of commands...
FortiProxy multiple pre-auth XSS vulnerabilities on SSL VPN
An Improper Neutralization of Input During Web Page Generation in the SSL VPN portal of FortiProxy may allow an unauthenticated, remote attacker to perform a reflected Cross Site Scripting attack XSS by injecting malicious payload in the error, message or redir parameters...
OpenSSL Advisory - January 2016
OpenSSL released an update in January 2016 to address one high and one low severity vulnerabilities...
Multiple Vulnerabilities in OpenSSL
...
FortiWeb Cross-Site Scripting Vulnerability
...
Format String Bug in fortiguard-resources CLI command
...
FortiNAC - Stored XSS triggering RCE via license key forgery
An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability CWE-79 in FortiNAC License Management would permit an authenticated attacker to trigger remote code execution via crafted licenses...
FortiClientWindows - Arbitrary file creation by unprivileged users
A relative path traversal CWE-23 vulnerability in FortiClientWindows may allow a local low privileged attacker to perform arbitrary file creation on the device filesystem...
FortiNAC - Unauthenticated access to administrative operations
An improper authorization vulnerability CWE-285 in FortiNAC may allow an unauthenticated attacker to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests...
FortiAnalyzer & FortiManager - improper authorization to template image
An exposure of resource to wrong sphere vulnerability CWE-668 in FortiAnalyzer and FortiManager GUI may allow an unauthenticated and remote attacker to access report template images via referencing the name in the URL path...
FortiSOAR - Improper access control on gateway API
An improper access control vulnerability CWE-284 in FortiSOAR may allow an unauthenticated attacker to access gateway API data via crafted HTTP GET requests...
FortiSIEM - privilege escalation by script executionution in Windows Agent
An improper privilege management vulnerability CWE-269 in the FortiSIEM Windows Agent may allow an authenticated user to execute unauthorized code or commands as a privileged user via script execution...
FortiAuthenticator - Hard-coded cryptographic keys used to encrypt sensitive data
Usage of hard-coded cryptographic keys to encrypt configuration files and debug logs in FortiAuthenticator may allow an attacker with access to the files or the CLI configuration to decrypt the sensitive data, via knowledge of the hard-coded key...
FortiSIEM LDAP server password reflected in admin portal
An information exposure vulnerability in the admin portal of FortiSIEM may allow an authenticated admin to retrieve the LDAP server password via the HTML source code. This could potentially aggravate attacks targeting the authenticated admin session, should they exist XSS, social engineering, pro...
OpenSSL vulnerabilities - June 2015
...
CVE-2015-3456 "VENOM" vulnerability
...
Multiple CSRF Vulnerabilities in FortiGate
...
FortiWeb - Heap-based buffer overflows in API controller
Multiple heap-based buffer overflow vulnerabilities CWE-122 in web API controllers of FortiWeb may allow a remote authenticated attacker to execute arbitrary code or commands via specifically crafted HTTP requests...
Protect
A heap-based buffer overflow CWE-122 in the firmware signature verification function of FortiOS may allow an attacker to execute arbitrary code via specially crafted installation images...
FortiWeb - Uncontrolled resource consumption
An uncontrolled resource consumption vulnerability CWE-400 in FortiWeb may allow an unauthenticated attacker to cause a denial of service via crafted HTTP requests to proxy services...
FortiWeb - OS command injection vulnerability
An OS command injection vulnerability in FortiWeb's management interface may allow a remote authenticated attacker to execute arbitrary commands on the system via the SAML server configuration page...
FortiDeceptor - OS command injection vulnerabilities
Multiple OS command injection vulnerabilities in FortiDeceptor management interface may allow an authenticated user to execute arbitrary commands on the system via specifically crafted web requests...
FortiAP system files overwrite via the tcpdump CLI command
...
Protect
VM appliance lack of root file system integrity check may allow an attacker with read/write access to the VM image before it is booted up to inject malicious implants in the image...
Authenticated user null pointer dereference in SSL-VPN
...
FortiClient (Windows) / FortiConverter (Windows) - Insecure Installation Folder
An incorrect default permissions CWE-276 vulnerability in FortiClient Windows and FortiConverter Windows may allow a local authenticated attacker to tamper with files in the installation folder, if FortiClient or FortiConvreter is installed in an insecure folder...
FortiWeb - Buffer overflow in execute backup-local command
A stack-based buffer overflow vulnerability CWE-121 in FortiWeb may allow a privileged attacker to execute arbitrary code or commands via specifically crafted CLI execute backup-local rename and execute backup-local show operations...
FortiSOAR - Privilege escalation from nginx user to root
An improper privilege management vulnerability CWE-269 in FortiSOAR may allow a GUI user who has already found a way to modify system files via another, unrelated and hypothetical exploit to execute arbitrary Python commands as root...
