CVE-2015-1880

Cross-site scripting XSS vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Fortinet FortiOS 5.2.x before 5.2.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the 1 user group or 2 vpn template menus...

Cross site scripting

Cross-site scripting XSS vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-8616

Multiple cross-site scripting XSS vulnerabilities in Fortinet FortiOS 5.2.x before 5.2.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the 1 user group or 2 vpn template menus...

CVE-2015-1880

Cross-site scripting XSS vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-8616

Fortinet FortiOS 5.2.x is affected by CVE-2014-8616 (and related CVE-2015-1880) due to multiple cross-site scripting vulnerabilities. Affected versions are FortiOS before 5.2.3. Exploitation occurs via crafted requests to vulnerable surfaces (notably the user group and VPN template menus, and the...

CVE-2014-8616

Multiple cross-site scripting XSS vulnerabilities in Fortinet FortiOS 5.2.x before 5.2.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the 1 user group or 2 vpn template menus...

CVE-2015-1880

Fortinet FortiOS 5.2.x prior to 5.2.3 is vulnerable to a cross-site scripting (XSS) flaw in the sslvpn login page. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, with exploitation potentially enabling code execution in the victim’s browser and re...

Fortinet FortiOS Man-in-the-Middle Attack Vulnerability (CNVD-2015-01149)

Fortinet FortiOS is a set of security operating system developed by the U.S. company Fita Fortinet dedicated to the FortiGate platform, which provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering, anti-spam and other security features. A man-in-the-middle attack...

Fortinet FortiGate XSS Vulnerability (FG-IR-14-003)

FortiOS as used in FortiGate is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2015-1571

The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the FortinetFactory certificate and...

Design/Logic Flaw

DISPUTED The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the FortinetFactory certificate...

CVE-2015-1571

Fortinet FortiOS 5.0 Patch 7 (build 4457) CAPWAP DTLS uses the same Fortinet_Factory certificate and private key across different customer installations. This configuration could enable an attacker to perform a man‑in‑the‑middle by spoofing SSL servers leveraging the Fortinet_Factory cert. Some s...

CVE-2015-1571

The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the FortinetFactory certificate and...

PT-2015-3369 · Fortinet · Fortios

Name of the Vulnerable Software and Affected Versions: FortiOS version 5.0 Patch 7 build 4457 Description: The CAPWAP DTLS protocol implementation in FortiOS uses the same certificate and private key across different customers' installations. However, according to FG-IR-15-002, the Fortinet Facto...

Fortinet FortiOS HTML Injection Vulnerability

Fortinet FortiOS is a set of security operating system developed by the U.S. company Fita Fortinet dedicated to the FortiGate platform, which provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering, anti-spam and other security features. An HTML injection vulnerability exist...

Fortinet FortiOS Information Disclosure Vulnerability (CNVD-2015-00916)

Fortinet FortiOS is a set of security operating system developed by the U.S. company Fita Fortinet dedicated to the FortiGate platform, which provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering, anti-spam and other security features. An information disclosure vulnerabili...

CVE-2015-1451

Multiple cross-site scripting XSS vulnerabilities in Fortinet FortiOS 5.0 Patch 7 build 4457 allow remote authenticated users to inject arbitrary web script or HTML via the 1 WTP Name or 2 WTP Active Software Version field in a CAPWAP Join request...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Fortinet FortiOS 5.0 Patch 7 build 4457 allow remote authenticated users to inject arbitrary web script or HTML via the 1 WTP Name or 2 WTP Active Software Version field in a CAPWAP Join request...

Design/Logic Flaw

The Control and Provisioning of Wireless Access Points CAPWAP daemon in Fortinet FortiOS 5.0 Patch 7 build 4457 allows remote attackers to cause a denial of service locked CAPWAP Access Controller via a large number of ClientHello DTLS messages...