CVE-2014-4738

Fortinet FortiWeb 5.x prior to 5.2.1 is affected by CVE-2014-4738 (XSS) in the web management interface URLs /user/ldap_user/check_dlg and /user/radius_user/check_dlg due to insufficient input validation. This allows remote attackers to inject arbitrary JavaScript in an administrative browser ses...

CVE-2014-4738

Multiple cross-site scripting XSS vulnerabilities in FortiGuard FortiWeb 5.0.x, 5.1.x, and 5.2.x before 5.2.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to 1 user/ldapuser/checkdlg or 2 user/radiususer/checkdlg...

CVE-2014-4738: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in FortiGuard FortiWeb 5.0.x, 5.1.x, and 5.2.x before 5.2.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to 1 user/ldapuser/checkdlg or 2 user/radiususer/checkdlg...

PT-2014-6085

Name of the Vulnerable Software and Affected Versions FortiGuard FortiWeb versions 5.0.x through 5.2.x before 5.2.1 Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to API endpoints such as "user/ldap user/check dlg" or "user/radius...

CVE-2014-1956

CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

Design/Logic Flaw

FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors...

Crlf injection

CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-1956

CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

CVE-2014-1955

FortiWeb (Fortinet) FortiWeb 4.x/5.x is affected by CVE-2014-1955, a cross-site scripting (XSS) vulnerability present in versions prior to 5.0.3. The issue allows remote attackers to inject arbitrary web scripts or HTML via unspecified vectors. The NVD entry lists a CVSS v2 base score of 4.3 (Med...

CVE-2014-1956: Undefined Security Weakness

CRLF injection vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors...

PT-2014-4380

Name of the Vulnerable Software and Affected Versions FortiGuard FortiWeb versions prior to 5.0.3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For versions prior to 5.0.3, update to version 5.0.3 or later to resolve t...

PT-2014-4382

Name of the Vulnerable Software and Affected Versions FortiGuard FortiWeb versions prior to 5.0.3 Description The issue allows remote authenticated users to gain privileges. Recommendations For versions prior to 5.0.3, update to version 5.0.3 or later to resolve the issue...

CVE-2014-1955: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in FortiGuard FortiWeb before 5.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-1957: Undefined Security Weakness

FortiGuard FortiWeb before 5.0.3 allows remote authenticated users to gain privileges via unspecified vectors...

PT-2014-4381

Name of the Vulnerable Software and Affected Versions FortiGuard FortiWeb versions prior to 5.0.3 Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. Recommendations For versions prior to 5.0.3, update to version 5.0.3 or lat...

CVE-2014-1458

Cross-site scripting XSS vulnerability in the web administration interface in FortiGuard FortiWeb 5.0.3 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors...

PT-2014-4193

Name of the Vulnerable Software and Affected Versions FortiGuard FortiWeb versions 5.0.3 and earlier Description A cross-site scripting XSS issue exists in the web administration interface, allowing remote authenticated administrators to inject arbitrary web script or HTML. Recommendations For...

CVE-2014-1458: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the web administration interface in FortiGuard FortiWeb 5.0.3 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors...