fortinet Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/fortinet/ Sun, 26 Feb 2023 09:11:53 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png fortinet Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/fortinet/ 32 32 CVE-2008-7161 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-7161/ Sun, 26 Feb 2023 09:11:53 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-7161/ Fortinet FortiGuard Fortinet FortiGate-1000 3.00 build 040075,070111 allows remote attackers to bypass URL filtering via fragmented GET or POST requests that use HTTP/1.0 without the Host header. NOTE: this issue might be related to CVE-2005-3058.

The post CVE-2008-7161 appeared first on CVE Vulnerability.

]]> Fortinet FortiGuard Fortinet FortiGate-1000 3.00 build 040075,070111 allows remote attackers to bypass URL filtering via fragmented GET or POST requests that use HTTP/1.0 without the Host header. NOTE: this issue might be related to CVE-2005-3058.

The post CVE-2008-7161 appeared first on CVE Vulnerability.

]]> CVE-2019-6698 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-6698/ Sun, 26 Feb 2023 06:34:02 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-6698/ Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated attacker with knowledge of the aforementioned credentials and network access to FortiCameras to take control of those, provided they are managed by a FortiRecorder device.

The post CVE-2019-6698 appeared first on CVE Vulnerability.

]]> Use of Hard-coded Credentials vulnerability in FortiRecorder all versions below 2.7.4 may allow an unauthenticated attacker with knowledge of the aforementioned credentials and network access to FortiCameras to take control of those, provided they are managed by a FortiRecorder device.

The post CVE-2019-6698 appeared first on CVE Vulnerability.

]]> CVE-2019-17657 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-17657/ Sun, 26 Feb 2023 06:31:39 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-17657/ An Uncontrolled Resource Consumption vulnerability in Fortinet FortiSwitch below 3.6.11, 6.0.6 and 6.2.2, FortiAnalyzer below 6.2.3, FortiManager below 6.2.3 and FortiAP-S/W2 below 6.2.2 may allow an attacker to cause admin webUI denial of service (DoS) via handling special crafted HTTP requests/responses in pieces slowly, as demonstrated by Slow HTTP DoS Attacks.

The post CVE-2019-17657 appeared first on CVE Vulnerability.

]]> An Uncontrolled Resource Consumption vulnerability in Fortinet FortiSwitch below 3.6.11, 6.0.6 and 6.2.2, FortiAnalyzer below 6.2.3, FortiManager below 6.2.3 and FortiAP-S/W2 below 6.2.2 may allow an attacker to cause admin webUI denial of service (DoS) via handling special crafted HTTP requests/responses in pieces slowly, as demonstrated by Slow HTTP DoS Attacks.

The post CVE-2019-17657 appeared first on CVE Vulnerability.

]]> CVE-2019-15709 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-15709/ Sun, 26 Feb 2023 06:31:02 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-15709/ An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators to overwrite system files via specially crafted tcpdump commands in the CLI.

The post CVE-2019-15709 appeared first on CVE Vulnerability.

]]> An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators to overwrite system files via specially crafted tcpdump commands in the CLI.

The post CVE-2019-15709 appeared first on CVE Vulnerability.

]]> CVE-2019-15708 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-15708/ Sun, 26 Feb 2023 06:31:02 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-15708/ A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted ifconfig commands.

The post CVE-2019-15708 appeared first on CVE Vulnerability.

]]> A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted ifconfig commands.

The post CVE-2019-15708 appeared first on CVE Vulnerability.

]]> CVE-2019-13402 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-13402/ Sun, 26 Feb 2023 06:30:14 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-13402/ /usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor can persist because neither system accounts nor the set of services is reset.

The post CVE-2019-13402 appeared first on CVE Vulnerability.

]]> /usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices implement an incomplete factory-reset process. A backdoor can persist because neither system accounts nor the set of services is reset.

The post CVE-2019-13402 appeared first on CVE Vulnerability.

]]> CVE-2019-13401 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-13401/ Sun, 26 Feb 2023 06:30:14 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-13401/ Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/.

The post CVE-2019-13401 appeared first on CVE Vulnerability.

]]> Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/.

The post CVE-2019-13401 appeared first on CVE Vulnerability.

]]> CVE-2019-13400 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-13400/ Sun, 26 Feb 2023 06:30:14 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-13400/ Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via cgi-bin/getuserinfo.cgi?mode=info.

The post CVE-2019-13400 appeared first on CVE Vulnerability.

]]> Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext. These credentials can be retrieved via cgi-bin/getuserinfo.cgi?mode=info.

The post CVE-2019-13400 appeared first on CVE Vulnerability.

]]> CVE-2019-13399 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-13399/ Sun, 26 Feb 2023 06:30:14 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-13399/ Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator’s SSL conversation.

The post CVE-2019-13399 appeared first on CVE Vulnerability.

]]> Dynacolor FCM-MB40 v1.2.0.0 devices have a hard-coded SSL/TLS key that is used during an administrator’s SSL conversation.

The post CVE-2019-13399 appeared first on CVE Vulnerability.

]]> CVE-2019-13398 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-13398/ Sun, 26 Feb 2023 06:30:14 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-13398/ Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrl_save_profile.cgi (save parameter) and cgi-bin/ddns.cgi.

The post CVE-2019-13398 appeared first on CVE Vulnerability.

]]> Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrl_save_profile.cgi (save parameter) and cgi-bin/ddns.cgi.

The post CVE-2019-13398 appeared first on CVE Vulnerability.

]]>