CVSS: 8.2EPSS: 0%CPEs: 18EXPL: 0CVE-2021-41028
https://notcve.org/view.php?id=CVE-2021-41028
16 Dec 2021 — A combination of a use of hard-coded cryptographic key vulnerability [CWE-321] in FortiClientEMS 7.0.1 and below, 6.4.6 and below and an improper certificate validation vulnerability [CWE-297] in FortiClientWindows, FortiClientLinux and FortiClientMac 7.0.1 and below, 6.4.6 and below may allow an unauthenticated and network adjacent attacker to perform a man-in-the-middle attack between the EMS and the FCT via the telemetry protocol. Una combinación de una vulnerabilidad de clave criptográfica embebida [CWE... • https://fortiguard.com/advisory/FG-IR-21-075 • CWE-295: Improper Certificate Validation CWE-798: Use of Hard-coded Credentials •
CVSS: 4.9EPSS: 0%CPEs: 36EXPL: 0CVE-2021-43204
https://notcve.org/view.php?id=CVE-2021-43204
09 Dec 2021 — A improper control of a resource through its lifetime in Fortinet FortiClientWindows version 6.4.1 and 6.4.0, version 6.2.9 and below, version 6.0.10 and below allows attacker to cause a complete denial of service of its components via changes of directory access permissions. Un control inapropiado de un recurso a lo largo de su vida en Fortinet FortiClientWindows versión 6.4.1 y 6.4.0, versión 6.2.9 y anteriores, versión 6.0.10 y anteriores, permite a un atacante causar una denegación de servicio completa ... • https://fortiguard.com/advisory/FG-IR-21-167 •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2021-32592
https://notcve.org/view.php?id=CVE-2021-32592
01 Dec 2021 — An unsafe search path vulnerability in FortiClientWindows 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x and FortiClientEMS 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x may allow an attacker to perform a DLL Hijack attack on affected devices via a malicious OpenSSL engine library in the search path. Una vulnerabilidad de ruta de búsqueda no segura en FortiClientWindows versiones 7.0.0, 6.4.6 y anteriores, 6.2.x, 6.0.x y FortiClientEMS 7.0.0, 6.4.6 y anteriores, 6.2.x, 6.0.x puede permitir a un atacante llevar a cabo un ataqu... • https://fortiguard.com/advisory/FG-IR-21-088 • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-26089 – Fortinet FortiClient Incorrect Permission Assignment Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-26089
17 Jun 2021 — An improper symlink following in FortiClient for Mac 6.4.3 and below may allow an non-privileged user to execute arbitrary privileged shell commands during installation phase. Un seguimiento inapropiado de los enlaces simbólicos en FortiClient para Mac versiones 6.4.3 y por debajo, puede permitir a un usuario no privilegiado ejecutar comandos de shell con privilegios arbitrarios durante la fase de instalación This vulnerability allows local attackers to escalate privileges on affected installations of Forti... • https://fortiguard.com/advisory/FG-IR-21-022 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-16150
https://notcve.org/view.php?id=CVE-2019-16150
04 Jun 2020 — Use of a hard-coded cryptographic key to encrypt security sensitive data in local storage and configuration in FortiClient for Windows prior to 6.4.0 may allow an attacker with access to the local storage or the configuration backup file to decrypt the sensitive data via knowledge of the hard-coded key. El uso de una clave criptográfica embebida para cifrar datos confidenciales de seguridad en el almacenamiento local y la configuración en FortiClient para Windows versiones anteriores a 6.4.0, puede permitir... • https://fortiguard.com/psirt/FG-IR-19-194 • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-9291
https://notcve.org/view.php?id=CVE-2020-9291
01 Jun 2020 — An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain elevated privileges via exhausting the pool of temporary file names combined with a symbolic link attack. Una Vulnerabilidad de Archivos Temporales No Seguros en FortiClient para Windows versiones 6.2.1 y posteriores, puede permitir a un usuario local alcanzar privilegios elevados por medio del agotamiento del conjunto de nombres de archivos temporales combinado con un ataque de enlace simbólic... • https://fortiguard.com/psirt/FG-IR-20-040 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-9290
https://notcve.org/view.php?id=CVE-2020-9290
15 Mar 2020 — An Unsafe Search Path vulnerability in FortiClient for Windows online installer 6.2.3 and below may allow a local attacker with control over the directory in which FortiClientOnlineInstaller.exe and FortiClientVPNOnlineInstaller.exe resides to execute arbitrary code on the system via uploading malicious Filter Library DLL files in that directory. Una vulnerabilidad de Ruta de Búsqueda No Segura en FortiClient for Windows online installer versiones 6.2.3 y por debajo, puede permitir que un atacante local, co... • https://fortiguard.com/psirt/FG-IR-19-060 • CWE-427: Uncontrolled Search Path Element •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2019-17658
https://notcve.org/view.php?id=CVE-2019-17658
12 Mar 2020 — An unquoted service path vulnerability in the FortiClient FortiTray component of FortiClientWindows v6.2.2 and prior allow an attacker to gain elevated privileges via the FortiClientConsole executable service path. Una vulnerabilidad de ruta de servicio no citada en el componente FortiTray de FortiClient de FortiClientWindows versiones v6.2.2 y anteriores, permite a un atacante alcanzar privilegios elevados por medio de la ruta de servicio ejecutable de FortiClientConsole. • https://github.com/Ibonok/CVE-2019-17658 • CWE-428: Unquoted Search Path or Element •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-16155
https://notcve.org/view.php?id=CVE-2019-16155
07 Feb 2020 — A privilege escalation vulnerability in FortiClient for Linux 6.2.1 and below may allow a user with low privilege to overwrite system files as root with arbitrary content through system backup file via specially crafted "BackupConfig" type IPC client requests to the fctsched process. Further more, FortiClient for Linux 6.2.2 and below allow low privilege user write the system backup file under root privilege through GUI thus can cause root system file overwrite. Una vulnerabilidad de escalada de privilegios... • https://danishcyberdefence.dk/blog/forticlient_linux •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-16152
https://notcve.org/view.php?id=CVE-2019-16152
06 Feb 2020 — A Denial of service (DoS) vulnerability in FortiClient for Linux 6.2.1 and below may allow an user with low privilege to cause FortiClient processes running under root privilege crashes via sending specially crafted IPC client requests to the fctsched process due the nanomsg not been correctly validated. Una vulnerabilidad de denegación de servicio (DoS) en FortiClient para Linux versiones 6.2.1 y posteriores, puede permitir a un usuario con privilegios bajos causar que los procesos de FortiClient se ejecut... • https://danishcyberdefence.dk/blog/forticlient_linux • CWE-20: Improper Input Validation •