FortiOS & FortiProxy - Information disclosure in web proxy error pages | allinfosecnews.com

May 3, 2022, 7 a.m. |

FortiGuard Labs | FortiGuard Center - IR Advisories fortiguard.fortinet.com

A server-generated error message containing sensitive information vulnerability [CWE-550] in FortiOS and FortiProxy web proxy may allow a malicious webserver to retrieve a web proxy's client username and IP via same origin HTTP requests triggering proxy-generated HTTP status codes pages.

disclosure error fortios information information disclosure proxy web

More from fortiguard.fortinet.com / FortiGuard Labs | FortiGuard Center - IR Advisories

FortiOS - Web server ETag exposure 2 weeks, 3 days ago | fortiguard.fortinet.com

actor attacker cwe device +17

FortiSandbox - Arbitrary file read on endpoint 2 weeks, 3 days ago | fortiguard.fortinet.com

arbitrary files attacker cwe directory +12

FortiNAC-F - Lack of certificate validation 2 weeks, 3 days ago | fortiguard.fortinet.com

attack attacker certificate channel +12

FortiOS - Format String in CLI command 2 weeks, 3 days ago | fortiguard.fortinet.com

access admin arbitrary code attacker +16

FortiOS & FortiProxy - administrator cookie leakage 2 weeks, 3 days ago | fortiguard.fortinet.com

administrator attacker conditions cookie +10

FortiSandbox - Arbitrary file delete on endpoint 2 weeks, 3 days ago | fortiguard.fortinet.com

arbitrary files attacker cwe delete +13

FortiClientMac - Lack of configuration file validation 2 weeks, 3 days ago | fortiguard.fortinet.com

arbitrary code attacker code configuration +15

FortiManager - Code Injection via Jinja Template 2 weeks, 3 days ago | fortiguard.fortinet.com

arbitrary code attacker code code injection +11

FortiSandbox - Arbitrary file write on CLI leading to arbitrary code execution 2 weeks, 3 days ago | fortiguard.fortinet.com

access admin arbitrary code arbitrary code execution +16

SOC 2 Manager, Audit and Certification

@ Deloitte | US and CA Multiple Locations

View on infosec-jobs.com

Security Operations Manager (f/d/m), 80-100%

@ Alpiq | Lausanne, CH

View on infosec-jobs.com

Project Manager - Cyber Security

@ Quantrics Enterprises Inc. | Philippines

View on infosec-jobs.com

Sr. Principal Application Security Engineer

@ Gen | DEU - Tettnang, Kaplaneiweg

View on infosec-jobs.com

(Senior) Security Architect Car IT/ Threat Modelling / Information Security (m/f/x)

@ Mercedes-Benz Tech Innovation | Ulm

View on infosec-jobs.com

Information System Security Officer

@ ManTech | 200AE - 375 E St SW, Washington, DC

View on infosec-jobs.com