898 matches found
CVE-2015-3456 "VENOM" vulnerability
...
Authenticated user null pointer dereference in SSL-VPN
...
Null pointer dereference in sslvpnd proxy endpoint
...
FortiADC - Cross-Site Scripting in Fabric Connectors
An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability CWE-79 in FortiADC may allow an authenticated attacker to perform a cross-site scripting attack via crafted HTTP requests...
FortiManager, FortiAnalyzer, FortiPortal & FortiSwitch - Information disclosure through diagnose debug commands
An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in FortiManager, FortiAnalyzer, FortiPortal & FortiSwitch may allow an attacker which has obtained access to a restricted administrative account to obtain sensitive information via diagnose debug commands...
FortiWeb - Unauthorized Configuration Download Vulnerability
An unauthorized configuration download vulnerability CWE-285 in FortiWeb may allow a local attacker to access confidential configuration files via a crafted http request...
FortiNAC - Unprotected MySQL root account
An empty password in configuration file vulnerability CWE-258 in FortiNAC may allow an authenticated attacker to access the MySQL databases via the CLI...
FortiWeb - Multiple command injection vulnerabilities
Multiple command injection vulnerabilities CWE-78 in the command line interpreter of FortiWeb may allow an authenticated attacker to execute arbitrary commands on the underlying system shell via specially crafted command arguments...
Insufficient validation logic in Fortisandbox sniffer's max file size
An improper input validation vulnerability in the sniffer interface of FortiSandbox may allow an authenticated attacker to silently halt the sniffer via specifically crafted requests...
FortiSandbox - Command injection in web interface
An improper neutralization of special elements used in an OS Command vulnerability in FortiSandbox may allow an authenticated attacker with access to the web GUI to execute unauthorized code or commands via specifically crafted HTTP requests...
FortiPortal - Pervasive SQL injections
Multiple improper neutralization of special elements used in an SQL command vulnerabilities CWE-89 in FortiPortal may allow an attacker with regular user's privileges to execute arbitrary commands on the underlying SQL database via specifically crafted HTTP requests...
FSSO Windows DC Agent [FSSO] Insecure communication between DC agent and Collector
An improper authentication vulnerability CWE-287 in FSSO Collector may allow an unauthenticated user to bypass any firewall authentication rule and access the protected network via sending specifically crafted UDP login notification packets...
FortiSwitch - memory leak issue in lldpmedd daemon
A missing release of memory after effective lifetime vulnerability in FortiSwitch may allow an attacker on an adjacent network to exhaust available memory by sending specifically crafted LLDP/CDP/EDP packets to the device...
FortiAP system command injection through ifconfig command
A system command injection vulnerability in the FortiAP CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted ifconfig commands...
Protect
An Improper Input Validation vulnerability in the SSL VPN portal of FortiOS and FortiProxy may allow an unauthenticated remote attacker to crash the SSL VPN service by sending a crafted POST request...
OpenSSL vulnerabilities - June 2015
...
Uncontrolled Resource Consumption in SNMP
...
Lack of certificate verification when establishing secure connections
...
FortiWeb and FortiRecorder - Arbitrary file read through command line pipe
An incomplete filtering of one or more instances of special elements vulnerability CWE-792 in the command line interpreter of FortiRecorder and FortiWeb may allow an authenticated user to read arbitrary files via specially crafted command arguments...
FortiWeb - format string vulnerability in the CLI
A format string vulnerability CWE-134 in the command line interpreter of FortiWeb may allow an authenticated user to execute unauthorized code or commands via specially crafted command arguments...
Read-Only users able to add/modify the Interface fields using the API
...
Protect
An integer overflow / wraparound vulnerability CWE-190 in the FortiOS, FortiProxy, FortiSwitch, FortiRecoder, and FortiVoiceEnterprise dhcpd daemon may allow an unauthenticated and network adjacent attacker to crash the dhcpd deamon, resulting in potential denial of service...
FortiAP-C - Command injection in CLI
An improper neutralization of special elements used in an OS Command vulnerability CWE-78 in FortiAP-C console may allow an authenticated attacker to execute unauthorized commands by running CLI commands with specifically crafted arguments...
FortiWeb - Unauthorized user is granted access to the Reports available in the Log & Report section
An improper access control vulnerability CWE-284 in the Report Browse section of FortiWeb's Log & Report may allow an unauthorized and unauthenticated user to access the Log reports via their URLs...
Protect
A cleartext storage in a file or on disk CWE-313 vulnerability in FortiOS SSL VPN may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on the targeted device's system...
FortiMail - OS Command injection
An improper neutralization of special elementsused in an OS Command vulnerability CWE-78 in FortiMail's administrative interface may allow an authenticated attacker to execute unauthorized commands via specifically crafted HTTP requests...
Buffer overflow vulnerability in FortiProxy SSL VPN through a crafted POST request
A buffer overflow vulnerability in the SSL VPN portal of FortiProxy may allow an unauthenticated, remote attacker to perform a Denial of Service attack by sending a specifically crafted POST request with a large msg value...
