CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7362
https://notcve.org/view.php?id=CVE-2015-7362
Fortinet FortiClient Linux SSLVPN before build 2313, when installed on Linux in a home directory that is world readable and executable, allows local users to gain privileges via the helper/subroc setuid program. Fortinet FortiClient Linux SSLVPN en versiones anteriores a build 2313, cuando se instala en Linux en un directorio home que es accesible para lectura y ejecutable por cualquiera, permite a usuarios locales obtener privilegios a través del programa helper/subroc setuid. • http://fortiguard.com/advisory/forticlient-sslvpn-linux-client-local-privilege-escalation-vulnerability http://www.fortiguard.com/advisory/forticlient-sslvpn-linux-client-local-privilege-escalation-vulnerability • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7361
https://notcve.org/view.php?id=CVE-2015-7361
FortiOS 5.2.3, when configured to use High Availability (HA) and the dedicated management interface is enabled, does not require authentication for access to the ZebOS shell on the HA dedicated management interface, which allows remote attackers to obtain shell access via unspecified vectors. FortiOS 5.2.3, cuando se configura para usar High Availability (HA) y la interfaz de administración dedicada está habilitada, no requiere autenticación para el acceso a la shell ZebOS en la interfaz de gestión dedicada HA, lo que permite a atacantes remotos obtener acceso a la shell a través de vectores no especificados. • http://fortiguard.com/advisory/zebos-routing-remote-shell-service-enabled http://www.fortiguard.com/advisory/zebos-routing-remote-shell-service-enabled http://www.securitytracker.com/id/1033093 • CWE-287: Improper Authentication •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2015-8038 – FortiManager 5.2.2 - Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-8038
Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) sharedjobmanager or (2) SOMServiceObjDialog. Múltiples vulnerabilidades de XSS en la Graphical User Interface (GUI) en Fortinet FortiManager en versiones anteriores a 5.2.4 permiten a atacantes remotos inyectar comandos web arbitrarios o HTML a través de (1) sharedjobmanager o (2) SOMServiceObjDialog. FortiManager version 5.2.2 suffers from multiple cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/38316 http://www.fortiguard.com/advisory/multiple-xss-vulnerabilities-in-fortimanager-gui • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2015-8037 – FortiManager 5.2.2 - Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-8037
Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) SOMVpnSSLPortalDialog or (2) FGDMngUpdHistory. Múltiples vulnerabilidades de XSS en la Graphical User Interface (GUI) en Fortinet FortiManager en versiones anteriores a 5.2.4 permiten a atacantes remotos inyectar secuencias de comandos web o HTML a través de (1) SOMVpnSSLPortalDialog o (2) FGDMngUpdHistory. FortiManager version 5.2.2 suffers from multiple cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/38316 http://www.fortiguard.com/advisory/multiple-xss-vulnerabilities-in-fortimanager-gui • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 3CVE-2015-5736 – Fortinet FortiClient 5.2.3 (Windows 10 x64 Creators) - Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2015-5736
The Fortishield.sys driver in Fortinet FortiClient before 5.2.4 allows local users to execute arbitrary code with kernel privileges by setting the callback function in a (1) 0x220024 or (2) 0x220028 ioctl call. Vulnerabilidad en el driver Fortishield.sys en Fortinet FortiClient en versiones anteriores a 5.2.4, permite a usuarios locales ejecutar código arbitrario con privilegios de kernel mediante el establecimiento de la función callback en llamada ioctl en (1) 0x220024 o (2) 0x220028. Fortinet FortiClient version 5.2.3 (Windows 10 x64 Creators) suffers from a local privilege escalation vulnerability. • https://www.exploit-db.com/exploits/45149 https://www.exploit-db.com/exploits/41722 https://www.exploit-db.com/exploits/41721 http://fortiguard.com/advisory/mulitple-vulnerabilities-in-forticlient http://packetstormsecurity.com/files/133398/FortiClient-Antivirus-Information-Exposure-Access-Control.html http://seclists.org/fulldisclosure/2015/Sep/0 http://www.coresecurity.com/advisories/forticlient-antivirus-multiple-vulnerabilities http://www.fortiguard.com/advisory/mulitple-vulnerabilities-in-forticlient http://www&# • CWE-264: Permissions, Privileges, and Access Controls •