CVE-2014-8616

Multiple cross-site scripting XSS vulnerabilities in Fortinet FortiOS 5.2.x before 5.2.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the 1 user group or 2 vpn template menus...

CVE-2014-8616

Fortinet FortiOS 5.2.x is affected by CVE-2014-8616 (and related CVE-2015-1880) due to multiple cross-site scripting vulnerabilities. Affected versions are FortiOS before 5.2.3. Exploitation occurs via crafted requests to vulnerable surfaces (notably the user group and VPN template menus, and the...

CVE-2015-1880

Cross-site scripting XSS vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Fortinet FortiOS Man-in-the-Middle Attack Vulnerability (CNVD-2015-01149)

Fortinet FortiOS is a set of security operating system developed by the U.S. company Fita Fortinet dedicated to the FortiGate platform, which provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering, anti-spam and other security features. A man-in-the-middle attack...

Fortinet FortiGate XSS Vulnerability (FG-IR-14-003)

FortiOS as used in FortiGate is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2015-1571

The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the FortinetFactory certificate and...

Design/Logic Flaw

DISPUTED The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the FortinetFactory certificate...

CVE-2015-1571

Fortinet FortiOS 5.0 Patch 7 (build 4457) CAPWAP DTLS uses the same Fortinet_Factory certificate and private key across different customer installations. This configuration could enable an attacker to perform a man‑in‑the‑middle by spoofing SSL servers leveraging the Fortinet_Factory cert. Some s...

CVE-2015-1571

The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the FortinetFactory certificate and...

PT-2015-3369 · Fortinet · Fortios

Name of the Vulnerable Software and Affected Versions: FortiOS version 5.0 Patch 7 build 4457 Description: The CAPWAP DTLS protocol implementation in FortiOS uses the same certificate and private key across different customers' installations. However, according to FG-IR-15-002, the Fortinet Facto...

Fortinet FortiOS Information Disclosure Vulnerability (CNVD-2015-00916)

Fortinet FortiOS is a set of security operating system developed by the U.S. company Fita Fortinet dedicated to the FortiGate platform, which provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering, anti-spam and other security features. An information disclosure vulnerabili...

Fortinet FortiOS HTML Injection Vulnerability

Fortinet FortiOS is a set of security operating system developed by the U.S. company Fita Fortinet dedicated to the FortiGate platform, which provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering, anti-spam and other security features. An HTML injection vulnerability exist...

CVE-2015-1451

Multiple cross-site scripting XSS vulnerabilities in Fortinet FortiOS 5.0 Patch 7 build 4457 allow remote authenticated users to inject arbitrary web script or HTML via the 1 WTP Name or 2 WTP Active Software Version field in a CAPWAP Join request...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Fortinet FortiOS 5.0 Patch 7 build 4457 allow remote authenticated users to inject arbitrary web script or HTML via the 1 WTP Name or 2 WTP Active Software Version field in a CAPWAP Join request...

Design/Logic Flaw

The Control and Provisioning of Wireless Access Points CAPWAP daemon in Fortinet FortiOS 5.0 Patch 7 build 4457 allows remote attackers to cause a denial of service locked CAPWAP Access Controller via a large number of ClientHello DTLS messages...

CVE-2015-1451

CVE-2015-1451 refers to multiple XSS vulnerabilities in Fortinet FortiOS 5.0 Patch 7 (build 4457) affecting the CAPWAP server. The issue allows remote authenticated users to inject arbitrary web script or HTML via the WTP Name or WTP Active Software Version fields in a CAPWAP Join request. Affect...

CVE-2015-1452

The CVE-2015-1452 issue affects Fortinet FortiOS 5.0 Patch 7 build 4457, specifically the CAPWAP daemon. An attacker can trigger a denial of service by sending a flood of ClientHello DTLS messages, which can lock the CAPWAP Access Controller. The available connected records confirm the affected c...

CVE-2015-1451

Multiple cross-site scripting XSS vulnerabilities in Fortinet FortiOS 5.0 Patch 7 build 4457 allow remote authenticated users to inject arbitrary web script or HTML via the 1 WTP Name or 2 WTP Active Software Version field in a CAPWAP Join request...

CVE-2015-1452

The Control and Provisioning of Wireless Access Points CAPWAP daemon in Fortinet FortiOS 5.0 Patch 7 build 4457 allows remote attackers to cause a denial of service locked CAPWAP Access Controller via a large number of ClientHello DTLS messages...

Fortinet FortiOS Denial of Service Vulnerability (CNVD-2015-00852)

Fortinet FortiOS is a set of security operating system developed by the U.S. company Fita Fortinet dedicated to the FortiGate platform, which provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering, anti-spam and other security features. The Fortinet FortiOS denial of servic...