CVE-2016-8495

An improper certificate validation vulnerability in Fortinet FortiManager 5.0.6 through 5.2.7 and 5.4.0 through 5.4.1 allows remote attacker to spoof a trusted entity by using a man-in-the-middle MITM attack via the Fortisandbox devices probing feature...

CVE-2016-8495

Fortinet FortiManager (versions 5.0.6–5.2.7 and 5.4.0–5.4.1) is affected by an improper TLS certificate validation vulnerability during device probing (Fortisandbox feature). This enables a remote attacker to perform MITM and spoof a trusted entity, with potential exposure of pre-shared secrets. ...

CVE-2016-8495: Exposure of Sensitive Information to an Unauthorized Actor

An improper certificate validation vulnerability in Fortinet FortiManager 5.0.6 through 5.2.7 and 5.4.0 through 5.4.1 allows remote attacker to spoof a trusted entity by using a man-in-the-middle MITM attack via the Fortisandbox devices probing feature...

FortiManager TLS certificate validation failure

FortiManager does not properly validate TLS certificates when probing for devices to administer. This leads to potential pre-shared secret exposure...

Fortinet FortiManager XSS Vulnerability (FG-IR-16-051)

Fortinet FortiManager is prone to a cross-site-scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Fortinet FortiManager and Fortinet FortiAnalyzer Cross-Site Scripting Vulnerabilities

Fortinet FortiManager and Fortinet FortiAnalyzer are products of Fortinet, a centralized network security management solution; Fortinet FortiAnalyzer is a centralized network security reporting solution. Fortinet FortiManager is a centralized network security management solution; Fortinet...

CVE-2015-7363

Cross-site scripting XSS vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3 allows remote administrators to inject arbitrary web script or HT...

Cross site scripting

Cross-site scripting XSS vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3 allows remote administrators to inject arbitrary web script or HT...

CVE-2015-7363

Cross-site scripting XSS vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3 allows remote administrators to inject arbitrary web script or HT...

CVE-2015-7363

CVE-2015-7363 covers a stored XSS in the Fortinet FortiManager/FortiAnalyzer advanced settings page through report filters. Affected are FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3. The vulnerability allows a remote administrat...

CVE-2015-7363: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3 allows remote administrators to inject arbitrary web script or HT...

FortiAnalyzer and FortiManager stored XSS vulnerability in report filters

A cross-site-scripting vulnerablity in FortiAnalyzer/FortiManager in advanced settings page could allow an administrator to inject scripts in the add filter field...

Security Bypass Vulnerabilities in Multiple Fortinet Products

Fortinet FortiManager and Fortinet FortiAnalyzer are products of Fortinet, a centralized network security management solution; Fortinet FortiAnalyzer is a centralized network security reporting solution. Fortinet FortiManager is a centralized network security management solution; Fortinet...

Fortinet FortiAnalyzer and FortiManager 'Filenames' HTML Injection Vulnerability

Fortinet FortiManager is a centralized network security management solution; Fortinet FortiAnalyzer is a centralized network security reporting solution. An HTML injection vulnerability exists in FortiAnalyzer and FortiManager 'Filenames' that could be exploited by an attacker to steal cookie-bas...

CVE-2016-3195

Cross-site scripting XSS vulnerability in the Web-UI in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-3195

Cross-site scripting XSS vulnerability in the Web-UI in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-3194

Cross-site scripting XSS vulnerability in the address added page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-3194

Cross-site scripting XSS vulnerability in the address added page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-3193

Cross-site scripting XSS vulnerability in the appliance web-application in Fortinet FortiManager 5.x before 5.0.12, 5.2.x before 5.2.6, and 5.4.x before 5.4.1 and FortiAnalyzer 5.x before 5.0.13, 5.2.x before 5.2.6, and 5.4.x before 5.4.1 allows remote authenticated users to inject arbitrary web...

CVE-2016-3193

Cross-site scripting XSS vulnerability in the appliance web-application in Fortinet FortiManager 5.x before 5.0.12, 5.2.x before 5.2.6, and 5.4.x before 5.4.1 and FortiAnalyzer 5.x before 5.0.13, 5.2.x before 5.2.6, and 5.4.x before 5.4.1 allows remote authenticated users to inject arbitrary web...