CVE-2017-14191: Undefined Security Weakness

An Improper Access Control vulnerability in Fortinet FortiWeb 5.6.0 up to but not including 6.1.0 under "Signed Security Mode", allows attacker to bypass the signed user cookie protection by removing the FortiWeb own protection session cookie...

FortiWeb's cookie tampering protection can be bypassed by erasing the FortiWeb session cookie

An improper access control vulnerability in FortiWeb's Signed Security mode may allow an attacker to disable the cookie tampering protection offered by FortiWeb to sites FortiWeb protects, via deleting FortiWeb's session cookie...

Fortinet FortiWeb Cross-Site Scripting Vulnerability (CNVD-2018-05180)

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content. A...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in FortiWeb before 4.4.4 allow remote attackers to inject arbitrary web script or HTML via the 1 redir or 2 mkey parameter to waf/pcreexpression/validate...

CVE-2012-6346

Multiple cross-site scripting XSS vulnerabilities in FortiWeb before 4.4.4 allow remote attackers to inject arbitrary web script or HTML via the 1 redir or 2 mkey parameter to waf/pcreexpression/validate...

CVE-2012-6346

FortiWeb’s vulnerability CVE-2012-6346 is a cross-site scripting flaw in FortiWeb versions prior to 4.4.4. The issue allows remote attackers to inject arbitrary web script or HTML by supplying the malicious payload via the redir or mkey parameter to waf/pcre_expression/validate. Impact described ...

CVE-2012-6346

Multiple cross-site scripting XSS vulnerabilities in FortiWeb before 4.4.4 allow remote attackers to inject arbitrary web script or HTML via the 1 redir or 2 mkey parameter to waf/pcreexpression/validate...

PT-2018-4054

Name of the Vulnerable Software and Affected Versions FortiWeb versions prior to 4.4.4 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the redir or mkey parameter to "waf/pcre expression/validate". Recommendations For versions prior t...

CVE-2012-6346: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in FortiWeb before 4.4.4 allow remote attackers to inject arbitrary web script or HTML via the 1 redir or 2 mkey parameter to waf/pcreexpression/validate...

The vulnerability of the software interface of the FortiWeb Manager, a centralized control system for network switches, relates to access control deficiencies, allowing an intruder to gain access to the system using an administrator account.

The vulnerability of the software interface for centralized control of network switches, FortiWeb Manager, is related to the lack of password verification for the admin account. Exploiting this vulnerability could allow a malicious actor, operating remotely and having access to the web interface,...

CVE-2017-7736

A stored Cross-site Scripting XSS vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import...

Cross site scripting

A stored Cross-site Scripting XSS vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import...

CVE-2017-7736

A stored Cross-site Scripting XSS vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import...

CVE-2017-7736

A stored Cross-site Scripting XSS vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import...

CVE-2017-7736

A stored Cross-site Scripting XSS vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import...

CVE-2017-7736

The CVE-2017-7736 entry applies to Fortinet FortiWeb: a stored Cross-site Scripting (XSS) vulnerability on the webUI Certificate View page affecting FortiWeb versions 5.8.0, 5.7.1 and earlier. The root cause is a flaw that lets an attacker inject arbitrary web script or HTML via a specially craft...

PT-2017-17917

Name of the Vulnerable Software and Affected Versions FortiWeb versions 5.8.0, 5.7.1 and earlier Description A stored Cross-site Scripting XSS issue in the webUI Certificate View page allows attackers to inject arbitrary web script or HTML via specially crafted malicious certificate imports...

Fortinet Fortiweb HTML Injection Vulnerability

FortiWeb is a web application layer firewall developed by Fortinet. An HTML injection vulnerability exists in Fortinet Fortiweb versions prior to 5.8.1 and 5.7.2, which can be exploited by an attacker to execute HTML and script code in the context of an affected site...

CVE-2017-7736: Improper Neutralization of Input During Web Page Generation

A stored Cross-site Scripting XSS vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import...

FortiWeb Stored XSS vulnerability on webUI certificate view page

There exists a persistent Cross-site Scripting XSS vulnerability on FortiWeb's webUI Certificate View page, which can be triggered via malicious certificate import...