5858 matches found
CVE-2017-12460
Barco ClickShare CSM-1 firmware prior to 1.7.0.3 and CSC-1 firmware prior to 1.10.0.10 are affected. An authenticated user can manage the wallpaper collection via the webUI and, by uploading a wallpaper with a specially crafted name, trigger HTML injection due to non-neutralized output. Impact is...
PT-2017-12560
Name of the Vulnerable Software and Affected Versions Barco ClickShare CSM-1 versions prior to 1.7.0.3 Barco ClickShare CSC-1 versions prior to 1.10.0.10 Description An issue allows an authenticated user to trigger an HTML injection by uploading a wallpaper with a specially crafted name to the...
CVE-2017-12460: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Barco ClickShare CSM-1 firmware before v1.7.0.3 and CSC-1 firmware before v1.10.0.10. An authenticated user can manage the wallpaper collection in the webUI to be shown as background on the ClickShare product. By uploading a wallpaper with a specially crafted name, an...
CVE-2017-7733: Improper Neutralization of Input During Web Page Generation
A Cross-Site-Scripting XSS vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 and 5.6.0 allows a remote unauthenticated attacker to execute arbitrary javascript code via webUI "Login Disclaimer" redir parameter...
CVE-2017-7341
An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, and 8.3.0 through 8.3.2 file management AP script download webUI page allows an authenticated admin user to execute arbitrary system console commands via crafted HTTP requests...
Command injection
An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, and 8.3.0 through 8.3.2 file management AP script download webUI page allows an authenticated admin user to execute arbitrary system console commands via crafted HTTP requests...
CVE-2017-7341
An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, and 8.3.0 through 8.3.2 file management AP script download webUI page allows an authenticated admin user to execute arbitrary system console commands via crafted HTTP requests...
PT-2017-17674
Name of the Vulnerable Software and Affected Versions Fortinet FortiWLC versions 6.1-2 through 6.1-5 Fortinet FortiWLC versions 7.0-7 through 7.0-10 Fortinet FortiWLC versions 8.0 through 8.2 Fortinet FortiWLC versions 8.3.0 through 8.3.2 Description The issue allows an authenticated admin user t...
CVE-2017-7341: Improper Neutralization of Special Elements used in an OS Command
An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5, 7.0-7 through 7.0-10, 8.0 through 8.2, and 8.3.0 through 8.3.2 file management AP script download webUI page allows an authenticated admin user to execute arbitrary system console commands via crafted HTTP requests...
PT-2017-3711
Name of the Vulnerable Software and Affected Versions: FortiOS versions 5.4.0 through 5.4.5 FortiOS version 5.6.0 Description: A Cross-Site-Scripting XSS vulnerability exists in the webUI "Login Disclaimer" redir parameter, allowing a remote unauthenticated attacker to execute arbitrary javascrip...
FortiOS DoS on webUI through 'params' JSON parameter
An authenticated user may pass a specially crafted payload to the 'params' parameter of the JSON web API URLs with /json , which can cause the web user interface to be temporarily unresponsive...
FortiWLC file management OS Command Injection vulnerability
The FortiWLC file management AP script download webUI page is affected by an OS Command Injection vulnerability which may allow an authenticated admin user to execute arbitrary system console commands, and possibly subsequently "root" the device...
FortiWLC XSS injection via crafted HTTP POST request
The FortiWLC admin webUI is affected by XSS vulnerabilities, potentially exploitable by an authenticated user, via non-sanitized parameters "refresh" and "branchtotable" present in HTTP POST requests. A successful attack would involve getting a targeted victim with an open session on the WebUI t...
Information disclosure
An information disclosure vulnerability in Fortinet FortiWeb 5.8.2 and below versions allows logged-in admin user to view SNMPv3 user password in cleartext in webui via the HTML source code...
CVE-2017-7737
An information disclosure vulnerability in Fortinet FortiWeb 5.8.2 and below versions allows logged-in admin user to view SNMPv3 user password in cleartext in webui via the HTML source code...
CVE-2017-7737: Exposure of Sensitive Information to an Unauthorized Actor
An information disclosure vulnerability in Fortinet FortiWeb 5.8.2 and below versions allows logged-in admin user to view SNMPv3 user password in cleartext in webui via the HTML source code...
Fortinet FortiManager Open Redirect Vulnerability (FG-IR-17-014)
Fortinet FortiManager is prone to an open redirect vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
DEBIAN-CVE-2017-11737
interface/js/app/history.js in WebUI in Rspamd before 1.6.3 allows XSS via the Subject and Message-Id headers, which are mishandled in the history page...
