Vulnerabilities > Fortinet > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-02-07 | CVE-2019-16155 | Unspecified vulnerability in Fortinet Forticlient A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to overwrite system files as root with arbitrary content through system backup file via specially crafted "BackupConfig" type IPC client requests to the fctsched process. | 6.6 |
| 2020-02-06 | CVE-2019-17652 | Out-of-bounds Write vulnerability in Fortinet Forticlient A stack buffer overflow vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to cause FortiClient processes running under root priviledge crashes via sending specially crafted "StartAvCustomScan" type IPC client requests to the fctsched process due the argv data not been well sanitized. | 6.8 |
| 2020-02-06 | CVE-2019-16152 | Improper Input Validation vulnerability in Fortinet Forticlient A Denial of service (DoS) vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to cause FortiClient processes running under root privilege crashes via sending specially crafted IPC client requests to the fctsched process due the nanomsg not been correctly validated. | 6.8 |
| 2020-01-23 | CVE-2019-15712 | Unspecified vulnerability in Fortinet Fortimail An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to access web console they should not be authorized for. | 6.5 |
| 2020-01-23 | CVE-2019-15707 | Unspecified vulnerability in Fortinet Fortimail An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow administrators to perform system backup config download they should not be authorized for. | 4.0 |
| 2020-01-07 | CVE-2019-6700 | Insufficiently Protected Credentials vulnerability in Fortinet Fortisiem An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated attacker to retrieve the external authentication password via the HTML source code. | 4.0 |
| 2020-01-07 | CVE-2019-16154 | Cross-site Scripting vulnerability in Fortinet Fortiauthenticator 6.0.0 An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6.0.0 may allow an unauthenticated user to perform a cross-site scripting attack (XSS) via a parameter of the logon page. | 4.3 |
| 2019-11-27 | CVE-2019-15705 | Improper Input Validation vulnerability in Fortinet Fortios An Improper Input Validation vulnerability in the SSL VPN portal of FortiOS versions 6.2.1 and below, and 6.0.6 and below may allow an unauthenticated remote attacker to crash the SSL VPN service by sending a crafted POST request. | 5.0 |
| 2019-11-21 | CVE-2019-6693 | Use of Hard-coded Credentials vulnerability in Fortinet Fortios Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. | 4.0 |
| 2019-11-21 | CVE-2018-9195 | Use of Hard-coded Credentials vulnerability in Fortinet Forticlient and Fortios Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information (URL/SPAM services in FortiOS 5.6, and URL/SPAM/AV services in FortiOS 6.0.; URL rating in FortiClient) sent and received from Fortiguard severs by decrypting these messages. | 4.3 |