CVE-2017-7335

CVE-2017-7335 concerns a Cross-Site Scripting (XSS) vulnerability in Fortinet FortiWLC (versions 6.1-2/6.1-4/6.1-5; 7.0-7/7.0-8/7.0-9/7.0-10; 8.0/8.1/8.2/8.3.0-8.3.2). The issue arises from non-sanitized HTTP POST parameters refresh and branchtotable, allowing an authenticated user to inject arbi...

CVE-2017-7341

An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, and 8.3.0 through 8.3.2 file management AP script download webUI page allows an authenticated admin user to execute arbitrary system console commands via crafted HTTP requests...

CVE-2017-7335

A Cross-Site Scripting XSS vulnerability in Fortinet FortiWLC 6.1-x 6.1-2, 6.1-4 and 6.1-5; 7.0-x 7.0-7, 7.0-8, 7.0-9, 7.0-10; and 8.x 8.0, 8.1, 8.2 and 8.3.0-8.3.2 allows an authenticated user to inject arbitrary web script or HTML via non-sanitized parameters "refresh" and "branchtotable" prese...

CVE-2017-7732

A reflected Cross-Site Scripting XSS vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9 customized pre-authentication webmail login page allows attacker to inject arbitrary web script or HTML via crafted HTTP requests...

CVE-2017-7341

An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, and 8.3.0 through 8.3.2 file management AP script download webUI page allows an authenticated admin user to execute arbitrary system console commands via crafted HTTP requests...

CVE-2017-7341

The CVE-2017-7341 entry describes an OS Command Injection in Fortinet FortiWLC (FortiWLC) file management AP script download webUI page. Affected software ranges from FortiWLC 6.1-2 to 8.3.2, with exploitation possible by an authenticated admin user via crafted HTTP requests to execute arbitrary ...

CVE-2017-7732

CVE-2017-7732 is a reflected XSS vulnerability in Fortinet FortiMail (versions up to 5.1, 5.2.0–5.2.9, 5.3.0–5.3.9) on the pre-authentication webmail login page. The issue allows an attacker to inject arbitrary web script/HTML via crafted HTTP requests, with exploitation described as pre-auth, po...

CVE-2017-7335

A Cross-Site Scripting XSS vulnerability in Fortinet FortiWLC 6.1-x 6.1-2, 6.1-4 and 6.1-5; 7.0-x 7.0-7, 7.0-8, 7.0-9, 7.0-10; and 8.x 8.0, 8.1, 8.2 and 8.3.0-8.3.2 allows an authenticated user to inject arbitrary web script or HTML via non-sanitized parameters "refresh" and "branchtotable" prese...

DUHK Attack Lets Hackers Recover Encryption Key Used in VPNs & Web Sessions

DUHK — Don't Use Hard-coded Keys — is a new 'non-trivial' cryptographic implementation vulnerability that could allow attackers to recover encryption keys that secure VPN connections and web browsing sessions. DUHK is the third crypto-related vulnerability reported this month after KRACK Wi-Fi...

Fortinet FortiWLC OS Command Injection Vulnerability (CNVD-2017-32269)

The Fortinet FortiWLC is a network management appliance. FortiWLC versions 6.1-2, 6.1-4, 6.1-5, FortiWLC 7.0-7, 7.0-8, 7.0-9, 7.0-10, and FortiWLC 8.0, 8.1, 8.2, 8.3.0-8.3.2 suffer from OS command injection vulnerabilities in their implementations, which can be exploited by an attacker to inject...

Fortinet FortiGate < 5.2 / 5.2.x <= 5.2.11 / 5.4.x <= 5.4.5 / 5.6.x <= 5.6.2 Multiple Vulnerabilities (FG-IR-17-196) (KRACK)

The remote host is running FortiOS prior to 5.2, 5.2.x prior to or equal to 5.2.11, 5.4.x prior to or equal 5.4.5, or 5.6.x prior to or equal to 5.6.2. It is, therefore, affected by multiple vulnerabilities discovered in the WPA2 handshake protocol. Note these issues affect only WiFi model device...

fortinet.com XSS vulnerability

Vulnerable URL: https://www.fortinet.com/search.html?q=%22--%21%3E%3Cimg+src%3Dx+onerror%3Dalert%28%22OPENBUGBOUNTY%22%29%3E=1 Details: Description| Value ---|--- Patched:| Yes, at 20.10.2017 Latest check for patch:| 20.10.2017 07:08 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

CVE-2017-7734

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via 'Comments' while saving Config Revisions...

Cross site scripting

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via the filter input in "Applications" under FortiView...

CVE-2017-7735

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.2.0 through 5.2.11 and 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via the "Groups" input while creating or editing User Groups...

Cross site scripting

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or commands via the action input during the activation of a FortiToken...

CVE-2017-3131

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via the filter input in "Applications" under FortiView...

CVE-2017-3133

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commands via the Replacement Message HTML for SSL-VPN...

Cross site scripting

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.2.0 through 5.2.11 and 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via the "Groups" input while creating or editing User Groups...

Cross site scripting

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commands via the Replacement Message HTML for SSL-VPN...