CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2017-7733
https://notcve.org/view.php?id=CVE-2017-7733
A Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 and 5.6.0 allows a remote unauthenticated attacker to execute arbitrary javascript code via webUI "Login Disclaimer" redir parameter. Una vulnerabilidad de Cross-Site Scripting (XSS) en Fortinet FortiOS desde la versión 5.4.0 a la 5.4.5 y en la versión 5.6.0 permite que un atacante remoto no autenticado ejecute código JavaScfript arbitrario mediante el parámetro de redirección "Login Disclaimer" en la interfaz gráfica de usuario web. • http://www.securityfocus.com/bid/101563 http://www.securitytracker.com/id/1039677 https://fortiguard.com/psirt/FG-IR-17-113 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2017-7734
https://notcve.org/view.php?id=CVE-2017-7734
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via 'Comments' while saving Config Revisions. Una vulnerabilidad de tipo Cross-Site Scripting en Fortinet FortiOS desde la versión 5.4.0 hasta la 5.4.4 permite que atacantes remotos ejecuten código o comandos sin autorización mediante 'Comments' mientras se guardan revisiones de configuración. • http://www.securityfocus.com/bid/99098 http://www.securitytracker.com/id/1038705 https://fortiguard.com/advisory/FG-IR-17-127 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 17EXPL: 0CVE-2017-7735
https://notcve.org/view.php?id=CVE-2017-7735
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.2.0 through 5.2.11 and 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via the "Groups" input while creating or editing User Groups. Una vulnerabilidad de tipo Cross-Site Scripting en Fortinet FortiOS desde la versión 5.2.0 hasta la 5.2.11 y 5.4.0 hasta la 5.4.4 permite que atacantes remotos ejecuten código o comandos sin autorización mediante la entrada "Groups" al crear o editar grupos de usuarios. • http://www.securityfocus.com/bid/99098 http://www.securitytracker.com/id/1038705 https://fortiguard.com/advisory/FG-IR-17-127 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 32EXPL: 0CVE-2017-3130
https://notcve.org/view.php?id=CVE-2017-3130
An information disclosure vulnerability in Fortinet FortiOS 5.6.0, 5.4.4 and below versions allows attacker to get FortiOS version info by inspecting FortiOS IKE VendorID packets. Una vulnerabilidad de divulgación de información en Fortinet FortiOS 5.6.0, 5.4.4 y versiones inferiores permite que un atacante obtenga la información de la versión de FortiOS mediante la inspección de paquetes FortiOS IKE VendorID. • http://www.securityfocus.com/bid/100211 https://fortiguard.com/advisory/FG-IR-17-073 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 43%CPEs: 6EXPL: 1CVE-2017-3131 – Fortinet FortiOS < 5.6.0 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-3131
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via the filter input in "Applications" under FortiView. Una vulnerabilidad de tipo Cross-Site Scripting en Fortinet FortiOS desde la versión 5.4.0 hasta la 5.4.4 y la versión 5.6.0 permite que atacantes remotos ejecuten código o comandos sin autorización mediante la entrada de filtro en "Applications" en FortiView. FortiOS versions 5.6.0 and below suffer from multiple cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/42388 http://www.securityfocus.com/bid/100009 http://www.securitytracker.com/id/1039020 https://fortiguard.com/advisory/FG-IR-17-104 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •