Fortinet FortiAnalyzer < 4.3.7 / 5.0.5 Multiple XSRF

The remote host is running FortiAnalyzer prior to 4.3.7 / 5.0.5. It is, therefore, affected by multiple cross-site request forgery vulnerabilities due to a failure to validate XSRF tokens in several web UI scripts. An attacker could potentially exploit this vulnerability to hijack an authenticate...

Fortinet FortiOS < 4.3.13 / 5.0.3 Multiple XSRF

The remote host is running FortiOS prior to 4.3.13 / 5.0.3. It is, therefore, affected by multiple cross-site request forgery vulnerabilities in web UI pages because they are not protected by XSRF tokens. An attacker could potentially exploit this vulnerability to hijack an authenticated user's...

Fortinet FortiOS User Interface Default Credentials

The remote Fortinet FortiOS user interface uses a known set of default credentials. Knowing these, an attacker with access to the service can gain administrative access to the device. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Fortinet FortiADC D-series contains a cross-site scripting vulnerability

Overview Fortinet FortiADC D-series 3.2.0, and possibly earlier versions, contains a cross-site scripting vulnerability. CWE-79 Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' Fortinet FortiADC D-series 3.2.0, and possibly earlier versions,...

Fortinet OpenSSL Information Disclosure (Heartbleed)

The firmware of the remote Fortinet host is running a version of OpenSSL that is affected by a remote information disclosure, commonly known as the 'Heartbleed' bug. A remote, unauthenticated, attacker could potentially exploit this vulnerability to extract up to 64 kilobytes of memory per reques...

Fortinet FortiADC 'locale'参数跨站脚本漏洞

Bugtraq ID:66642 CVE ID:CVE-2014-0331 Fortinet FortiADC是一款应用交付控制器。 通过"locale" GET参数传递给/FortiADC/guipartA/的输入在返回用户之前缺少过滤，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 Fortinet FortiADC 3.2.0 Fortinet FortiADC 3.2.1版本已经修复漏洞，建议用户下载使用： http://www.fortiguard.com/...

FortiADC Cross-Site Scripting Vulnerability

...

Fortinet Application/Device Detection

Binary data 8183.prm...

Fortinet Fortiweb HTML注入漏洞(CVE-2014-1458)

BUGTRAQ ID: 65354 CVECAN ID: CVE-2014-1458 FortiGate系列安全产品可检测和消除网络威胁。 Fortinet Fortiweb 5.0.3及其他版本的Web管理接口存在跨站脚本漏洞，可使经过身份验证的远程管理员注入任意Web脚本或HTML。 0 Fortinet FortiWeb 5.0.3 厂商补丁： Fortinet -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.fortinetfirewall.com/index.php...

CVE-2013-7182

Cross-site scripting XSS vulnerability in firewall/schedule/recurrdlg in Fortinet FortiOS 5.0.5 allows remote attackers to inject arbitrary web script or HTML via the mkey parameter...

CVE-2013-7181

Cross-site scripting XSS vulnerability in user/ldapuser/add in Fortinet FortiOS 5.0.3 allows remote attackers to inject arbitrary web script or HTML via the filter parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in firewall/schedule/recurrdlg in Fortinet FortiOS 5.0.5 allows remote attackers to inject arbitrary web script or HTML via the mkey parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in user/ldapuser/add in Fortinet FortiOS 5.0.3 allows remote attackers to inject arbitrary web script or HTML via the filter parameter...

CVE-2013-7182

Cross-site scripting XSS vulnerability in firewall/schedule/recurrdlg in Fortinet FortiOS 5.0.5 allows remote attackers to inject arbitrary web script or HTML via the mkey parameter...

CVE-2013-7182

Fortinet FortiOS FortiGate is affected by CVE-2013-7182 (XSS) in the web UI path /firewall/schedule/recurrdlg, via the mkey parameter. Affected versions are FortiOS 5.0.5 (and prior to 5.0.6 per advisory sources) with a vulnerability that allows remote attackers to inject arbitrary script/HTML in...

CVE-2013-7181

Cross-site scripting XSS vulnerability in user/ldapuser/add in Fortinet FortiOS 5.0.3 allows remote attackers to inject arbitrary web script or HTML via the filter parameter...

CVE-2013-7181

CVE-2013-7181 is a reflected XSS in Fortinet FortiWeb 5.x (notably 5.0.3) via the filter parameter in /user/ldap_user/add. The root cause is inadequate input sanitization of the filter field, enabling arbitrary script execution in the context of an end-user browser. Affected products include Fort...

FortiOS 5.0.5 Cross Site Scripting

I. VULNERABILITY ------------------------- Reflected XSS Attacks vulnerabilities in FortiOS 5.0.5 II. BACKGROUND ------------------------- Fortinet's industry-leading, Network Security Platforms deliver Next Generation Firewall NGFW security with exceptional throughput, ultra low latency, and...

Fortinet Fortiweb 5.0.3 contains a reflected cross-site scripting vulnerability

Overview Fortinet Fortiweb 5.0.3, and possibly earlier versions, contains a cross-site scripting vulnerability. CWE-79 Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' Fortinet Fortiweb 5.0.3, and possibly earlier versions, contains a cross-si...

Fortinet FortiOS 5.0.5 contains a reflected cross-site scripting (XSS) vulnerability

Overview Fortinet FortiOS 5.0.5, and possibly earlier versions, contains a cross-site scripting vulnerability. CWE-79 Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' Fortinet FortiOS 5.0.5, and possibly earlier versions, contains a cross-site...