898 matches found
Protect
Failure to sanitize input in the SSL VPN web portal may allow a remote unauthenticated attacker to perform a reflected Cross-site Scripting XSS attack by sending a request to the error page with malicious GET parameters...
FortiSwitch - memory leak issue in lldpmedd daemon
A missing release of memory after effective lifetime vulnerability in FortiSwitch may allow an attacker on an adjacent network to exhaust available memory by sending specifically crafted LLDP/CDP/EDP packets to the device...
FortiClient Use of Hard-coded Cryptographic Key
Use of a hard-coded cryptographic key to encrypt security sensitive data in configuration in FortiClient for Windows may allow an attacker with access to the configuration or the backup file to decrypt the sensitive data via knowledge of the hard-coded key...
Protect
Multiple vulnerabilities, referred to as Dragonblood, exist in WiFi WPA3 standard implementation...
Command injection vulnerability in FortiClient for Mac OS
An Improper Neutralization of Special Elements used in a Command vulnerability in one of FortiClient for Mac OS root processes, may allow a local user of the system on which FortiClient is running to execute unauthorized code as root by bypassing a security check...
Serial number disclosure in the FortiOS PPTP server hostname protocol field
Fortigate PPTP service reveals serial number of FortiGate in the hostname field defined in connection control setup packets of PPTP protocol...
Stored XSS under CA and CRL certificate view page
Javascript code and HTML tags can be injected into the CN value of CA and CRL certificates via the import CA and CRL certificates feature of the GUI. The injected code may be executed when the GUI administrator views the CA certificate details and browses CRL certificates when CN values are...
Apache Tomcat vulnerabilities
Multiple Remote Code Execution RCE vulnerabilities CVE-2017-12615, CVE-2017-12617 are affecting Apache Tomcat...
FortiMail reflected XSS vulnerability under customized webmail login page
There exists a reflected cross-site scripting XSS vulnerability on FortiMail customized pre-authentication webmail login page, allowing successful attackers to run arbitrary javascript code in the security context of their victim's browser...
FortiOS XSS vulnerabilities via FortiView Application filter, FortiToken activation & SSL VPN Replacement Messages
Three XSS vulnerabilities...
OpenSSL vulnerabilities - March 2015
...
FortiADC - Command injection in diagnose system df CLI command
An improper neutralization of special elements used in an OS command vulnerability CWE-78 in FortiADC CLI may allow a local and authenticated attacker to execute unauthorized commands via specifically crafted arguments in diagnose system df CLI command...
FortiNAC - Improper access control on administrative panels
An access control vulnerability CWE-284 in FortiNAC may allow a remote attacker authenticated on the administrative interface to perform unauthorized jsp calls via crafted HTTP requests...
FortiNAC - database harcoded credentials
A use of hard-coded credentials vulnerability CWE-798 in FortiNAC may allow an authenticated attacker to access to the database via shell commands...
FortiWeb - Multiple OS command injection
Multiple improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerabilities CWE-78 in FortiWeb may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests...
FortiNAC - Multiple Stored and Reflected XSS
Several improper neutralization of inputs during web page generation vulnerability CWE-79 in FortiNAC may allow an authenticated attacker to perform several XSS attacks via crafted HTTP GET requests...
FortiMail - Inter-domain information leakage
An improper access control vulnerability CWE-284 in FortiMail may allow an authenticated admin user assigned to a specific domain to access and modify other domains information via insecure direct object references IDOR...
FortiTester - Command injection in CLI command
An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the command line interpreter of FortiTester may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...
FortiSOAR - Path traversal vulnerabilities in the web API
Multiple relative path traversal vulnerabilities CWE-23 in the web API of FortiSOAR may allow an authenticated attacker to write in the underlying filesystem with nginx permissions via crafted HTTP requests...
FortiTokenMobile - Missing digital certificate validation
An improper validation of certificate with host mismatch vulnerability CWE-297 in FortiTokenMobile may allow an unauthenticated user to spoof the validation server identity and achieve a Man-in-the-Middle attack...
FortiEDR - Hardcoded AES key enable disabling local Collector
A use of hard-coded cryptographic key vulnerability CWE-321 in the registration mechanism of FortiEDR collectors may allow a local attacker to disable and uninstall the collectors from the end-points within the same deployment...
FortiSIEM - plaintext storage of sensitive data in Windows Agent
A plaintext storage of a password vulnerability CWE-256 in the FortiSIEM Windows Agent may allow an authenticated user to impersonate the agent registered to the Supervisor via reading specific log files...
FortiAnalyzer - XSS vulnerability observed in the Column settings of LogView
An improper neutralization of input vulnerability CWE-79 in FortiAnalyzer may allow a remote authenticated attacker to perform a stored cross site scripting attack XSS via the column settings of Logview in FortiAnalyzer, should the attacker be able to obtain that POST request, via other,...
Authentication bypass in FortiWAN
A relative path traversal vulnerability CWE-23 in FortiWAN may allow a remote non-authenticated attacker to delete files on the system by sending a crafted POST request. In particular, deleting specific configuration files will reset the Admin password to its default value...
XSS vulnerability in FortiManager and FortiAnalyzer
...
Console window of FortiClient for Mac OS displays password in clear-text.
A clear text storage of sensitive information vulnerability in FortiClient for Mac may allow a local attacker to read sensitive information logged in the console window when the user connects to an SSL VPN Gateway...
FortiClient Windows Service or Process Tampering
FortiClient for Windows could be subject to the following shut down or tampering attempts:...
FortiOS stored XSS vulnerability in the policy global-label parameter
FortiOS is subject to a Cross-Site Scripting vulnerability, due to an improperly sanitized parameter in a hidden CLI configuration setting named 'global-label' . This can however only be exploited by an administrator with write privileges...
DHCP Hostname HTML Injection
...
FortiBalancer Remote SSH Vulnerability
...
Log-fetch client request password is shown in clear text in the heartbeat response
...
FortiNAC - Multiple XML external entity (XXE) injection
An improper restriction of XML external entity reference vulnerability CWE-611 in the parser of XML requests of FortiNAC may allow an unauthenticated attacker to trigger a denial of service or read arbitrary files from the underlying file system via specifically crafted XML documents...
Read-Only users able to add/modify the Interface fields using the API
...
FortiTester - Authenticated command injection in certificate import feature
An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the management interface of FortiTester may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to commands of the certificate import feature...
FortiEDR - Cross Site Scripting (XSS) vulnerabilities over the Management Console
An improper neutralization of input during web page generation vulnerability CWE-79 in FortiEDR Central Manager may allow a remote authenticated attacker to perform a reflected cross site scripting attack XSS via injecting a malicious payload into the Management Console through various endpoints...
FortiWLC - Access of Uninitialized Pointer vulnerability
An access of uninitialized pointer CWE-824 vulnerability in FortiWLC may allow a local and authenticated attacker to crash the access point being managed by the controller by executing a crafted CLI command...
Protect
An integer overflow or wraparound vulnerability CWE-190 in FortiOS SSLVPN memory allocator may allow an unauthenticated attacker to corrupt control data on the heap via specifically crafted requests to SSLVPN, resulting in potentially arbitrary code execution...
FortiWeb - OS command injection
Multiple improper neutralization of special elements used in a command vulnerabilities CWE-77 in FortiWeb management interface may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests...
FortiAnalyzer - XSS vulnerability
An improper neutralization of input during web page generation CWE-79 in FortiAnalyzer may allow an attacker to perform a stored Cross Site Scripting XSS attack via specifically crafted requests to the web GUI...
FortiPortal - Denial of service vulnerabilities
Multiple uncontrolled resource consumption vulnerabilities CWE-400 in the web interface of FortiPortal may allow a single low-privileged user to induce a denial of service via multiple HTTP requests...
FortiWLM - Command injection in script handlers
An improper neutralization of special elements used in an OS command vulnerability 'OS Command Injection' CWE-78 in FortiWLM may allow an authenticated attacker to execute unauthorized code or commands via crafted HTTP requests to various controllers...
FortiSandbox - Predictable session IDs of JSON API
An instance of small space of random values in FortiSandbox RPC API may allow an attacker in possession of a few information pieces about the state of the device to possibly predict valid session IDs...
FortiMail / FortiNDR / FortiWeb - Path traversal vulnerabilities
Multiple Path traversal vulnerabilities in FortiMail, FortiNDR & FortiWeb may allow a regular user to obtain unauthorized access to files and data via specifically crafted web requests...
FortiProxy - Stack-based Buffer overflow vulnerability through the diagnose sys cpuset CLI command
A stack-based buffer overflow vulnerability in FortiProxy physical appliance CLI may allow an authenticated, remote attacker to perform a Denial of Service attack by running the diagnose sys cpuset with a large cpuset mask value. Fortinet is not aware of any successful exploitation of this...
FortiWeb is vulnerable to a buffer overflow
A stack-based buffer overflow vulnerability in FortiWeb may allow a remote, unauthenticated attacker to crash the httpd daemon thread by sending a request with a crafted cookie header...
FortiManager Cross-Site WebSocket Hijacking (CSWSH)
An Insufficient Verification of Data Authenticity vulnerability in FortiManager may allow an unauthenticated attacker to perform a Cross-Site WebSocket Hijacking CSWSH attack...
TCP SACK panic attack- Linux Kernel Vulnerabilities- CVE-2019-11477, CVE-2019-11478 & CVE-2019-11479
CVE-2019-11477: The Linux kernel is vulnerable to an integer overflow in the 16 bit width of TCPSKBCBskb-tcpgsosegs. A remote attacker could use this to cause a denial of service...
Protect
There is a format string vulnerability in the SSH username handling when connecting to FortiOS 5.6.0, that may lead to memory corruption...
SSL VPN Web Portal user credentials may be leaked to super_admins
An admin user with superadmin privileges i.e. with a superadmin profile may view the current sslvpn web portal session info, using the fnsysctl CLI command. This info includes user credentials...