FortiAuthenticator - XSS vulnerability in OWA login page
An improper neutralization of input during web page generation vulnerability CWE-79 in FortiAuthenticator OWA Agent may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests...
FortiWAN - Stored Cross-site scripting in log viewer
An improper neutralization of input during web page generation vulnerability CWE-79 in FortiWAN may allow an attacker to perform a stored cross-site scripting attack via specifically crafted HTTP requests...
FortiWAN - Use of hardcoded salt for password hashing
A use of a one-way hash with a predictable salt vulnerability CWE-760 in FortiWAN may allow an attacker who has previously come in possession of the password file to potentially guess passwords therein stored...
FortiWeb - Multiple command injection vulnerabilities
Multiple command injection vulnerabilities CWE-78 in the command line interpreter of FortiWeb may allow an authenticated attacker to execute arbitrary commands on the underlying system shell via specially crafted command arguments...
FortiPortal - XML parser is vulnerable to XXE attacks
An improper restriction of XML external entity reference vulnerability CWE-611 in the parser of XML responses of FortiPortal may allow an attacker who controls the producer of XML reports consumed by FortiPortal to trigger a denial of service or read arbitrary files from the underlying file...
Protect
On May 11th, 2021, Mathy Vanhoef New York University Abu Dhabi published a new paper, Fragment and Forge: Breaking Wi-Fi Through Frame Aggregation and Fragmentation, on a number of vulnerabilities in the base 802.11 protocol 802.11 is the standard that Wi-Fi is built on. The paper discloses three...
FortiWeb - Stack-Based Buffer Overflow vulnerability
A stack-based buffer overflow CWE-121 vulnerability in FortiWeb may allow an unauthenticated attacker to overwrite the content of the stack and potentially execute arbitrary code by sending crafted HTTP requests with large request parameter values...
Null pointer dereference in sslvpnd proxy endpoint
...
FortiWeb - Multiple Stack based buffer overflow in web interface
Multiple buffer overflow CWE-121 vulnerabilities in the web server of FortiWeb may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted HTTP requests...
FortiWeb - Double free in pipe management
A double free vulnerability CWE-415 in FortiWeb CLI may allow an authenticated, local attacker to achieve arbitrary code execution via specifically crafted commands...
FortiSandbox & FortiDeceptor - Insufficient logging and lack of limitation of failed authentication attempts
An insufficient logging CWE-778 vulnerability in FortiSandbox and FortiDeceptor may allow a remote attacker to repeatedly enter incorrect credentials without causing a log entry, and with no limit on the number of failed authentication attempts...
FortiADC - SQL injection vulnerability in configuration backup feature
An improper neutralization of special elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 in FortiADC may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests...
FortiSOAR - Server-Side Template Injection in Playbook component
An improper neutralization of special elements used in a template engine vulnerability CWE-1336 in FortiSOAR management interface may allow a remote and authenticated attacker to execute arbitrary code via a crafted payload...
FortiWeb - Unauthorized user is granted access to the Reports available in the Log & Report section
An improper access control vulnerability CWE-284 in the Report Browse section of FortiWeb's Log & Report may allow an unauthorized and unauthenticated user to access the Log reports via their URLs...
Insufficient validation logic in Fortisandbox sniffer's max file size
An improper input validation vulnerability in the sniffer interface of FortiSandbox may allow an authenticated attacker to silently halt the sniffer via specifically crafted requests...
FortiManager- Improper access control in SD-WAN Orchestrator
An improper access control vulnerability in FortiManager may allow an authenticated attacker with a restricted user profile to access the SD-WAN Orchestrator panel via directly visiting its URL...
FortiProxy - HTTPD is vulnerable to a Stack-based Buffer Overflow vulnerability
...
Buffer overflow vulnerability in FortiProxy SSL VPN through a crafted POST request
A buffer overflow vulnerability in the SSL VPN portal of FortiProxy may allow an unauthenticated, remote attacker to perform a Denial of Service attack by sending a specifically crafted POST request with a large msg value...
FortiWeb is vulnerable to a Format string vulnerability
A format string vulnerability in FortiWeb may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive data via the redir parameter...
Authentication bypass in FortiMail and FortiVoiceEntreprise
An improper authentication vulnerability in FortiMail and FortiVoiceEntreprise may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user interface...
FortiWLC-SD Privilege escalation vulnerability using copy running-config
The lack of input sanitisation for CLI command 'copy running-config' allows a user with 'admin' or 'superuser' privilege level to gain shell on the FortiWLC-SD with root privilege...
SAM and LSAD remote protocols man in the middle vulnerability (Badlock)
The Security Account Manager Remote Protocol MS-SAMR and the Local Security Authority Domain Policy Remote Protocol MS-LSAD are both vulnerable to man in the middle attacks. These protocols are typically available on all Windows installations as well as every Samba server...