CVE-2017-7341

An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, and 8.3.0 through 8.3.2 file management AP script download webUI page allows an authenticated admin user to execute arbitrary system console commands via crafted HTTP requests...

CVE-2017-7732

A reflected Cross-Site Scripting XSS vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9 customized pre-authentication webmail login page allows attacker to inject arbitrary web script or HTML via crafted HTTP requests...

Cross site scripting

A Cross-Site Scripting XSS vulnerability in Fortinet FortiWLC 6.1-x 6.1-2, 6.1-4 and 6.1-5; 7.0-x 7.0-7, 7.0-8, 7.0-9, 7.0-10; and 8.x 8.0, 8.1, 8.2 and 8.3.0-8.3.2 allows an authenticated user to inject arbitrary web script or HTML via non-sanitized parameters "refresh" and "branchtotable" prese...

Command injection

An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, and 8.3.0 through 8.3.2 file management AP script download webUI page allows an authenticated admin user to execute arbitrary system console commands via crafted HTTP requests...

CVE-2017-7335

A Cross-Site Scripting XSS vulnerability in Fortinet FortiWLC 6.1-x 6.1-2, 6.1-4 and 6.1-5; 7.0-x 7.0-7, 7.0-8, 7.0-9, 7.0-10; and 8.x 8.0, 8.1, 8.2 and 8.3.0-8.3.2 allows an authenticated user to inject arbitrary web script or HTML via non-sanitized parameters "refresh" and "branchtotable" prese...

CVE-2017-7335

A Cross-Site Scripting XSS vulnerability in Fortinet FortiWLC 6.1-x 6.1-2, 6.1-4 and 6.1-5; 7.0-x 7.0-7, 7.0-8, 7.0-9, 7.0-10; and 8.x 8.0, 8.1, 8.2 and 8.3.0-8.3.2 allows an authenticated user to inject arbitrary web script or HTML via non-sanitized parameters "refresh" and "branchtotable" prese...

CVE-2017-7335

A Cross-Site Scripting XSS vulnerability in Fortinet FortiWLC 6.1-x 6.1-2, 6.1-4 and 6.1-5; 7.0-x 7.0-7, 7.0-8, 7.0-9, 7.0-10; and 8.x 8.0, 8.1, 8.2 and 8.3.0-8.3.2 allows an authenticated user to inject arbitrary web script or HTML via non-sanitized parameters "refresh" and "branchtotable" prese...

CVE-2017-7341

The CVE-2017-7341 entry describes an OS Command Injection in Fortinet FortiWLC (FortiWLC) file management AP script download webUI page. Affected software ranges from FortiWLC 6.1-2 to 8.3.2, with exploitation possible by an authenticated admin user via crafted HTTP requests to execute arbitrary ...

CVE-2017-7732

CVE-2017-7732 is a reflected XSS vulnerability in Fortinet FortiMail (versions up to 5.1, 5.2.0–5.2.9, 5.3.0–5.3.9) on the pre-authentication webmail login page. The issue allows an attacker to inject arbitrary web script/HTML via crafted HTTP requests, with exploitation described as pre-auth, po...

CVE-2017-7732

A reflected Cross-Site Scripting XSS vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9 customized pre-authentication webmail login page allows attacker to inject arbitrary web script or HTML via crafted HTTP requests...

CVE-2017-7341

An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, and 8.3.0 through 8.3.2 file management AP script download webUI page allows an authenticated admin user to execute arbitrary system console commands via crafted HTTP requests...

CVE-2017-7335

A Cross-Site Scripting XSS vulnerability in Fortinet FortiWLC 6.1-x 6.1-2, 6.1-4 and 6.1-5; 7.0-x 7.0-7, 7.0-8, 7.0-9, 7.0-10; and 8.x 8.0, 8.1, 8.2 and 8.3.0-8.3.2 allows an authenticated user to inject arbitrary web script or HTML via non-sanitized parameters "refresh" and "branchtotable" prese...

CVE-2017-7335

CVE-2017-7335 concerns a Cross-Site Scripting (XSS) vulnerability in Fortinet FortiWLC (versions 6.1-2/6.1-4/6.1-5; 7.0-7/7.0-8/7.0-9/7.0-10; 8.0/8.1/8.2/8.3.0-8.3.2). The issue arises from non-sanitized HTTP POST parameters refresh and branchtotable, allowing an authenticated user to inject arbi...

CVE-2017-7341

An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, and 8.3.0 through 8.3.2 file management AP script download webUI page allows an authenticated admin user to execute arbitrary system console commands via crafted HTTP requests...

PT-2017-17669

Name of the Vulnerable Software and Affected Versions Fortinet FortiWLC versions 6.1-2 through 6.1-5 Fortinet FortiWLC versions 7.0-7 through 7.0-10 Fortinet FortiWLC versions 8.0 through 8.3.2 Description A Cross-Site Scripting XSS issue allows an authenticated user to inject arbitrary web scrip...

PT-2017-17674

Name of the Vulnerable Software and Affected Versions Fortinet FortiWLC versions 6.1-2 through 6.1-5 Fortinet FortiWLC versions 7.0-7 through 7.0-10 Fortinet FortiWLC versions 8.0 through 8.2 Fortinet FortiWLC versions 8.3.0 through 8.3.2 Description The issue allows an authenticated admin user t...

CVE-2017-7335: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability in Fortinet FortiWLC 6.1-x 6.1-2, 6.1-4 and 6.1-5; 7.0-x 7.0-7, 7.0-8, 7.0-9, 7.0-10; and 8.x 8.0, 8.1, 8.2 and 8.3.0-8.3.2 allows an authenticated user to inject arbitrary web script or HTML via non-sanitized parameters "refresh" and "branchtotable" prese...

CVE-2017-7341: Improper Neutralization of Special Elements used in an OS Command

An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, and 8.3.0 through 8.3.2 file management AP script download webUI page allows an authenticated admin user to execute arbitrary system console commands via crafted HTTP requests...

DUHK Attack Lets Hackers Recover Encryption Key Used in VPNs & Web Sessions

DUHK — Don't Use Hard-coded Keys — is a new 'non-trivial' cryptographic implementation vulnerability that could allow attackers to recover encryption keys that secure VPN connections and web browsing sessions. DUHK is the third crypto-related vulnerability reported this month after KRACK Wi-Fi...

Fortinet FortiWLC OS Command Injection Vulnerability (CNVD-2017-32269)

The Fortinet FortiWLC is a network management appliance. FortiWLC versions 6.1-2, 6.1-4, 6.1-5, FortiWLC 7.0-7, 7.0-8, 7.0-9, 7.0-10, and FortiWLC 8.0, 8.1, 8.2, 8.3.0-8.3.2 suffer from OS command injection vulnerabilities in their implementations, which can be exploited by an attacker to inject...