CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2015-8038 – FortiManager 5.2.2 - Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-8038
Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) sharedjobmanager or (2) SOMServiceObjDialog. Múltiples vulnerabilidades de XSS en la Graphical User Interface (GUI) en Fortinet FortiManager en versiones anteriores a 5.2.4 permiten a atacantes remotos inyectar comandos web arbitrarios o HTML a través de (1) sharedjobmanager o (2) SOMServiceObjDialog. FortiManager version 5.2.2 suffers from multiple cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/38316 http://www.fortiguard.com/advisory/multiple-xss-vulnerabilities-in-fortimanager-gui • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2015-8037 – FortiManager 5.2.2 - Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-8037
Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) SOMVpnSSLPortalDialog or (2) FGDMngUpdHistory. Múltiples vulnerabilidades de XSS en la Graphical User Interface (GUI) en Fortinet FortiManager en versiones anteriores a 5.2.4 permiten a atacantes remotos inyectar secuencias de comandos web o HTML a través de (1) SOMVpnSSLPortalDialog o (2) FGDMngUpdHistory. FortiManager version 5.2.2 suffers from multiple cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/38316 http://www.fortiguard.com/advisory/multiple-xss-vulnerabilities-in-fortimanager-gui • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 15EXPL: 2CVE-2015-3620 – Fortinet FortiAnalyzer / FortiManager Cross Site Scripting
https://notcve.org/view.php?id=CVE-2015-3620
Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en la página de los informes de dataset avanzados en Fortinet FortiAnalyzer 5.0.0 hasta 5.0.10 y 5.2.0 hasta 5.2.1 y FortiManager 5.0.3 hasta 5.0.10 y 5.2.0 hasta 5.2.1 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de vectores no especificados. Fortinet FortiAnalyzer and FortiManager suffer from a client-side cross site scripting vulnerability. • http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2015/May/13 http://www.fortiguard.com/advisory/FG-IR-15-005 http://www.securityfocus.com/archive/1/535452/100/0/threaded http://www.securityfocus.com/bid/74646 http://www.securitytracker.com/id/1032262 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2014-2336
https://notcve.org/view.php?id=CVE-2014-2336
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2334 and CVE-2014-2335. Múltiples vulnerabilidades de XSS en la interfaz del usuario de web en Fortinet FortiManager anterior a 5.0.7 y FortiAnalyzer anterior a 5.0.7 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados, una vulnerabilidad diferente a CVE-2014-2334 y CVE-2014-2335. • http://secunia.com/advisories/61309 http://www.fortiguard.com/advisory/FG-IR-14-033 http://www.securityfocus.com/bid/70889 https://exchange.xforce.ibmcloud.com/vulnerabilities/98479 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 1%CPEs: 6EXPL: 0CVE-2005-4570
https://notcve.org/view.php?id=CVE-2005-4570
The Internet Key Exchange version 1 (IKEv1) implementations in Fortinet FortiOS 2.50, 2.80 and 3.0, FortiClient 2.0,; and FortiManager 2.80 and 3.0 allow remote attackers to cause a denial of service (termination of a process that is automatically restarted) via IKE packets with invalid values of certain IPSec attributes, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1. NOTE: due to the lack of details in the vendor advisory, it is unclear which of CVE-2005-3666, CVE-2005-3667, and/or CVE-2005-3668 this issue applies to. • http://secunia.com/advisories/18446 http://www.fortinet.com/FortiGuardCenter/VU226364.html http://www.securityfocus.com/bid/15997 http://www.vupen.com/english/advisories/2006/0182 •