FortiWeb - Stack based buffer overflow in SAML management

A stack-based buffer overflow vulnerability CWE-121 in FortiWeb SAML server configuration may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted XML files...

FortiNAC - Multiple Command Injections in webserver

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the webserver of FortiNAC may allow a privileged attacker to execute arbitrary OS commands via specially crafted input parameters...

FortiClient (MAC) - FortiTray stores the SSLVPN password in cleartext

An exposure of sensitive information to an unauthorized actor vulnerabiltiy CWE-200 in FortiClient for Mac may allow a local authenticated attacker to obtain the SSL-VPN password in cleartext via running a logstream for the FortiTray process in the terminal...

FortiClientEMS - Sensitive information leak

A missing encryption of sensitive data vulnerability CWE-311 in FortiClientEMS may allow an authenticated attacker to view sensitive information in clear text via any browser development tools...

FortiClientWindows & FortiClient EMS - Privilege escalation via DLL Hijacking

An unsafe search path vulnerability in FortiClient and FortiClient EMS may allow an attacker to perform a DLL Hijack attack on affected devices via a malicious OpenSSL engine library in the search path...

Protect

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiOS may allow a remote unauthenticated attacker to either redirect users to malicious websites via a crafted "Host" header or to execute JavaScript code in the victim's browser context...

LibGD security advisory [18 January 2017]

The LibGD project released advisories on January 18th, 2017, July 22nd, 2016 and June 25th, 2016 describing 12 vulnerabilities, as listed below:...

FortiManager and FortiAnalyzer Persistent XSS vulnerability

An XSS vulnerablity in FortiManager/FortiAnalyzer could allow privileged guest user accounts and restricted user accounts to inject malicious script to the application-side or client-side of the appliance web-application; this potentially enables XSS attacks...

HTML injection in SAML and Security Fabric components

...

FortiSOAR - Improper Authorization in request headers

An improper access control vulnerability CWE-284 in FortiSOAR's playbook component may allow an attacker authenticated on the administrative interface to perform unauthorized actions via crafted HTTP requests...

FortiPortal - XSS observed on policy column settings

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiPortal management interface may allow a remote authenticated attacker to perform a stored cross site scripting XSS attack via sending request with specially crafted columnindex parameter...

FortiDeceptor - Reflected XSS vulnerability on Lure Resources page

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiDeceptor management interface may allow an authenticated user to perform a cross site scripting XSS attack via sending requests with specially crafted lure resource ID...

FortiWeb - OS command injection due to direct input interpolation in API controllers

An improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability CWE-78 in FortiWeb may allow an authenticated attacker to execute arbitrary code or commands via crafted HTTP requests to ApplicationDelivery, JsonProtection and WebProtection controllers...

FortiClient EMS - SAML SSO replay attack

An authentication bypass by capture-replay vulnerability CWE-294 in FortiClient EMS may allow an unauthenticated attacker to impersonate an existing user by intercepting and re-using valid SAML authentication messages...

FortiWeb - OS command injection

Multiple improper neutralization of special elements used in a command vulnerabilities CWE-77 in FortiWeb management interface may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests...

FortiWeb - Multiple stack-based buffer overflow vulnerabilities in CLI command

Multiple stack-based buffer overflow vulnerabilities in FortiWeb CLI interface may allow an authenticated attacker to execute unauthorized code or commands via config backup arguments...

FortiManager & FortiAnalyzer - Improper access control on the administrators account list

An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface may allow a remote and authenticated attacker with restricted user profile to retrieve the list of administrative users of other ADOMs and their related configuration...

Uncontrolled Resource Consumption (Unauthenticated Denial of Service) in login module

An uncontrolled resource consumption denial of service vulnerability in FortiSandbox and FortiAuthenticator login modules may allow an unauthenticated attacker to bring the device into an unresponsive state via specifically-crafted long request parameters...

Cross-site scripting (XSS) vulnerability via DHCP Hostname parameter

An attacker could send DHCP request containing malicious scripts in the HOSTNAME parameter. The malicious script code is executed while viewing the logs in FortiAnalyzer and FortiManager with FortiAnalyzer feature enabled...

FortiManager XSS vulnerability when view config under Revision History

A potential Cross-site Scripting XSS vulnerability exists in FortiManager: Displayed data is not sanitized when an administrator views the managed devices configuration, in the installation revision history of the GUI...

OpenRedirect in Malicious Generated PDF Document on FortiAnalyzer and FortiManager

An open redirect vulnerability exists in FortiAnalyzer and FortiManager when a user of the GUI is converting an HTML table to a PDF document via the FortiView feature, due to lack of user input sanitization...

HTTP Host header attacks against web proxy disclaimer response webpage

The FortiOS web proxy disclaimer page is potentially vulnerable to an XSS attack, via maliciously crafted "Host" headers in user HTTP requests. The latter is possible if an attacker is in a Man-in-the-middle position i.e. able to modify the HTTP requests of the potential victim before they reach...

FortiWAN Multiple Vulnerabilities

FortWan 4.2.4 and below is exposed to cross site scripting, information leak and escalation of privilege vulnerabilities. CVE-2016-4965: Non-administrative authenticated user having access privileges to the nslookup functionality can perform OS command injection in the root user context...

