6065 matches found
CVE-2017-7337
An improper Access Control vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to interact with unauthorized VDOMs or enumerate other ADOMs via another user's stolen session and CSRF tokens or the adomName parameter in the /fpc/sec/customer/policy/getAdomVersion...
CVE-2017-3129
CVE-2017-3129 is an XSS vulnerability in Fortinet FortiWeb (Site Publisher) affecting FortiWeb versions 5.7.1 and earlier. It allows an attacker to execute unauthorized code or commands via an improperly sanitized POST parameter. Public references indicate advisories (e.g., FG-IR-17-076) and mult...
CVE-2017-7339
A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via the 'Name' and 'Description' inputs in the 'Add Revision Backup' functionality...
CVE-2017-7338
A password management vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to carry out information disclosure via the FortiAnalyzer Management View...
CVE-2017-7339
CVE-2017-7339 affects Fortinet FortiPortal 4.0.0 and earlier, where a cross-site scripting flaw exists in the Add Revision Backup function via the Name and Description inputs. The vulnerability enables an attacker to inject and execute script in the context of a logged-in user. The connected docu...
CVE-2017-3129
A Cross-Site Scripting vulnerability in Fortinet FortiWeb versions 5.7.1 and below allows attacker to execute unauthorized code or commands via an improperly sanitized POST parameter in the FortiWeb Site Publisher feature...
CVE-2017-3126
An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute unauthorized code or commands via the next parameter...
CVE-2017-7731
The CVE-2017-7731 entry concerns Fortinet FortiPortal, where a weak password recovery vulnerability affects FortiPortal versions 4.0.0 and earlier, enabling information disclosure via the Forgotten Password feature. Per available documents, the issue allows partial confidentiality exposure with n...
CVE-2017-7343
CVE-2017-7343 : The connected documents confirm a vulnerability in Fortinet FortiPortal ≤ 4.0.0 described as an open redirect via the url parameter . This could allow an attacker to cause unauthorized actions by redirecting or manipulating the request, with the NVD entry noting that an attacker c...
CVE-2017-3126
An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute unauthorized code or commands via the next parameter...
CVE-2017-7338
A password management vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to carry out information disclosure via the FortiAnalyzer Management View...
CVE-2017-7343
An open redirect vulnerability in Fortinet FortiPortal 4.0.0 and below allows attacker to execute unauthorized code or commands via the url parameter...
CVE-2017-7337
An improper Access Control vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to interact with unauthorized VDOMs or enumerate other ADOMs via another user's stolen session and CSRF tokens or the adomName parameter in the /fpc/sec/customer/policy/getAdomVersion...
CVE-2017-7731
A weak password recovery vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows attacker to carry out information disclosure via the Forgotten Password feature...
CVE-2017-7731
A weak password recovery vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows attacker to carry out information disclosure via the Forgotten Password feature...
CVE-2017-3134
CVE-2017-3134 affects Fortinet FortiWLC-SD versions 8.2.4 and earlier. The issue is a privilege-escalation flaw where an attacker with admin/superuser privileges can gain shell/root access via the CLI command ‘copy running-config’, attributed to lack of input sanitisation for that command. Connec...
Fortinet FortiOS 5.0.x / 5.2.x < 5.2.11 'global-label' Parameter XSS (FG-IR-17-057)
The version of Fortinet FortiOS running on the remote device is 5.0.x or 5.2.x prior to 5.2.11. It is, therefore, affected by a stored cross-site scripting XSS vulnerability due to improper validation of user-supplied input to the 'global-label' parameter. An authenticated, remote attacker can...
Fortinet FortiWLC-SD Elevation of Privilege Vulnerability
Fortinet FortiWLC-SD is an unlimited router product from Fortinet. An elevation of privilege vulnerability exists in Fortinet FortiWLC-SD. An attacker can exploit this vulnerability to gain root privileges...
