Fortinet, Inc. vulnerabilities
41 vulnerabilities
Known vulnerabilities in Fortinet, Inc. products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 19 products.
Products
19- Fortios8 vulnerabilities
- Fortinet Fortios7 vulnerabilities
- Fortinet Fortiportal6 vulnerabilities
- Fortinet Fortiweb3 vulnerabilities
- Forticlient For Mac OSX2 vulnerabilities
- Forticlient For Windows2 vulnerabilities
- Forticlient Sslvpn Client For Linux2 vulnerabilities
- Fortinet Fortimanager2 vulnerabilities
- Fortinet Fortimanager, Fortianalyzer2 vulnerabilities
- Fortiwlc2 vulnerabilities
- Fortiauthenticator1 vulnerabilities
- Forticlientwindows1 vulnerabilities
- Fortimanager1 vulnerabilities
- Fortinet Fortianalyzer, Fortimanager1 vulnerabilities
- Fortinet Forticlientwindows1 vulnerabilities
- Fortinet Fortiwlc SD1 vulnerabilities
- Fortinet Fortiwlm1 vulnerabilities
- Fortiweb1 vulnerabilities
- Fortiwebmanager1 vulnerabilities
CVE-2018-13376fortinet, inc.fortinet fortios+1
EPSS score2.12%
An uninitialized memory buffer leak exists in Fortinet FortiOS 5.6.1 to 5.6.3, 5.4.6 to 5.4.7, 5.2 all versions under web proxy's disclaimer response web pages, potentially causing sensitive data to be displayed in the HTTP response.CVE-2018-1351fortinet, inc.fortinet fortimanager+1EPSS score1.19%
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.6 and below versions allows attacker to execute HTML/javascript code via managed remote devices CLI commands by viewing the remote device CLI config installation log.CVE-2018-1355fortinet, inc.fortinet fortimanager, fortianalyzer+2EPSS score1.62%
An open redirect vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows attacker to inject script code during converting a HTML table to a PDF document under the FortiView feature. An attacker may be able to social engineer an authenticated user into generating a PDF file containing injected malicious URLs.CVE-2018-1353fortinet, inc.fortimanager+1EPSS score0.70%
An information disclosure vulnerability in Fortinet FortiManager 6.0.1 and below versions allows a standard user with adom assignment read the interface settings of vdoms unrelated to the assigned adom.CVE-2018-1360fortinet, inc.fortinet fortimanager+1EPSS score0.86%
A cleartext transmission of sensitive information vulnerability in Fortinet FortiManager 5.2.0 through 5.2.7, 5.4.0 and 5.4.1 may allow an unauthenticated attacker in a man in the middle position to retrieve the admin password via intercepting REST API JSON responses.CVE-2018-1354fortinet, inc.fortinet fortimanager, fortianalyzer+2EPSS score1.66%
An improper access control vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows a regular user edit the avatar picture of other users with arbitrary content.CVE-2018-9194fortinet, inc.fortios+1EPSS score1.13%
A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under VIP SSL feature when CPx being used.CVE-2018-9192fortinet, inc.fortios+1EPSS score1.12%
A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under SSL Deep Inspection feature when CPx being used.CVE-2018-9190fortinet, inc.fortinet forticlientwindows+1EPSS score0.43%
A null pointer dereference vulnerability in Fortinet FortiClientWindows 6.0.2 and earlier allows attacker to cause a denial of service via the NDIS miniport driver.CVE-2018-9186fortinet, inc.fortiauthenticator+1EPSS score0.73%
A cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to execute unauthorized script code via inject malicious scripts in HTTP referer header.CVE-2017-14184fortinet, inc.forticlient for mac osx+4EPSS score2.08%
An Information Disclosure vulnerability in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2334 and below versions allows regular users to see each other's VPN authentication credentials due to improperly secured storage locations.CVE-2017-14190fortinet, inc.fortios+1EPSS score1.05%
A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attacker to inject arbitrary web script or HTML via maliciously crafted "Host" header in user HTTP requests.CVE-2017-14191fortinet, inc.fortiweb+1EPSS score0.95%
An Improper Access Control vulnerability in Fortinet FortiWeb 5.6.0 up to but not including 6.1.0 under "Signed Security Mode", allows attacker to bypass the signed user cookie protection by removing the FortiWeb own protection session cookie.CVE-2017-14185fortinet, inc.fortios+1EPSS score1.29%
An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8 and 5.2 all versions allows SSL VPN web portal users to access internal FortiOS configuration information (eg:addresses) via specifically crafted URLs inside the SSL-VPN web portal.CVE-2017-14189fortinet, inc.fortiwebmanager+1EPSS score2.78%
An improper access control vulnerability in Fortinet FortiWebManager 5.8.0 allows anyone that can access the admin webUI to successfully log-in regardless the provided password.CVE-2017-14186fortinet, inc.fortios+1EPSS score3.72%
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote user to inject arbitrary web script or HTML in the context of the victim's browser via the login redir parameter. An URL Redirection attack may also be feasible by injecting an external URL via the affected parameter.CVE-2017-14187fortinet, inc.fortios+1EPSS score0.45%
A local privilege escalation and local code execution vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8, and 5.2 and below versions allows attacker to execute unauthorized binary program contained on an USB drive plugged into a FortiGate via linking the aforementioned binary program to a command that is allowed to be run by the fnsysctl CLI command.CVE-2017-17540fortinet, inc.fortiwlc+1EPSS score1.97%
The presence of a hardcoded account in Fortinet FortiWLC 8.3.3 allows attackers to gain unauthorized read/write access via a remote shell.CVE-2017-17539fortinet, inc.fortiwlc+1EPSS score1.97%
The presence of a hardcoded account in Fortinet FortiWLC 7.0.11 and earlier allows attackers to gain unauthorized read/write access via a remote shell.CVE-2017-17543fortinet, inc.forticlient for mac osx+4EPSS score0.44%
Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2335 and below versions, due to the use of a static encryption key and weak encryption algorithms.