CVE-2017-14190

A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attacker to inject arbitrary web script or HTML via maliciously crafted "Host" header in user HTTP requests...

Cross site scripting

A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attacker to inject arbitrary web script or HTML via maliciously crafted "Host" header in user HTTP requests...

CVE-2017-14190

A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attacker to inject arbitrary web script or HTML via maliciously crafted "Host" header in user HTTP requests...

CVE-2017-14190

Fortinet FortiOS 5.x is affected by a Cross-site Scripting (XSS) vulnerability exploitable via a crafted Host header in HTTP requests. Affected versions include 5.4.x up to 5.4.7 and 5.6.x up to 5.6.2 (and 5.2 and earlier per sources). The issue stems from inadequate input filtering on the Host h...

CVE-2017-14190

A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attacker to inject arbitrary web script or HTML via maliciously crafted "Host" header in user HTTP requests...

CVE-2017-14190

A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attacker to inject arbitrary web script or HTML via maliciously crafted "Host" header in user HTTP requests...

CVE-2017-14190: Improper Neutralization of Input During Web Page Generation

A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attacker to inject arbitrary web script or HTML via maliciously crafted "Host" header in user HTTP requests...

Fortinet FortiOS Cross-Site Scripting Vulnerability (CNVD-2018-03219)

Fortinet FortiOS is a set of security operating system developed by the U.S. Fiat Fortinet company dedicated to FortiGate network security platform. The system provides users with firewall, antivirus, IPSec/SSL VPN, Web content filtering and anti-spam and other security features. A cross-site...

PT-2018-1712

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 5.6.0 through 5.6.2 Fortinet FortiOS versions 5.4.0 through 5.4.7 Fortinet FortiOS version 5.2 and earlier Description: A Cross-site Scripting issue allows an attacker to inject arbitrary web script or HTML via a...

HTTP Host header attacks against web proxy disclaimer response webpage

The FortiOS web proxy disclaimer page is potentially vulnerable to an XSS attack, via maliciously crafted "Host" headers in user HTTP requests. The latter is possible if an attacker is in a Man-in-the-middle position i.e. able to modify the HTTP requests of the potential victim before they reach...

Information disclosure

An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with superadmin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command...

CVE-2017-7738

An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with superadmin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command...

CVE-2017-7738

An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with superadmin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command...

CVE-2017-7738

Fortinet FortiOS has an information disclosure vulnerability (CVE-2017-7738) affecting FortiOS 5.6.0–5.6.2, 5.4.0–5.4.5, and 5.2 and earlier. An admin with super_admin privileges can view the SSL VPN web portal session info via the fnsysctl CLI, potentially exposing user credentials. Related advi...

CVE-2017-7738

An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with superadmin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command...

CVE-2017-7738

An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with superadmin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command...

CVE-2017-7738: Exposure of Sensitive Information to an Unauthorized Actor

An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with superadmin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command...

PT-2017-3717

Name of the Vulnerable Software and Affected Versions: FortiOS versions 5.4.6 through 5.4.9 FortiOS versions 6.0.0 through 6.0.1 Description: A potential issue exists where an attacker could recover plaintext from encrypted messages or perform a Man-in-the-middle MiTM attack on RSA PKCS 1 v1.5...

PT-2017-3716

Name of the Vulnerable Software and Affected Versions: FortiOS versions 5.4.6 through 5.4.9 FortiOS versions 6.0.0 through 6.0.1 Description: The issue is related to a weakness in the implementation of the TLS protocol in FortiOS, specifically in the encryption algorithm. This weakness can be...

PT-2017-17919

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 5.2 and below Fortinet FortiOS versions 5.4.0 through 5.4.5 Fortinet FortiOS versions 5.6.0 through 5.6.2 Description The issue allows an admin user with super admin privileges to view the current SSL VPN web portal...