CVE-2016-3978

FortiOS Web UI (Fortinet) is affected by CVE-2016-3978. Affects FortiOS WebUI in 5.0.x prior to 5.0.13, 5.2.x prior to 5.2.3, and 5.4.x prior to 5.4.0. The flaw allows remote attackers to redirect users to arbitrary sites via the redirect parameter to login, enabling phishing or cross-site script...

CVE-2016-3978

The Web User Interface WebUI in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting XSS attacks via the "redirect" parameter to "login."...

Fortinet FortiOS Open Redirect / Cross Site Scripting

Description =================================================================== The FortiOS webui accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. The redirect input parameter is also prone to a cross site scripting. Public Fortinet...

Cisco APIC-EM WebUI Detection

Binary data ciscoapicwebuidetect.nbin...

HomeMatic WebUI Detection

The script sends a HTTP request to the server and attempts to extract the version from the reply. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Mageia: Security Advisory (MGASA-2015-0265)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Google Chrome OS < 43.0.2357.125 Multiple Vulnerabilities

Binary data 8887.prm...

Google Chrome < 43.0.2357.130 Multiple Vulnerabilities

Binary data 8880.pasl...

WebUI 1.5b6 mainfile.php 代码执行

No description provided by source...

Multiple XSS vulnerabilities in FortiSandbox WebUI

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-FORTISANDBOX-0801.txt Vendor: ================================ www.fortinet.com PSIRT ID: 1418018 Product: ================================== FortiSandbox 3000D v2.02...

CVE-2015-3626

Cross-site scripting XSS vulnerability in the DHCP Monitor page in the Web User Interface WebUI in Fortinet FortiOS before 5.2.4 on FortiGate devices allows remote attackers to inject arbitrary web script or HTML via a crafted hostname...

CVE-2015-3626

Summary: CVE-2015-3626 is an XSS flaw in Fortinet FortiOS FortiGate WebUI, specifically the DHCP Monitor page. Affected: FortiOS versions prior to 5.2.4. Cause: insufficient input filtering on the DHCP hostname field allows injection of arbitrary script/HTML. References from NVD/NVD-listed detail...

FortiSandbox 3000D 2.02 build0042 Cross Site Scripting

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-FORTISANDBOX-0801.txt Vendor: ================================ www.fortinet.com PSIRT ID: 1418018 Product: ================================== FortiSandbox 3000D v2.02...

Multiple XSS vulnerabilities in FortiSandbox WebUI

...

WebUI mainfile.php Arbitrary Command Injection

An arbitrary command injection vulnerability exists in WebUI. The vulnerability is due to insufficient validation of multiple parameters in "mainfile.php" when handling HTTP requests. A remote, authenticated attacker can exploit this vulnerability by sending maliciously crafted input to the...

MGASA-2015-0265 Updated chromium-browser package fixes security vulnerability

A scheme validation error in WebUI CVE-2015-1266. Two cross-origin bypass issues in Blink CVE-2015-1267, CVE-2015-1268. A normalization error in the HSTS/HPKP preload list CVE-2015-1269. This update also disables the automatic, silent downloading and installation of "external components" like the...

Google Chrome Security Bypass Vulnerability (CNVD-2015-04100)

Google Chrome is a web browser developed by the American company Google Google. A security vulnerability exists in the content/browser/webui/contentwebuicontrollerfactory.cc file in Google Chrome 43.0.2357.81 and earlier versions, which stems from the program's failure to properly validate a URL...

CVE-2015-1266

CVE-2015-1266 affects Google Chrome prior to 43.0.2357.130. The issue is a scheme validation error in content_browser/webui/content_web_ui_controller_factory.cc that causes Chrome to misclassify WebUI URLs, allowing a remote attacker to bypass access restrictions by using a URL with a different s...

CVE-2015-1266

Removed by vendor...

CVE-2015-1266

content/browser/webui/contentwebuicontrollerfactory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a URL is associated with a WebUI SiteInstance, which allows remote attackers to bypass intended access restrictions via a similar URL, as...