898 matches found
Stored XSS in guest management page
...
FortiAP's - Arbitrary file read through the CLI
...
Improper privilege management on API requests
...
Buffer overflow in execute extender command
...
Path Traversal vulnerability
...
Proxy mode with deep inspection - Stack-based buffer overflow
...
Path traversal in history downloadzip
...
Existing websocket connection persists after deleting API admin
...
FortiNAC - argument injection in XML interface on port tcp/5555
An improper neutralization of special elements used in a command 'command injection' vulnerability CWE-77 in FortiNAC tcp/5555 service may allow an unauthenticated attacker to copy local files of the device to other local directories of the device via specially crafted input fields. To access the...
FortiNAC - java untrusted object deserialization RCE
A deserialization of untrusted data vulnerability CWE-502 in FortiNAC may allow an unauthenticated user to execute unauthorized code or commands via specifically crafted requests to the tcp/1050 service...
Authenticated user null pointer dereference in SSL-VPN
...
Null pointer dereference in sslvnd
...
Out-of-bound write in CLI
...
FortiSIEM - Bruteforce of Exposed Endpoints
An improper restriction of excessive authentication attempts CWE-307 in FortiSIEM may allow a unauthenticated user with access to several endpoints to perform a brute force attack on these endpoints...
Read Only administrator can intercept sensitive data
...
FortiClient (Windows) / FortiConverter (Windows) - Insecure Installation Folder
An incorrect default permissions CWE-276 vulnerability in FortiClient Windows and FortiConverter Windows may allow a local authenticated attacker to tamper with files in the installation folder, if FortiClient or FortiConvreter is installed in an insecure folder...
FortiNAC - SSL Renegotation leading to DoS
An improper permissions, privileges, and access controls vulnerability CWE-264 in FortiNAC may allow an unauthenticated attacker to perform a DoS attack on the device via client-secure renegotiation...
Format String Bug in Fclicense daemon
...
Lack of certificate verification when establishing secure connections
...
FortiNAC - Improper access control on administrative panels
An access control vulnerability CWE-284 in FortiNAC may allow a remote attacker authenticated on the administrative interface to perform unauthorized jsp calls via crafted HTTP requests...
Null pointer dereference in sslvpnd proxy endpoint
...
FortiSIEM - Use of a Broken or Risky Cryptographic Algorithm
A use of a broken or risky cryptographic algorithm CWE-327 in FortiSIEM may allow a remote unauthenticated attacker to perform brute force attacks on GUI endpoints via taking advantage of outdated hashing methods...
Format String Bug in fortiguard-resources CLI command
...
DoS in firmware upgrade function
...
Access of uninitialized pointer in administrative interface API
...
SSRF in FortiGuard Outbreak feature
...
SMTP password ciphertext exposure in Log
...
Heap buffer overflow in sslvpn pre-authentication
...
FortiADC & FortiADC Manager - Command injection vulnerabilities in cli commands
Multiple improper neutralization of special elements used in an os command 'OS Command Injection' vulnerabilties CWE-78 in FortiADC & FortiADC Manager may allow a local authenticated attacker to execute arbitrary shell code as root user via crafted CLI requests...
Path traversal vulnerability in administrative interface
...
FortiSIEM - Plaintext credentials storage in DB
A plaintext storage of a password vulnerability CWE-256 in FortiSIEM may allow an attacker able to access user DB content to impersonate any admin user on the device GUI...
FortiADC - Command injection in diagnose system df CLI command
An improper neutralization of special elements used in an OS command vulnerability CWE-78 in FortiADC CLI may allow a local and authenticated attacker to execute unauthorized commands via specifically crafted arguments in diagnose system df CLI command...
Out-of-bound-write in sslvpnd
...
FortiADC - Command injection in external resource module
An improper neutralization of special elements used in an OS command vulnerability CWE-78 in FortiADC may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...
FortiNAC - Stored XSS triggering RCE via license key forgery
An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability CWE-79 in FortiNAC License Management would permit an authenticated attacker to trigger remote code execution via crafted licenses...
FortiNAC - Weak password hashing method in /etc/shadow
An insufficiently protected credentials vulnerability CWE-522 in FortiNAC may allow a local attacker with system access to retrieve users' passwords...
FortiNAC - open redirect in defaultUrl parameter
A URL redirection to untrusted site 'Open Redirect' vulnerability CWE-601 in FortiNAC may allow an unauthenticated attacker to redirect users to any arbitrary website via a crafted URL...
FortiADC - Path traversal vulnerability in CLI
A relative path traversal vulnerability CWE-23 in FortiADC may allow a privileged attacker to delete arbitrary directories from the underlying file system via crafted CLI commands...
FortiNAC - Weak authentication mechanism on device registration page
A weak authentication vulnerability CWE-1390 in FortiNAC device registration page may allow an unauthenticated attacker to perform password spraying attacks with an increased chance of success...
FortiNAC - database harcoded credentials
A use of hard-coded credentials vulnerability CWE-798 in FortiNAC may allow an authenticated attacker to access to the database via shell commands...
FortiNAC - SSH Weak Key Exchange Algorithm
A use of a weak cryptographic algorithm vulnerability CWE-327 in FortiNAC may increase the chances of an attacker to have access to sensitive information or to perform man-in-the-middle attacks...
FortiPresence - Unpassworded remotely accessible Redis & MongoDB
A missing authentication for critical function vulnerability CWE-306 in FortiPresence on-prem infrastructure server may allow a remote, unauthenticated attacker to access the Redis and MongoDB instances via crafted authentication requests...
FortiADC & FortiDDoS & FortiDDoS-F - Command injection in log & report module
An improper neutralization of special elements used in an OS command vulnerability CWE-78 in FortiADC, FortiDDoS and FortiDDoS-F may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...
FortiNAC - Report disclosure to unauthenticated users
An exposure of sensitive information to an unauthorized actor vulnerability CWE-200 in FortiNAC may allow an unauthenticated attacker to access sensitive information via crafted HTTP requests...
Cross Site Scripting vulnerabilities in administrative interface
...
FortiSandbox / FortiDeceptor - Improper profile-based access control over APIs
An improper privilege management vulnerability CWE-269 in FortiSandbox & FortiDeceptor may allow a remote authenticated attacker to perform unauthorized API calls via crafted HTTP or HTTPS requests...
FortiClient (Windows) - Improper write access over FortiClient pipe object
Multiple vulnerabilities including an incorrect permission assignment for critical resource CWE-732 vulnerability and a time-of-check time-of-use TOCTOU race condition CWE-367 vulnerability in FortiClientWindows may allow an attacker on the same file sharing network to execute commands via writin...
Open redirect in sslvpnd
...
Policy-based NGFW SSL VPN mode doesn't filter accesses via Bookmarks
...
FortiWeb & FortiADC - OS command injection in CLI
An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the command line interpreter of FortiWeb & FortiADC may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...