898 matches found
Information Disclosure on SSLVPN endpoint
...
Weak authentication in security fabric daemon
...
SSH key is added even if operation is aborted
...
eap-cert-auth bypass via revoked certificate
...
Privilege escalation in automation-stitch
...
Privilege escalation in GUI websocket module
...
TACACS+ authentication bypass
...
Denial of Service in Security Fabric Root
...
Unauthorized modification of global threat feeds
...
Buffer over-read in FGFM
...
No certificate name verification for fgfm connection
...
Use of uninitialized resource in SSLVPN websocket
...
LDAP Clear-text credentials retrievable with IP modification
...
Log Pollution via login page
...
Unverified password change via set_password endpoint
...
Os command injection on vm download feature
...
error based SQLI on device del feature
...
Incorrect authorization in GUI console
...
Authenticated SQLI on CLI
...
Multiple format string vulnerabilities
...
OS command injection in CLI command
...
Use of hardcoded key used for remote backup server password encryption
...
Pre-authentication Denial of Service attack in OpenSSH - CVE-2025-26466
...
OS Command Injection in administrative interface
...
Client-side enforcement of server-side security related to vm download feature
...
Stack buffer overflow in fabric service
...
Permission escalation due to an Improper Privilege Management
...
Use of Hard-coded Cryptographic Key to encrypt sensitive data
...
OS command injection in external connector
...
Disclosure of Logs of Devices not belonging to the Current ADOM from Log View
...
Insertion of sensitive information into Event log
...
Multiple Reflected and Stored Cross-Site Scripting
...
FortiOS / FortiProxy / FortiPAM / FortiSwitchManager - Format string vulnerability in CLI commands
...
Multiple arbitrary file deletion in the CLI
...
Hardcoded Session Secret Leading to Unauthenticated Remote Code Execution
...
Out-of-bounds Write in IPSEC Daemon
...
Authentication bypass in Node.js websocket module and CSF requests
...
FortiAP - Restricted Shell Escape via CLI Command Injection
...
Exposure of sensitive information in RADIUS Accounting-Request
...
Stack based buffer overflow in httpd
...
`Host` header injection
...
Null pointer dereference leading to sslvpn DOS
...
Multiple privilege escalation
...
IPsec dynamic assignation IP spoofing
...
Unchecked boundary length causing multiple logic flaws
...
Arbitrary file write on GUI
...
SSLVPN DOS
...
Command injection in csfd daemon
...