FortiOS supports weak ciphers suites when connecting to Fortiguard servers

...

Lack of client-side certificate validation when establishing secure connections with FortiGuard to download outbreakalert

...

FortiAuthenticator, FortiDeceptor & FortiMail - Improper restriction over excessive authentication attempts

An improper restriction of excessive authentication attempts vulnerability CWE-307 in FortiAuthenticator, FortiDeceptor & FortiMail may allow a remote unauthenticated attacker to partially exhaust CPU and memory via sending numerous HTTP requests to the login form...

FortiNAC - Weak password storage

An insufficiently protected credentials vulnerability CWE-522 in FortiNAC may allow an attacker with access to the database to perform attacks to recover the passwords...

Improper password storage mechanism

...

FortiADC - Stored XSS vulnerability in external resource page

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiADC management interface may allow a remote and authenticated attacker to trigger a stored cross site scripting XSS attack via configuring a specially crafted IP Address...

FortiTester - Unauthenticated command injection

Multiple improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerabilities CWE-78 in Console, Telnet, and SSH login components of FortiTester may allow an unauthenticated remote attacker to execute arbitrary command in the underlying shell...

FortiWLM - Path traversal vulnerability

Multiple relative path traversal vulnerabilities CWE-23 in FortiWLM management interface may allow an authenticated attacker to retrieve arbitrary files from the underlying filesystem via specially crafted web requests...

FortiNAC - improper permissions set for tomcat users configuration file

An incorrect permission assignment for a critical resource vulnerability CWE-732 in FortiNAC may allow an authenticated attacker to access sensitive system data and, as a consequence, raise the authenticated user's privilege to admin...

FortiWLM - SQL Injection in script handlers

An improper neutralization of special elements CWE-79 used in an SQL command vulnerability 'SQL Injection' CWE-89 in FortiWLM may allow an authenticated attacker to disclose sensitive information via crafted HTTP requests to various controllers...

FortiManager - Excel formula injection in P&O IPv4 Policy names Vulnerability

An improper neutralization of formula elements vulnerability CWE 1236 in FortiManager may allow a local authenticated privileged attacker to execute arbitrary shell code on the end-user's host via inserting CSV formula in the policy names. This is achieved once the user downloads and opens the...

FortiManager - Access Control missing in P&O module assignment vulnerability

An improper authentication vulnerability CWE-287 in FortiManager may allow a standard user to assign or un-assign a global policy package via a POST request to flatui/json module...

FortiPortal - Path traversal in controller

A protection mechanism failure vulnerability CWE-693 resulting in improperly limiting pathname to a restricted directory in FortiPortal may allow an authenticated attacker to perform a path traversal attack via maliciously crafted GET parameters...

FortiManager and FortiAnalyzer - Buffer overflow vulnerability through the diagnose system geoip-city command

A buffer overflow vulnerability in FortiAnalyzer and FortiManager CLI may allow an authenticated, local attacker to perform a Denial of Service attack by running the diagnose system geoip-city command with a large ip value. Fortinet is not aware of any successful exploitation of this vulnerabilit...

Session ID does not expire after logout in FortiDeceptor

An insufficient session expiration vulnerability in FortiDeceptor may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks...

FortiMail admin privilege escalation through improper user profile control

Two improper access control vulnerabilities in FortiMail admin webUI may allow administrators to perform privileged functions they should not be authorized for...

Application control block page leaks private IP and hostname

The default replacement message in FortiOS' Application control block page reveals the private IP as well as the hostname of the FortiGate...

FortiClient privilege escalation vulnerability

A low privileged user may be able to execute arbitrary code by exploiting a FortiClientNamedPipe vulnerability...

FortiOS flow-mode detection bypass under certain conditions

A FortiGate configured to use flow-based protection will stop monitoring network sessions that are active when a scanning engine is reloaded after an update nearly instantaneous process. This tends to impact long lived network sessions, with chances to be alive during and after an update, such a...

FortiClient Android and iOS multiple vulnerabilities

...

FortiAnalyzer Cross Site Request Forgery Vulnerability

...

Potential Web Vulnerabilities in FortiMail

...

FortiADC & FortiDDoS & FortiDDoS-F - Command injection in log & report module

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in FortiADC, FortiDDoS and FortiDDoS-F may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...

FortiWeb - Confused deputy issue on SERVER_NAME causes open proxy flaw

An unintended proxy or intermediary 'Confused Deputy' CWE-441 in FortiWeb may allow an authenticated attacker to use the device as proxy to reach any protected host via crafted HTTP requests...

Protect

A download of code without integrity check vulnerability CWE-494 in the "execute restore src-vis" command of FortiOS may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages...

FortiPortal - XSS vulnerability

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiPortal GUI may allow a remote and unauthenticated attacker to perform an XSS attack via sending a crafted request with an invalid lang parameter or with an invalid...

FortiMail - Memory leak in Webmail

A missing release of memory after its effective lifetime vulnerability CWE-401 in FortiMail Webmail may allow an unauthenticated remote attacker to exhaust available memory via specifically crafted login requests...