Fortinet, Inc. vulnerabilities, page 2
41 vulnerabilities
Known vulnerabilities in Fortinet, Inc. products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 19 products.
CVE-2017-7737fortinet, inc.fortinet fortiweb+1
EPSS score1.06%
An information disclosure vulnerability in Fortinet FortiWeb 5.8.2 and below versions allows logged-in admin user to view SNMPv3 user password in cleartext in webui via the HTML source code.CVE-2017-7731fortinet, inc.fortinet fortiportal+1EPSS score1.10%
A weak password recovery vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows attacker to carry out information disclosure via the Forgotten Password feature.CVE-2017-7344fortinet, inc.forticlientwindows+1EPSS score1.85%
A privilege escalation in Fortinet FortiClient Windows 5.4.3 and earlier as well as 5.6.0 allows attacker to gain privilege via exploiting the Windows "security alert" dialog thereby popping up when the "VPN before logon" feature is enabled and an untrusted certificate chain.CVE-2017-7734fortinet, inc.fortinet fortios+1EPSS score0.79%
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via 'Comments' while saving Config Revisions.CVE-2017-7739fortinet, inc.fortios+1EPSS score1.08%
A reflected Cross-site Scripting (XSS) vulnerability in web proxy disclaimer response web pages in Fortinet FortiOS 5.6.0, 5.4.0 to 5.4.5, 5.2.0 to 5.2.11 allows an unauthenticated attacker to inject arbitrary web script or HTML in the context of the victim's browser via sending a maliciously crafted URL to the victim.CVE-2017-7338fortinet, inc.fortinet fortiportal+1EPSS score1.16%
A password management vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to carry out information disclosure via the FortiAnalyzer Management View.CVE-2017-7738fortinet, inc.fortios+1EPSS score1.45%
An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with super_admin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command.CVE-2017-7735fortinet, inc.fortinet fortios+1EPSS score0.79%
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.2.0 through 5.2.11 and 5.4.0 through 5.4.4 allows attackers to execute unauthorized code or commands via the "Groups" input while creating or editing User Groups.CVE-2017-7343fortinet, inc.fortinet fortiportal+1EPSS score0.66%
An open redirect vulnerability in Fortinet FortiPortal 4.0.0 and below allows attacker to execute unauthorized code or commands via the url parameter.CVE-2017-7336fortinet, inc.fortinet fortiwlm+1EPSS score2.46%
A hard-coded account named 'upgrade' in Fortinet FortiWLM 8.3.0 and lower versions allows a remote attacker to log-in and execute commands with 'upgrade' account privileges.CVE-2017-7337fortinet, inc.fortinet fortiportal+1EPSS score1.06%
An improper Access Control vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to interact with unauthorized VDOMs or enumerate other ADOMs via another user's stolen session and CSRF tokens or the adomName parameter in the /fpc/sec/customer/policy/getAdomVersion request.CVE-2017-7736fortinet, inc.fortinet fortiweb+1EPSS score0.33%
A stored Cross-site Scripting (XSS) vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import.CVE-2017-7339fortinet, inc.fortinet fortiportal+1EPSS score0.66%
A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via the 'Name' and 'Description' inputs in the 'Add Revision Backup' functionality.CVE-2017-7342fortinet, inc.fortinet fortiportal+1EPSS score1.25%
A weak password recovery process vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via a hidden Close buttonCVE-2017-3132fortinet, inc.fortinet fortios+1EPSS score8.11%
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or commands via the action input during the activation of a FortiToken.CVE-2017-3133fortinet, inc.fortinet fortios+1EPSS score10.68%
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commands via the Replacement Message HTML for SSL-VPN.CVE-2017-3130fortinet, inc.fortinet fortios+1EPSS score1.45%
An information disclosure vulnerability in Fortinet FortiOS 5.6.0, 5.4.4 and below versions allows attacker to get FortiOS version info by inspecting FortiOS IKE VendorID packets.CVE-2017-3129fortinet, inc.fortinet fortiweb+1EPSS score0.71%
A Cross-Site Scripting vulnerability in Fortinet FortiWeb versions 5.7.1 and below allows attacker to execute unauthorized code or commands via an improperly sanitized POST parameter in the FortiWeb Site Publisher feature.CVE-2017-3126fortinet, inc.fortinet fortianalyzer, fortimanager+2EPSS score0.94%
An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute unauthorized code or commands via the next parameter.CVE-2017-3131fortinet, inc.fortinet fortios+1EPSS score7.68%
A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.4.0 through 5.4.4 and 5.6.0 allows attackers to execute unauthorized code or commands via the filter input in "Applications" under FortiView.