CVE-2017-14189

An improper access control vulnerability in Fortinet FortiWebManager 5.8.0 allows anyone that can access the admin webUI to successfully log-in regardless the provided password...

CVE-2017-14186

A Cross-site Scripting XSS vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote user to inject arbitrary web script or HTML in the context of the victim's browser via the login redir parameter. An URL Redirection attack...

CVE-2017-14186

A Cross-site Scripting XSS vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote user to inject arbitrary web script or HTML in the context of the victim's browser via the login redir parameter. An URL Redirection attack...

CVE-2017-14189

Summary: CVE-2017-14189 affects Fortinet FortiWebManager 5.8.0 where the admin login fails to verify the provided password, allowing login access to anyone who can reach the admin WebUI. The root cause is an improper access-control check in the login process. Public references include the FortiGu...

CVE-2017-14186

FortiGate FortiOS SSL VPN Web Portal is affected by CVE-2017-14186. A cross-site scripting (XSS) vulnerability exists because the login redir parameter is not sanitized, enabling a remote attacker to inject arbitrary script in a user’s browser within the FortiGate SSL VPN Web Portal context. A re...

CVE-2017-7736

A stored Cross-site Scripting XSS vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import...

Cross site scripting

A stored Cross-site Scripting XSS vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import...

CVE-2017-7736

A stored Cross-site Scripting XSS vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import...

CVE-2017-7736

The CVE-2017-7736 entry applies to Fortinet FortiWeb: a stored Cross-site Scripting (XSS) vulnerability on the webUI Certificate View page affecting FortiWeb versions 5.8.0, 5.7.1 and earlier. The root cause is a flaw that lets an attacker inject arbitrary web script or HTML via a specially craft...

CVE-2017-7736

A stored Cross-site Scripting XSS vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import...

CVE-2017-7736

A stored Cross-site Scripting XSS vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import...

Fortinet FortiOS 5.2.x < 5.2.23 / 5.4.x < 5.4.6 / 5.6.x < 5.6.1 Web Proxy Disclaimer Response Page Reflected XSS (FG-IR-17-168)

The version of Fortinet FortiOS running on the remote device is 5.2.x prior to 5.2.12, 5.4.x prior to 5.4.6, or 5.6.x prior to 5.6.1. It is, therefore, affected by a flaw in the web proxy disclaimer response page input validation that allows a reflected cross-site scripting XSS attack. C Tenable...

Fortinet FortiOS < 5.2 / 5.4.x < 5.4.6 / 5.6.x < 5.6.1 SSL / TLS Renegotiation Handshakes MitM Plaintext Data Injection (FG-IR-17-137)

The version of Fortinet FortiOS running on the remote device is 5.2.x or prior, 5.4.x prior to 5.4.6, or 5.6.x prior to 5.6.1. It is, therefore, affected by a MITM vulnerability in SSL Deep-Inspection due to insecure TLS renegotiation. C Tenable Network Security, Inc. include"compat.inc"; if...

Fortinet FortiOS Information Disclosure Vulnerability (CNVD-2017-37067)

Fortinet FortiOS is a set of security operating system developed by the U.S. Fiat Fortinet company dedicated to FortiGate network security platform. The system provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering and anti-spam and other security features. An information...

Cross site scripting

A reflected Cross-site Scripting XSS vulnerability in web proxy disclaimer response web pages in Fortinet FortiOS 5.6.0, 5.4.0 to 5.4.5, 5.2.0 to 5.2.11 allows an unauthenticated attacker to inject arbitrary web script or HTML in the context of the victim's browser via sending a maliciously craft...

CVE-2017-7739

A reflected Cross-site Scripting XSS vulnerability in web proxy disclaimer response web pages in Fortinet FortiOS 5.6.0, 5.4.0 to 5.4.5, 5.2.0 to 5.2.11 allows an unauthenticated attacker to inject arbitrary web script or HTML in the context of the victim's browser via sending a maliciously craft...

CVE-2017-7739

A reflected Cross-site Scripting XSS vulnerability in web proxy disclaimer response web pages in Fortinet FortiOS 5.6.0, 5.4.0 to 5.4.5, 5.2.0 to 5.2.11 allows an unauthenticated attacker to inject arbitrary web script or HTML in the context of the victim's browser via sending a maliciously craft...

CVE-2017-7739

A reflected Cross-site Scripting XSS vulnerability in web proxy disclaimer response web pages in Fortinet FortiOS 5.6.0, 5.4.0 to 5.4.5, 5.2.0 to 5.2.11 allows an unauthenticated attacker to inject arbitrary web script or HTML in the context of the victim's browser via sending a maliciously craft...

CVE-2017-7739

CVE-2017-7739 (Fortinet FortiOS): A reflected XSS vulnerability in the web proxy disclaimer response page allows an unauthenticated attacker to inject arbitrary script/HTML by sending a malicious URL. The underlying issue is flawed input validation on the disclaimer page. Affected FortiOS version...

Fortinet FortiOS Cross-Site Scripting Vulnerability (CNVD-2017-33750)

Fortinet FortiOS is a set of security operating system developed by the U.S. Fiat Fortinet dedicated to the FortiGate network security platform. The system provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering and anti-spam and other security features. A cross-site scripti...