CVSS: 7.5EPSS: 0%CPEs: 32EXPL: 0CVE-2017-3130
https://notcve.org/view.php?id=CVE-2017-3130
An information disclosure vulnerability in Fortinet FortiOS 5.6.0, 5.4.4 and below versions allows attacker to get FortiOS version info by inspecting FortiOS IKE VendorID packets. Una vulnerabilidad de divulgación de información en Fortinet FortiOS 5.6.0, 5.4.4 y versiones inferiores permite que un atacante obtenga la información de la versión de FortiOS mediante la inspección de paquetes FortiOS IKE VendorID. • http://www.securityfocus.com/bid/100211 https://fortiguard.com/advisory/FG-IR-17-073 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 43%CPEs: 6EXPL: 1CVE-2017-3131 – Fortinet FortiOS < 5.6.0 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-3131
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via the filter input in "Applications" under FortiView. Una vulnerabilidad de tipo Cross-Site Scripting en Fortinet FortiOS desde la versión 5.4.0 hasta la 5.4.4 y la versión 5.6.0 permite que atacantes remotos ejecuten código o comandos sin autorización mediante la entrada de filtro en "Applications" en FortiView. FortiOS versions 5.6.0 and below suffer from multiple cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/42388 http://www.securityfocus.com/bid/100009 http://www.securitytracker.com/id/1039020 https://fortiguard.com/advisory/FG-IR-17-104 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-3132 – Fortinet FortiOS < 5.6.0 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-3132
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or commands via the action input during the activation of a FortiToken. Una vulnerabilidad de tipo Cross-Site Scripting en Fortinet FortiOS en su versión 5.6.0 y anteriores permite que atacantes remotos ejecuten código o comandos sin autorización mediante la entrada de acción durante la activación de un FortiToken. FortiOS versions 5.6.0 and below suffer from multiple cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/42388 http://www.securityfocus.com/bid/100009 http://www.securitytracker.com/id/1039020 https://fortiguard.com/advisory/FG-IR-17-104 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-3133 – Fortinet FortiOS < 5.6.0 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-3133
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commands via the Replacement Message HTML for SSL-VPN. Una vulnerabilidad de tipo Cross-Site Scripting en Fortinet FortiOS en su versión 5.6.0 y anteriores permite que atacantes remotos ejecuten código o comandos sin autorización mediante el código HTML de los mensajes de reemplazo para SSL-VPN. FortiOS versions 5.6.0 and below suffer from multiple cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/42388 http://www.securityfocus.com/bid/100009 http://www.securitytracker.com/id/1039020 https://fortiguard.com/advisory/FG-IR-17-104 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 11EXPL: 0CVE-2017-3127
https://notcve.org/view.php?id=CVE-2017-3127
A Cross-Site Scripting vulnerability in Fortinet FortiGate 5.2.0 through 5.2.10 allows attacker to execute unauthorized code or commands via the srcintf parameter during Firewall Policy Creation. Una vulnerabilidad de tipo cross-site-scripting en FortiGate versiones 5.2.0 a 5.2.10 de Fortinet, permite al atacante ejecutar código o comandos no autorizados por medio del parámetro srcintf durante la Creación de Políticas de Firewall. • http://www.securityfocus.com/bid/98048 http://www.securitytracker.com/id/1038367 https://fortiguard.com/psirt/FG-IR-17-017 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •