CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2017-14184
https://notcve.org/view.php?id=CVE-2017-14184
An Information Disclosure vulnerability in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Mac OSX 5.6.0 and below versions and FortiClient SSLVPN Client for Linux 4.4.2334 and below versions allows regular users to see each other's VPN authentication credentials due to improperly secured storage locations. Una vulnerabilidad de divulgación de información en Fortinet FortiClient for Windows 5.6.0 y anteriores, FortiClient for Mac OSX 5.6.0 y anteriores y FortiClient SSLVPN Client for Linux 4.4.2334 y anteriores permite que usuarios regulares vean las credenciales de autenticación de VPN de otros usuarios. Esto se debe a las ubicaciones de almacenamiento indebidamente aseguradas. • http://www.securityfocus.com/bid/102123 https://fortiguard.com/advisory/FG-IR-17-214 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 1CVE-2017-7344 – Fortinet FortiClient Windows Privilege Escalation
https://notcve.org/view.php?id=CVE-2017-7344
A privilege escalation in Fortinet FortiClient Windows 5.4.3 and earlier as well as 5.6.0 allows attacker to gain privilege via exploiting the Windows "security alert" dialog thereby popping up when the "VPN before logon" feature is enabled and an untrusted certificate chain. Una escalada de privilegios en Fortinet FortiClient Windows en versiones 5.4.3 y anteriores, así como la versión 5.6.0, permite que un atacante consiga privilegios explotando el diálogo de Windows "security alert" que aparece cuando la característica "VPN before logon" está habilitada y se conecta un certificado no fiable. Fortinet FortiClient Windows suffers from a privilege escalation vulnerability at logon. • http://www.securityfocus.com/bid/102176 https://fortiguard.com/advisory/FG-IR-17-070 https://securite.intrinsec.com/2017/12/22/cve-2017-7344-fortinet-forticlient-windows-privilege-escalation-at-logon •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 2CVE-2015-1570
https://notcve.org/view.php?id=CVE-2015-1570
The Endpoint Control protocol implementation in Fortinet FortiClient 5.2.3.091 for Android and 5.2.028 for iOS does not validate certificates, which makes it easier for man-in-the-middle attackers to spoof servers via a crafted certificate. La implementación de protocolo Endpoint Control en Fortinet FortiClient 5.2.3.091 para Android y 5.2.028 para iOS no valida los certificados, lo que facilita a atacantes man-in-the-middle falsificar servidores a través de un certificado manipulado. • http://seclists.org/fulldisclosure/2015/Jan/124 http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiClient_Multiple_Vulnerabilities.pdf • CWE-310: Cryptographic Issues •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 2CVE-2015-1453
https://notcve.org/view.php?id=CVE-2015-1453
The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which makes it easier for attackers to obtain passwords and possibly other sensitive data by leveraging the key to decrypt data in the Shared Preferences. La clase qm en Fortinet FortiClient 5.2.3.091 para Android utiliza una clave de cifrado embebido de FoRtInEt!AnDrOiD, lo que facilita a atacantes obtener contraseñas y posiblemente otros datos sensibles mediante el aprovechamiento de la clave para descifrar datos en las preferencias compartidas 'Shared Preferences'. • http://seclists.org/fulldisclosure/2015/Jan/124 http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiClient_Multiple_Vulnerabilities.pdf http://www.securityfocus.com/bid/72383 • CWE-310: Cryptographic Issues •