FortiClient Use of Hard-coded Cryptographic Key
Use of a hard-coded cryptographic key to encrypt security sensitive data in configuration in FortiClient for Windows may allow an attacker with access to the configuration or the backup file to decrypt the sensitive data via knowledge of the hard-coded key...
FortiOS SSL Deep Inspection TLS Padding Oracle Vulnerabilities
Multiple padding Oracle vulnerabilities Zombie POODLE, GOLDENDOODLE, OpenSSL 0-length in the CBC padding implementation of FortiOS when configured with SSL Deep Inspection policies and with the IPS sensor enabled may allow an attacker to decipher TLS connections going through the FortiGate by...
Protect
Failure to sanitize the error or message handling parameters in the SSL VPN web portal may allow an attacker to perform a Cross-site Scripting XSS attack...
FortiSIEM external authentication password reflected in external authentication profile
An information exposure vulnerability in the external authentication profile form of FortiSIEM may allow an authenticated attacker to retrieve the external authentication password via the HTML source code.This could potentially aggravate attacks targeting the authenticated admin session, should...
Multiple Vulnerabilities in OpenSSL
...
FortiWAN - Command injection vulnerability
An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the management interface of FortiWAN may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...
FortiWeb - Multiple Stack based buffer overflow in web interface
Multiple buffer overflow CWE-121 vulnerabilities in the web server of FortiWeb may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted HTTP requests...
FortiClientEMS - Sensitive information leak
A missing encryption of sensitive data vulnerability CWE-311 in FortiClientEMS may allow an authenticated attacker to view sensitive information in clear text via any browser development tools...
FortiClientWindows & FortiClient EMS - Privilege escalation via DLL Hijacking
An unsafe search path vulnerability in FortiClient and FortiClient EMS may allow an attacker to perform a DLL Hijack attack on affected devices via a malicious OpenSSL engine library in the search path...
FortiWLM - Command injection in script handlers
An improper neutralization of special elements used in an OS command vulnerability 'OS Command Injection' CWE-78 in FortiWLM may allow an authenticated attacker to execute unauthorized code or commands via crafted HTTP requests to various controllers...
FortiAnalyzer - XSS vulnerability observed in the Column settings of LogView
An improper neutralization of input vulnerability CWE-79 in FortiAnalyzer may allow a remote authenticated attacker to perform a stored cross site scripting attack XSS via the column settings of Logview in FortiAnalyzer, should the attacker be able to obtain that POST request, via other,...
FortiManager and FortiAnalyzer - Multiple reflected XSS
Multiple improper neutralization of input during web page generation CWE-79 in FortiManager and FortiAnalyzer user interface may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack XSS by injecting malicious payload in GET parameters...
FortiMail - Unauthenticated encryption in IBE leads to email plaintext recovery
A missing cryptographic step in FortiMail IBE may allow an unauthenticated attacker who intercepts the encrypted messages to manipulate them in such a way that makes the tampering and the recovery of the plaintexts possible...
Authentication bypass in FortiWAN
A relative path traversal vulnerability CWE-23 in FortiWAN may allow a remote non-authenticated attacker to delete files on the system by sending a crafted POST request. In particular, deleting specific configuration files will reset the Admin password to its default value...
FortiWeb is vulnerable to a Format string vulnerability
A format string vulnerability in FortiWeb may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive data via the redir parameter...
XSS vulnerability in FortiAuthenticator OWA Agent
FortiAuthenticator Agent for Outlook Web Access v1.5 and below...
FortiWAN Multiple Vulnerabilities
FortWan 4.2.4 and below is exposed to cross site scripting, information leak and escalation of privilege vulnerabilities. CVE-2016-4965: Non-administrative authenticated user having access privileges to the nslookup functionality can perform OS command injection in the root user context...
FortiWeb - Double free in pipe management
A double free vulnerability CWE-415 in FortiWeb CLI may allow an authenticated, local attacker to achieve arbitrary code execution via specifically crafted commands...
FortiADC - Persistent XSS in Log pages
An improper neutralization of input during web page generation vulnerability CWE-79 in FortiADC may allow a remote unauthenticated attacker to perform a stored cross site scripting XSS attack via HTTP fields observed in the traffic and event logviews...
FortiWLC - Access of Uninitialized Pointer vulnerability
An access of uninitialized pointer CWE-824 vulnerability in FortiWLC may allow a local and authenticated attacker to crash the access point being managed by the controller by executing a crafted CLI command...
FortiAnalyzer - XSS vulnerability
An improper neutralization of input during web page generation CWE-79 in FortiAnalyzer may allow an attacker to perform a stored Cross Site Scripting XSS attack via specifically crafted requests to the web GUI...
FortiMail - SQL Injection vulnerabilities
Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail may allow a non-authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests...