Vulnerabilites related to fortinet - fortianalyzer_firmware
Vulnerability from fkie_nvd
Published
2016-08-05 14:59
Modified
2024-11-21 02:49
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an image uploaded in the report section.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| fortinet | fortimanager_firmware | 5.0.3 | |
| fortinet | fortimanager_firmware | 5.0.4 | |
| fortinet | fortimanager_firmware | 5.0.5 | |
| fortinet | fortimanager_firmware | 5.0.6 | |
| fortinet | fortimanager_firmware | 5.0.7 | |
| fortinet | fortimanager_firmware | 5.0.8 | |
| fortinet | fortimanager_firmware | 5.0.9 | |
| fortinet | fortimanager_firmware | 5.0.10 | |
| fortinet | fortimanager_firmware | 5.2.0 | |
| fortinet | fortimanager_firmware | 5.2.1 | |
| fortinet | fortimanager_firmware | 5.2.2 | |
| fortinet | fortimanager_firmware | 5.2.3 | |
| fortinet | fortimanager_firmware | 5.2.4 | |
| fortinet | fortimanager_firmware | 5.2.5 | |
| fortinet | fortianalyzer_firmware | 5.0.0 | |
| fortinet | fortianalyzer_firmware | 5.0.1 | |
| fortinet | fortianalyzer_firmware | 5.0.4 | |
| fortinet | fortianalyzer_firmware | 5.0.5 | |
| fortinet | fortianalyzer_firmware | 5.0.10 | |
| fortinet | fortianalyzer_firmware | 5.2.0 | |
| fortinet | fortianalyzer_firmware | 5.2.1 | |
| fortinet | fortianalyzer_firmware | 5.2.2 | |
| fortinet | fortianalyzer_firmware | 5.2.3 | |
| fortinet | fortianalyzer_firmware | 5.2.4 | |
| fortinet | fortianalyzer_firmware | 5.2.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "83ADE078-F9B6-4E46-89AB-F9DE3A2EAF06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A5DF6CBD-E8D8-40B7-9512-CD739D6FA918",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "42304E1B-C9BF-4CCE-A5C7-4FAC7E4C87E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "34B83D3F-23C8-4781-887C-1876B103A4B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "BC2F75CB-BC6D-434A-84C8-6290F4B6E8B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "AB152570-F07F-4706-9717-D31F5F31CDE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C2A3410C-E673-49C1-AA2C-2BD77C68DCA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6AFEA22C-D661-4859-86CE-329D23E3EF87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "72523D47-A6FA-48E8-B2D0-3563027CE35C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7FE6366D-0535-4681-90F7-3AB9386184A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0F5BBE82-1D71-40EE-B506-1DD1066F537C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F1A2A3F2-A908-4192-8032-F8FA3310B50A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0B621447-97C3-42B4-92FF-3D5BEDE26A2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4D281C46-3C6A-4ABA-B25C-1FA623F78566",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9B83E355-BA1A-47B3-AE43-04668C87FD8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4EBA54E4-E824-4F68-94BF-D70F5A51B40F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0C3F75D9-5719-4392-8FDE-DA1CFEE5BEFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "06360B2F-EE21-4E99-9931-E4C62B1D2C25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "C4BA0949-E1B2-41F4-801C-1FF5FDD5FD8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B27A485B-71F5-485C-9F3C-691A4F1CA5A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0E098F02-C9DA-4EC9-B13C-8DFD6735615F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BF465F07-3786-4533-9B61-C8344DCB166F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D43C2347-D6F3-40A6-8E00-DD31F11A84BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A48CA4D3-FBD6-4048-8FFB-C0A874402E1E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4F9636D8-7C3B-4504-9D1C-01AC471EAFAF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an image uploaded in the report section."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en Fortinet FortiAnalyzer 5.x en versiones anteriores a 5.0.12 y 5.2.x en versiones anteriores a 5.2.6 y FortiManager 5.x en versiones anteriores a 5.0.12 y 5.2.x en versiones anteriores a 5.2.6 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del nombre de archivo de una imagen cargada en la secci\u00f3n del informe."
}
],
"id": "CVE-2016-3196",
"lastModified": "2024-11-21T02:49:35.110",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-08-05T14:59:06.547",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://seclists.org/fulldisclosure/2016/Aug/4"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/539069/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92203"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id/1036550"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1036551"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.vulnerability-lab.com/get_content.php?id=1687"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://seclists.org/fulldisclosure/2016/Aug/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/539069/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/92203"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1036550"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1036551"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.vulnerability-lab.com/get_content.php?id=1687"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-07-16 20:29
Modified
2024-11-21 03:18
Severity ?
Summary
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows inject Javascript code and HTML tags through the CN value of CA and CRL certificates via the import CA and CRL certificates feature.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| psirt@fortinet.com | http://www.securitytracker.com/id/1041246 | Third Party Advisory, VDB Entry | |
| psirt@fortinet.com | http://www.securitytracker.com/id/1041247 | Third Party Advisory, VDB Entry | |
| psirt@fortinet.com | https://fortiguard.com/advisory/FG-IR-17-305 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1041246 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securitytracker.com/id/1041247 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://fortiguard.com/advisory/FG-IR-17-305 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| fortinet | fortianalyzer_firmware | * | |
| fortinet | fortianalyzer_firmware | 6.0.0 | |
| fortinet | fortimanager_firmware | * | |
| fortinet | fortimanager_firmware | 6.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "14395CC2-7264-4F1C-BB71-BA70BB97980F",
"versionEndIncluding": "5.6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FC9E13C1-4CEC-45FD-B7BE-207537565BBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DEBC8DBF-8BC5-4DD8-A724-985DE305EA04",
"versionEndIncluding": "5.6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "86E0D6CE-4731-4A1E-BFEE-E57EEF25F63B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows inject Javascript code and HTML tags through the CN value of CA and CRL certificates via the import CA and CRL certificates feature."
},
{
"lang": "es",
"value": "Una vulnerabilidad de Cross-Site Scripting (XSS) en Fortinet FortiManager 6.0.0, 5.6.4 y anteriores y FortiAnalyzer 6.0.0, 5.6.4 y anteriores permite inyectar c\u00f3digo JavaScript y etiquetas HTML mediante el valor CN de los certificados CA y CRL mediante la caracter\u00edstica de importaci\u00f3n de certificados CA y CRL."
}
],
"id": "CVE-2017-17541",
"lastModified": "2024-11-21T03:18:08.103",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-07-16T20:29:00.270",
"references": [
{
"source": "psirt@fortinet.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1041246"
},
{
"source": "psirt@fortinet.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1041247"
},
{
"source": "psirt@fortinet.com",
"tags": [
"Vendor Advisory"
],
"url": "https://fortiguard.com/advisory/FG-IR-17-305"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1041246"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1041247"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://fortiguard.com/advisory/FG-IR-17-305"
}
],
"sourceIdentifier": "psirt@fortinet.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-05-27 00:29
Modified
2024-11-21 03:24
Severity ?
Summary
An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute unauthorized code or commands via the next parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| fortinet | fortianalyzer_firmware | 5.4.0 | |
| fortinet | fortianalyzer_firmware | 5.4.1 | |
| fortinet | fortianalyzer_firmware | 5.4.2 | |
| fortinet | fortimanager_firmware | 5.4.0 | |
| fortinet | fortimanager_firmware | 5.4.1 | |
| fortinet | fortimanager_firmware | 5.4.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EC123643-C9EE-40BF-B6F5-CE942F0A474E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EDBCBC4B-ECCB-467D-8CB1-D017C5DCB3D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B9CD11DF-36F4-4761-92AC-5F01F965B02A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7C235585-4228-43B3-B2BB-06563B67F9E7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B760F3B0-C81A-4B53-8D1E-384834D4A594",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "43BF2F41-32BB-4C64-A9A2-62FB61B7D318",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute unauthorized code or commands via the next parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de Redireccionamiento Abierto en FortiAnalyzer versiones desde 5.4.0 hasta 5.4.2 y FortiManager versiones desde 5.4.0 hasta 5.4.2 de Fortinet, permite a un atacante ejecutar c\u00f3digo o comandos no autorizados por medio del par\u00e1metro next."
}
],
"id": "CVE-2017-3126",
"lastModified": "2024-11-21T03:24:53.160",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-05-27T00:29:00.973",
"references": [
{
"source": "psirt@fortinet.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/98557"
},
{
"source": "psirt@fortinet.com",
"url": "http://www.securitytracker.com/id/1038539"
},
{
"source": "psirt@fortinet.com",
"url": "http://www.securitytracker.com/id/1038540"
},
{
"source": "psirt@fortinet.com",
"tags": [
"Vendor Advisory"
],
"url": "https://fortiguard.com/psirt/FG-IR-17-014"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/98557"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1038539"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1038540"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://fortiguard.com/psirt/FG-IR-17-014"
}
],
"sourceIdentifier": "psirt@fortinet.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-601"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-11-20 14:12
Modified
2024-11-21 01:59
Severity ?
Summary
cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrf_token parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| fortinet | fortianalyzer_firmware | * | |
| fortinet | fortianalyzer-1000d | - | |
| fortinet | fortianalyzer-2000b | - | |
| fortinet | fortianalyzer-200d | - | |
| fortinet | fortianalyzer-3000d | - | |
| fortinet | fortianalyzer-300d | - | |
| fortinet | fortianalyzer-4000b | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "93A2AD3B-02DC-48AC-9A76-7CB8854E52C1",
"versionEndIncluding": "5.0.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:fortinet:fortianalyzer-1000d:-:*:*:*:*:*:*:*",
"matchCriteriaId": "646FBB7D-FB82-491E-8C03-E0D129B7A040",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:fortinet:fortianalyzer-2000b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8C066180-4970-46F3-86E5-EFE53FBE58FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:fortinet:fortianalyzer-200d:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F4962F12-7C53-4BAD-B6BD-A478AC398A84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:fortinet:fortianalyzer-3000d:-:*:*:*:*:*:*:*",
"matchCriteriaId": "73A52694-D20A-4D42-B33F-3C7623BF800B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:fortinet:fortianalyzer-300d:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9FCB9155-75A9-413C-B660-DD21D52F889A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:fortinet:fortianalyzer-4000b:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BA710178-3B33-44FA-8560-08CC0362188E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrf_token parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks."
},
{
"lang": "es",
"value": "cgi-bin/module/sysmanager/admin/SYSAdminUserDialog en Fortinet FortiAnalyzer anterior a la versi\u00f3n 5.0.5 no valida adecuadamente el par\u00e1metro csrf_token, lo que permite a atacantes remotos realizar ataques de CSRF."
}
],
"id": "CVE-2013-6826",
"lastModified": "2024-11-21T01:59:47.160",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-11-20T14:12:31.070",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.com/files/123980/fortianalyzer-xsrf.txt"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/63663"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.com/files/123980/fortianalyzer-xsrf.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/63663"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-10-31 14:55
Modified
2024-11-21 02:06
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| fortinet | fortianalyzer_firmware | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABDA1EDD-39A5-43F8-8C65-989A2BFD45EA",
"versionEndIncluding": "5.0.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en la interfaz del usuario de web en Fortinet FortiAnalyzer anterior a 5.0.7 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de vectores no especificados, una vulnerabilidad diferente a CVE-2014-2336."
}
],
"id": "CVE-2014-2334",
"lastModified": "2024-11-21T02:06:06.153",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-10-31T14:55:02.797",
"references": [
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/61309"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.fortiguard.com/advisory/FG-IR-14-033/"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/70887"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98477"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/61309"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.fortiguard.com/advisory/FG-IR-14-033/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/70887"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98477"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2015-05-12 19:59
Modified
2024-11-21 02:29
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| fortinet | fortimanager_firmware | 5.0.3 | |
| fortinet | fortimanager_firmware | 5.0.4 | |
| fortinet | fortimanager_firmware | 5.0.5 | |
| fortinet | fortimanager_firmware | 5.0.6 | |
| fortinet | fortimanager_firmware | 5.0.7 | |
| fortinet | fortimanager_firmware | 5.0.8 | |
| fortinet | fortimanager_firmware | 5.0.9 | |
| fortinet | fortimanager_firmware | 5.0.10 | |
| fortinet | fortimanager_firmware | 5.2.0 | |
| fortinet | fortimanager_firmware | 5.2.1 | |
| fortinet | fortianalyzer_firmware | 5.0.0 | |
| fortinet | fortianalyzer_firmware | 5.0.1 | |
| fortinet | fortianalyzer_firmware | 5.0.10 | |
| fortinet | fortianalyzer_firmware | 5.2.0 | |
| fortinet | fortianalyzer_firmware | 5.2.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "83ADE078-F9B6-4E46-89AB-F9DE3A2EAF06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A5DF6CBD-E8D8-40B7-9512-CD739D6FA918",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "42304E1B-C9BF-4CCE-A5C7-4FAC7E4C87E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "34B83D3F-23C8-4781-887C-1876B103A4B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "BC2F75CB-BC6D-434A-84C8-6290F4B6E8B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "AB152570-F07F-4706-9717-D31F5F31CDE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C2A3410C-E673-49C1-AA2C-2BD77C68DCA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6AFEA22C-D661-4859-86CE-329D23E3EF87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "72523D47-A6FA-48E8-B2D0-3563027CE35C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7FE6366D-0535-4681-90F7-3AB9386184A2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9B83E355-BA1A-47B3-AE43-04668C87FD8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4EBA54E4-E824-4F68-94BF-D70F5A51B40F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "C4BA0949-E1B2-41F4-801C-1FF5FDD5FD8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B27A485B-71F5-485C-9F3C-691A4F1CA5A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0E098F02-C9DA-4EC9-B13C-8DFD6735615F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en la p\u00e1gina de los informes de dataset avanzados en Fortinet FortiAnalyzer 5.0.0 hasta 5.0.10 y 5.2.0 hasta 5.2.1 y FortiManager 5.0.3 hasta 5.0.10 y 5.2.0 hasta 5.2.1 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2015-3620",
"lastModified": "2024-11-21T02:29:29.827",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2015-05-12T19:59:23.043",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://seclists.org/fulldisclosure/2015/May/13"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.fortiguard.com/advisory/FG-IR-15-005/"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/535452/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/74646"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1032262"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://seclists.org/fulldisclosure/2015/May/13"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.fortiguard.com/advisory/FG-IR-15-005/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/535452/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/74646"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1032262"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-10-31 14:55
Modified
2024-11-21 02:06
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2334 and CVE-2014-2335.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| fortinet | fortimanager | * | |
| fortinet | fortianalyzer_firmware | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:fortinet:fortimanager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "753B3D8D-B699-4F54-B8D7-0F2938CA1812",
"versionEndIncluding": "5.0.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABDA1EDD-39A5-43F8-8C65-989A2BFD45EA",
"versionEndIncluding": "5.0.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2334 and CVE-2014-2335."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en la interfaz del usuario de web en Fortinet FortiManager anterior a 5.0.7 y FortiAnalyzer anterior a 5.0.7 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de vectores no especificados, una vulnerabilidad diferente a CVE-2014-2334 y CVE-2014-2335."
}
],
"id": "CVE-2014-2336",
"lastModified": "2024-11-21T02:06:06.430",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-10-31T14:55:02.907",
"references": [
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/61309"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.fortiguard.com/advisory/FG-IR-14-033/"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/70889"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98479"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/61309"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.fortiguard.com/advisory/FG-IR-14-033/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/70889"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98479"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-08-19 21:59
Modified
2024-11-21 02:49
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the address added page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "833C89CE-43F0-4F6E-8A4F-504EA5F16319",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C96F78B0-2F6E-4A28-B0B8-CCE3638DCCDC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "68D3536B-652C-4642-9FF9-5A7CFDBB7DD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "83ADE078-F9B6-4E46-89AB-F9DE3A2EAF06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A5DF6CBD-E8D8-40B7-9512-CD739D6FA918",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "42304E1B-C9BF-4CCE-A5C7-4FAC7E4C87E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "34B83D3F-23C8-4781-887C-1876B103A4B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "BC2F75CB-BC6D-434A-84C8-6290F4B6E8B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "AB152570-F07F-4706-9717-D31F5F31CDE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C2A3410C-E673-49C1-AA2C-2BD77C68DCA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6AFEA22C-D661-4859-86CE-329D23E3EF87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7D9B23B1-A527-49B6-A6CB-CFFCF278B70E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "72523D47-A6FA-48E8-B2D0-3563027CE35C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7FE6366D-0535-4681-90F7-3AB9386184A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0F5BBE82-1D71-40EE-B506-1DD1066F537C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F1A2A3F2-A908-4192-8032-F8FA3310B50A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0B621447-97C3-42B4-92FF-3D5BEDE26A2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4D281C46-3C6A-4ABA-B25C-1FA623F78566",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9B83E355-BA1A-47B3-AE43-04668C87FD8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "378DE593-6514-4111-95DF-C881E163E6D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BEAD4CF6-6654-4BCC-8EC4-5B11AF81C123",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0C3F75D9-5719-4392-8FDE-DA1CFEE5BEFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "06360B2F-EE21-4E99-9931-E4C62B1D2C25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "8FEC6473-536E-4ADB-9BD1-8A75846A039E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "799DA4F4-F5DD-4D56-ACC0-C28891C27A57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "8AD6F2AF-F98F-4113-94D8-1F3D26702D82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "647BBA50-058A-4D8D-884A-83A818B90622",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "C4BA0949-E1B2-41F4-801C-1FF5FDD5FD8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "042001D0-4E10-488F-AB01-AFEB23D78C01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "728F1AAE-6156-443B-A5DA-990538432389",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B27A485B-71F5-485C-9F3C-691A4F1CA5A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0E098F02-C9DA-4EC9-B13C-8DFD6735615F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BF465F07-3786-4533-9B61-C8344DCB166F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D43C2347-D6F3-40A6-8E00-DD31F11A84BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A48CA4D3-FBD6-4048-8FFB-C0A874402E1E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4F9636D8-7C3B-4504-9D1C-01AC471EAFAF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the address added page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en la p\u00e1gina de direcci\u00f3n de agregado en Fortinet FortiManager 5.x en versiones anteriores a 5.0.12 y 5.2.x en versiones anteriores a 5.2.6 y FortiAnalyzer 5.x en versiones anteriores a 5.0.13 y 5.2.x en versiones anteriores a 5.2.6 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2016-3194",
"lastModified": "2024-11-21T02:49:34.803",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-08-19T21:59:06.430",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-xss-vulnerability"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/92456"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id/1036550"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-xss-vulnerability"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/92456"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1036550"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-10-31 14:55
Modified
2024-11-21 02:06
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| fortinet | fortianalyzer_firmware | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABDA1EDD-39A5-43F8-8C65-989A2BFD45EA",
"versionEndIncluding": "5.0.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en la interfaz del usuario de web en Fortinet FortiManager anterior a 5.0.7 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de vectores no especificados, una vulnerabilidad diferente a CVE-2014-2336."
}
],
"id": "CVE-2014-2335",
"lastModified": "2024-11-21T02:06:06.290",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-10-31T14:55:02.860",
"references": [
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/61309"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.fortiguard.com/advisory/FG-IR-14-033/"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98478"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/61309"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.fortiguard.com/advisory/FG-IR-14-033/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98478"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-08-19 21:59
Modified
2024-11-21 02:49
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Web-UI in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "833C89CE-43F0-4F6E-8A4F-504EA5F16319",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C96F78B0-2F6E-4A28-B0B8-CCE3638DCCDC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "68D3536B-652C-4642-9FF9-5A7CFDBB7DD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "83ADE078-F9B6-4E46-89AB-F9DE3A2EAF06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A5DF6CBD-E8D8-40B7-9512-CD739D6FA918",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "42304E1B-C9BF-4CCE-A5C7-4FAC7E4C87E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "34B83D3F-23C8-4781-887C-1876B103A4B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "BC2F75CB-BC6D-434A-84C8-6290F4B6E8B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "AB152570-F07F-4706-9717-D31F5F31CDE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C2A3410C-E673-49C1-AA2C-2BD77C68DCA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6AFEA22C-D661-4859-86CE-329D23E3EF87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7D9B23B1-A527-49B6-A6CB-CFFCF278B70E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "72523D47-A6FA-48E8-B2D0-3563027CE35C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7FE6366D-0535-4681-90F7-3AB9386184A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0F5BBE82-1D71-40EE-B506-1DD1066F537C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F1A2A3F2-A908-4192-8032-F8FA3310B50A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0B621447-97C3-42B4-92FF-3D5BEDE26A2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4D281C46-3C6A-4ABA-B25C-1FA623F78566",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9B83E355-BA1A-47B3-AE43-04668C87FD8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "378DE593-6514-4111-95DF-C881E163E6D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BEAD4CF6-6654-4BCC-8EC4-5B11AF81C123",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0C3F75D9-5719-4392-8FDE-DA1CFEE5BEFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "06360B2F-EE21-4E99-9931-E4C62B1D2C25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "8FEC6473-536E-4ADB-9BD1-8A75846A039E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "799DA4F4-F5DD-4D56-ACC0-C28891C27A57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "8AD6F2AF-F98F-4113-94D8-1F3D26702D82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "647BBA50-058A-4D8D-884A-83A818B90622",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "C4BA0949-E1B2-41F4-801C-1FF5FDD5FD8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "042001D0-4E10-488F-AB01-AFEB23D78C01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "728F1AAE-6156-443B-A5DA-990538432389",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B27A485B-71F5-485C-9F3C-691A4F1CA5A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0E098F02-C9DA-4EC9-B13C-8DFD6735615F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BF465F07-3786-4533-9B61-C8344DCB166F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D43C2347-D6F3-40A6-8E00-DD31F11A84BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A48CA4D3-FBD6-4048-8FFB-C0A874402E1E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4F9636D8-7C3B-4504-9D1C-01AC471EAFAF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Web-UI in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en la Web-UI en Fortinet FortiManager 5.x en versiones anteriores a 5.0.12 y 5.2.x en versiones anteriores a 5.2.6 y FortiAnalyzer 5.x en versiones anteriores a 5.0.13 y 5.2.x en versiones anteriores a 5.2.6 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2016-3195",
"lastModified": "2024-11-21T02:49:34.957",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-08-19T21:59:07.430",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-client-side-xss-vulnerability"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/92453"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id/1036550"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-client-side-xss-vulnerability"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/92453"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1036550"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-08-19 21:59
Modified
2024-11-21 02:49
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the appliance web-application in Fortinet FortiManager 5.x before 5.0.12, 5.2.x before 5.2.6, and 5.4.x before 5.4.1 and FortiAnalyzer 5.x before 5.0.13, 5.2.x before 5.2.6, and 5.4.x before 5.4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "833C89CE-43F0-4F6E-8A4F-504EA5F16319",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C96F78B0-2F6E-4A28-B0B8-CCE3638DCCDC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "68D3536B-652C-4642-9FF9-5A7CFDBB7DD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "83ADE078-F9B6-4E46-89AB-F9DE3A2EAF06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A5DF6CBD-E8D8-40B7-9512-CD739D6FA918",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "42304E1B-C9BF-4CCE-A5C7-4FAC7E4C87E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "34B83D3F-23C8-4781-887C-1876B103A4B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "BC2F75CB-BC6D-434A-84C8-6290F4B6E8B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "AB152570-F07F-4706-9717-D31F5F31CDE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C2A3410C-E673-49C1-AA2C-2BD77C68DCA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6AFEA22C-D661-4859-86CE-329D23E3EF87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7D9B23B1-A527-49B6-A6CB-CFFCF278B70E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "72523D47-A6FA-48E8-B2D0-3563027CE35C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7FE6366D-0535-4681-90F7-3AB9386184A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0F5BBE82-1D71-40EE-B506-1DD1066F537C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F1A2A3F2-A908-4192-8032-F8FA3310B50A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0B621447-97C3-42B4-92FF-3D5BEDE26A2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4D281C46-3C6A-4ABA-B25C-1FA623F78566",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7C235585-4228-43B3-B2BB-06563B67F9E7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9B83E355-BA1A-47B3-AE43-04668C87FD8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "378DE593-6514-4111-95DF-C881E163E6D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BEAD4CF6-6654-4BCC-8EC4-5B11AF81C123",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0C3F75D9-5719-4392-8FDE-DA1CFEE5BEFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "06360B2F-EE21-4E99-9931-E4C62B1D2C25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "8FEC6473-536E-4ADB-9BD1-8A75846A039E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "799DA4F4-F5DD-4D56-ACC0-C28891C27A57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "8AD6F2AF-F98F-4113-94D8-1F3D26702D82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "647BBA50-058A-4D8D-884A-83A818B90622",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "C4BA0949-E1B2-41F4-801C-1FF5FDD5FD8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "042001D0-4E10-488F-AB01-AFEB23D78C01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "728F1AAE-6156-443B-A5DA-990538432389",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B27A485B-71F5-485C-9F3C-691A4F1CA5A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0E098F02-C9DA-4EC9-B13C-8DFD6735615F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BF465F07-3786-4533-9B61-C8344DCB166F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D43C2347-D6F3-40A6-8E00-DD31F11A84BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A48CA4D3-FBD6-4048-8FFB-C0A874402E1E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4F9636D8-7C3B-4504-9D1C-01AC471EAFAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EC123643-C9EE-40BF-B6F5-CE942F0A474E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the appliance web-application in Fortinet FortiManager 5.x before 5.0.12, 5.2.x before 5.2.6, and 5.4.x before 5.4.1 and FortiAnalyzer 5.x before 5.0.13, 5.2.x before 5.2.6, and 5.4.x before 5.4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en la aplicaci\u00f3n web del dispositivo en Fortinet FortiManager 5.x en versiones anteriores a 5.0.12, 5.2.x en versiones anteriores a 5.2.6 y 5.4.x en versiones anteriores a 5.4.1 y FortiAnalyzer 5.x en versiones anteriores a 5.0.13, 5.2.x en versiones anteriores a 5.2.6 y 5.4.x en versiones anteriores a 5.4.1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2016-3193",
"lastModified": "2024-11-21T02:49:34.657",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-08-19T21:59:05.463",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability-1"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/92458"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id/1036550"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/92458"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1036550"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-10-07 14:59
Modified
2024-11-21 02:36
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3 allows remote administrators to inject arbitrary web script or HTML via vectors related to report filters.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "833C89CE-43F0-4F6E-8A4F-504EA5F16319",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C96F78B0-2F6E-4A28-B0B8-CCE3638DCCDC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "68D3536B-652C-4642-9FF9-5A7CFDBB7DD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "83ADE078-F9B6-4E46-89AB-F9DE3A2EAF06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A5DF6CBD-E8D8-40B7-9512-CD739D6FA918",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "42304E1B-C9BF-4CCE-A5C7-4FAC7E4C87E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "34B83D3F-23C8-4781-887C-1876B103A4B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "BC2F75CB-BC6D-434A-84C8-6290F4B6E8B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "AB152570-F07F-4706-9717-D31F5F31CDE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "C2A3410C-E673-49C1-AA2C-2BD77C68DCA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6AFEA22C-D661-4859-86CE-329D23E3EF87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "7D9B23B1-A527-49B6-A6CB-CFFCF278B70E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "72523D47-A6FA-48E8-B2D0-3563027CE35C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortimanager_firmware:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7FE6366D-0535-4681-90F7-3AB9386184A2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:fortinet:fortimanager:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0A46415B-E9D2-463D-AE16-D51DEEC23690",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9B83E355-BA1A-47B3-AE43-04668C87FD8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4EBA54E4-E824-4F68-94BF-D70F5A51B40F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "378DE593-6514-4111-95DF-C881E163E6D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BEAD4CF6-6654-4BCC-8EC4-5B11AF81C123",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0C3F75D9-5719-4392-8FDE-DA1CFEE5BEFD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "06360B2F-EE21-4E99-9931-E4C62B1D2C25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "8FEC6473-536E-4ADB-9BD1-8A75846A039E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "799DA4F4-F5DD-4D56-ACC0-C28891C27A57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "8AD6F2AF-F98F-4113-94D8-1F3D26702D82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "647BBA50-058A-4D8D-884A-83A818B90622",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "C4BA0949-E1B2-41F4-801C-1FF5FDD5FD8A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "042001D0-4E10-488F-AB01-AFEB23D78C01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "728F1AAE-6156-443B-A5DA-990538432389",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B27A485B-71F5-485C-9F3C-691A4F1CA5A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0E098F02-C9DA-4EC9-B13C-8DFD6735615F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fortinet:fortianalyzer_firmware:5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BF465F07-3786-4533-9B61-C8344DCB166F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:fortinet:fortianalyzer:-:*:*:*:*:*:*:*",
"matchCriteriaId": "156CCFE2-8ED2-417E-8A32-C3AB1DD97C8B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3 allows remote administrators to inject arbitrary web script or HTML via vectors related to report filters."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en la p\u00e1gina de configuraci\u00f3n avanzada en Fortinet FortiManager 5.x en versiones anteriores a 5.0.12 y 5.2.x en versiones anteriores a 5.2.3, en los modelos de hardware con un disco duro y FortiAnalyzer 5.x en versiones anteriores a 5.0.13 y 5.2.x en versiones anteriores a 5.2.3 permite a administradores remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de vectores relacionados con filtros de informe."
}
],
"id": "CVE-2015-7363",
"lastModified": "2024-11-21T02:36:39.297",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-10-07T14:59:02.677",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://fortiguard.com/advisory/fortianalyzer-and-fortimanager-stored-xss-vulnerability-in-report-filters"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/93413"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id/1036981"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id/1036982"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://fortiguard.com/advisory/fortianalyzer-and-fortimanager-stored-xss-vulnerability-in-report-filters"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/93413"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1036981"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id/1036982"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
cve-2017-17541
Vulnerability from cvelistv5
Published
2018-07-16 20:00
Modified
2024-10-25 14:08
Severity ?
EPSS score ?
Summary
A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows inject Javascript code and HTML tags through the CN value of CA and CRL certificates via the import CA and CRL certificates feature.
References
| ▼ | URL | Tags |
|---|---|---|
| https://fortiguard.com/advisory/FG-IR-17-305 | x_refsource_CONFIRM | |
| http://www.securitytracker.com/id/1041246 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securitytracker.com/id/1041247 | vdb-entry, x_refsource_SECTRACK |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Fortinet | Fortinet FortiManager, FortiAnalyzer |
Version: FortiManager 6.0.0, 5.6.4 and below versions; FortiAnalyzer 6.0.0, 5.6.4 and below versions |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:51:32.239Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://fortiguard.com/advisory/FG-IR-17-305"
},
{
"name": "1041246",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1041246"
},
{
"name": "1041247",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1041247"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2017-17541",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-23T14:00:14.644167Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-25T14:08:48.618Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Fortinet FortiManager, FortiAnalyzer",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "FortiManager 6.0.0, 5.6.4 and below versions; FortiAnalyzer 6.0.0, 5.6.4 and below versions"
}
]
}
],
"datePublic": "2018-07-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows inject Javascript code and HTML tags through the CN value of CA and CRL certificates via the import CA and CRL certificates feature."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-17T09:57:01",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://fortiguard.com/advisory/FG-IR-17-305"
},
{
"name": "1041246",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1041246"
},
{
"name": "1041247",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1041247"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@fortinet.com",
"ID": "CVE-2017-17541",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Fortinet FortiManager, FortiAnalyzer",
"version": {
"version_data": [
{
"version_value": "FortiManager 6.0.0, 5.6.4 and below versions; FortiAnalyzer 6.0.0, 5.6.4 and below versions"
}
]
}
}
]
},
"vendor_name": "Fortinet"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows inject Javascript code and HTML tags through the CN value of CA and CRL certificates via the import CA and CRL certificates feature."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Execute unauthorized code or commands"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://fortiguard.com/advisory/FG-IR-17-305",
"refsource": "CONFIRM",
"url": "https://fortiguard.com/advisory/FG-IR-17-305"
},
{
"name": "1041246",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1041246"
},
{
"name": "1041247",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1041247"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2017-17541",
"datePublished": "2018-07-16T20:00:00",
"dateReserved": "2017-12-11T00:00:00",
"dateUpdated": "2024-10-25T14:08:48.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-3195
Vulnerability from cvelistv5
Published
2016-08-19 21:00
Modified
2024-08-05 23:47
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the Web-UI in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securitytracker.com/id/1036550 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securityfocus.com/bid/92453 | vdb-entry, x_refsource_BID | |
| http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-client-side-xss-vulnerability | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:47:59.053Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1036550",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1036550"
},
{
"name": "92453",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92453"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-client-side-xss-vulnerability"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-08-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Web-UI in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-15T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1036550",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1036550"
},
{
"name": "92453",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92453"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-client-side-xss-vulnerability"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-3195",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the Web-UI in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1036550",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1036550"
},
{
"name": "92453",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92453"
},
{
"name": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-client-side-xss-vulnerability",
"refsource": "CONFIRM",
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-client-side-xss-vulnerability"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-3195",
"datePublished": "2016-08-19T21:00:00",
"dateReserved": "2016-03-15T00:00:00",
"dateUpdated": "2024-08-05T23:47:59.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-3194
Vulnerability from cvelistv5
Published
2016-08-19 21:00
Modified
2024-08-05 23:47
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the address added page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securitytracker.com/id/1036550 | vdb-entry, x_refsource_SECTRACK | |
| http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-xss-vulnerability | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/92456 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:47:59.063Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1036550",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1036550"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-xss-vulnerability"
},
{
"name": "92456",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92456"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-08-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the address added page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-15T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1036550",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1036550"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-xss-vulnerability"
},
{
"name": "92456",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92456"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-3194",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the address added page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1036550",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1036550"
},
{
"name": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-xss-vulnerability",
"refsource": "CONFIRM",
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-xss-vulnerability"
},
{
"name": "92456",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92456"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-3194",
"datePublished": "2016-08-19T21:00:00",
"dateReserved": "2016-03-15T00:00:00",
"dateUpdated": "2024-08-05T23:47:59.063Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2015-3620
Vulnerability from cvelistv5
Published
2015-05-12 19:00
Modified
2024-08-06 05:47
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.fortiguard.com/advisory/FG-IR-15-005/ | x_refsource_CONFIRM | |
| http://seclists.org/fulldisclosure/2015/May/13 | mailing-list, x_refsource_FULLDISC | |
| http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.html | x_refsource_MISC | |
| http://www.securityfocus.com/archive/1/535452/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/bid/74646 | vdb-entry, x_refsource_BID | |
| http://www.securitytracker.com/id/1032262 | vdb-entry, x_refsource_SECTRACK |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T05:47:57.762Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.fortiguard.com/advisory/FG-IR-15-005/"
},
{
"name": "20150505 Fortinet FortiAnalyzer \u0026 FortiManager - Client Side Cross Site Scripting Vulnerability",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2015/May/13"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.html"
},
{
"name": "20150505 Fortinet FortiAnalyzer \u0026 FortiManager - Client Side Cross Site Scripting Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/535452/100/0/threaded"
},
{
"name": "74646",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/74646"
},
{
"name": "1032262",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1032262"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2015-02-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.fortiguard.com/advisory/FG-IR-15-005/"
},
{
"name": "20150505 Fortinet FortiAnalyzer \u0026 FortiManager - Client Side Cross Site Scripting Vulnerability",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2015/May/13"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.html"
},
{
"name": "20150505 Fortinet FortiAnalyzer \u0026 FortiManager - Client Side Cross Site Scripting Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/535452/100/0/threaded"
},
{
"name": "74646",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/74646"
},
{
"name": "1032262",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1032262"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-3620",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.fortiguard.com/advisory/FG-IR-15-005/",
"refsource": "CONFIRM",
"url": "http://www.fortiguard.com/advisory/FG-IR-15-005/"
},
{
"name": "20150505 Fortinet FortiAnalyzer \u0026 FortiManager - Client Side Cross Site Scripting Vulnerability",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2015/May/13"
},
{
"name": "http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/131766/Fortinet-FortiAnalyzer-FortiManager-Cross-Site-Scripting.html"
},
{
"name": "20150505 Fortinet FortiAnalyzer \u0026 FortiManager - Client Side Cross Site Scripting Vulnerability",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/535452/100/0/threaded"
},
{
"name": "74646",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/74646"
},
{
"name": "1032262",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1032262"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-3620",
"datePublished": "2015-05-12T19:00:00",
"dateReserved": "2015-04-30T00:00:00",
"dateUpdated": "2024-08-06T05:47:57.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-2334
Vulnerability from cvelistv5
Published
2014-10-31 14:00
Modified
2024-08-06 10:14
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.fortiguard.com/advisory/FG-IR-14-033/ | x_refsource_CONFIRM | |
| http://secunia.com/advisories/61309 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/98477 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/70887 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:14:25.155Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.fortiguard.com/advisory/FG-IR-14-033/"
},
{
"name": "61309",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/61309"
},
{
"name": "fortimanageranalyzer-cve20142334-xss(98477)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98477"
},
{
"name": "70887",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/70887"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-10-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.fortiguard.com/advisory/FG-IR-14-033/"
},
{
"name": "61309",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/61309"
},
{
"name": "fortimanageranalyzer-cve20142334-xss(98477)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98477"
},
{
"name": "70887",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/70887"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-2334",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.fortiguard.com/advisory/FG-IR-14-033/",
"refsource": "CONFIRM",
"url": "http://www.fortiguard.com/advisory/FG-IR-14-033/"
},
{
"name": "61309",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/61309"
},
{
"name": "fortimanageranalyzer-cve20142334-xss(98477)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98477"
},
{
"name": "70887",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/70887"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-2334",
"datePublished": "2014-10-31T14:00:00",
"dateReserved": "2014-03-12T00:00:00",
"dateUpdated": "2024-08-06T10:14:25.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-2336
Vulnerability from cvelistv5
Published
2014-10-31 14:00
Modified
2024-08-06 10:14
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2334 and CVE-2014-2335.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.fortiguard.com/advisory/FG-IR-14-033/ | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/70889 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/61309 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/98479 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:14:25.153Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.fortiguard.com/advisory/FG-IR-14-033/"
},
{
"name": "70889",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/70889"
},
{
"name": "61309",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/61309"
},
{
"name": "fortimanageranalyzer-cve20142336-xss(98479)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98479"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-10-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2334 and CVE-2014-2335."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.fortiguard.com/advisory/FG-IR-14-033/"
},
{
"name": "70889",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/70889"
},
{
"name": "61309",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/61309"
},
{
"name": "fortimanageranalyzer-cve20142336-xss(98479)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98479"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-2336",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2334 and CVE-2014-2335."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.fortiguard.com/advisory/FG-IR-14-033/",
"refsource": "CONFIRM",
"url": "http://www.fortiguard.com/advisory/FG-IR-14-033/"
},
{
"name": "70889",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/70889"
},
{
"name": "61309",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/61309"
},
{
"name": "fortimanageranalyzer-cve20142336-xss(98479)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98479"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-2336",
"datePublished": "2014-10-31T14:00:00",
"dateReserved": "2014-03-12T00:00:00",
"dateUpdated": "2024-08-06T10:14:25.153Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-3193
Vulnerability from cvelistv5
Published
2016-08-19 21:00
Modified
2024-08-05 23:47
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the appliance web-application in Fortinet FortiManager 5.x before 5.0.12, 5.2.x before 5.2.6, and 5.4.x before 5.4.1 and FortiAnalyzer 5.x before 5.0.13, 5.2.x before 5.2.6, and 5.4.x before 5.4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securitytracker.com/id/1036550 | vdb-entry, x_refsource_SECTRACK | |
| http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability-1 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/92458 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:47:59.032Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1036550",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1036550"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability-1"
},
{
"name": "92458",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92458"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-08-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the appliance web-application in Fortinet FortiManager 5.x before 5.0.12, 5.2.x before 5.2.6, and 5.4.x before 5.4.1 and FortiAnalyzer 5.x before 5.0.13, 5.2.x before 5.2.6, and 5.4.x before 5.4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-15T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1036550",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1036550"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability-1"
},
{
"name": "92458",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92458"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-3193",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the appliance web-application in Fortinet FortiManager 5.x before 5.0.12, 5.2.x before 5.2.6, and 5.4.x before 5.4.1 and FortiAnalyzer 5.x before 5.0.13, 5.2.x before 5.2.6, and 5.4.x before 5.4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1036550",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1036550"
},
{
"name": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability-1",
"refsource": "CONFIRM",
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability-1"
},
{
"name": "92458",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92458"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-3193",
"datePublished": "2016-08-19T21:00:00",
"dateReserved": "2016-03-15T00:00:00",
"dateUpdated": "2024-08-05T23:47:59.032Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-3126
Vulnerability from cvelistv5
Published
2017-05-26 22:00
Modified
2024-10-25 14:14
Severity ?
EPSS score ?
Summary
An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute unauthorized code or commands via the next parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securitytracker.com/id/1038540 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securityfocus.com/bid/98557 | vdb-entry, x_refsource_BID | |
| http://www.securitytracker.com/id/1038539 | vdb-entry, x_refsource_SECTRACK | |
| https://fortiguard.com/psirt/FG-IR-17-014 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Fortinet, Inc. | Fortinet FortiAnalyzer, FortiManager |
Version: FortiAnalyzer 5.4.2, 5.4.1, 5.4.0 Version: FortiManager 5.4.2, 5.4.1, 5.4.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T14:16:28.200Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1038540",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1038540"
},
{
"name": "98557",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/98557"
},
{
"name": "1038539",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1038539"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://fortiguard.com/psirt/FG-IR-17-014"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2017-3126",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-23T14:00:52.755671Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-25T14:14:04.358Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Fortinet FortiAnalyzer, FortiManager",
"vendor": "Fortinet, Inc.",
"versions": [
{
"status": "affected",
"version": "FortiAnalyzer 5.4.2, 5.4.1, 5.4.0"
},
{
"status": "affected",
"version": "FortiManager 5.4.2, 5.4.1, 5.4.0"
}
]
}
],
"datePublic": "2017-04-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute unauthorized code or commands via the next parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Open redirect",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-07T09:57:01",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "1038540",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1038540"
},
{
"name": "98557",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/98557"
},
{
"name": "1038539",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1038539"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://fortiguard.com/psirt/FG-IR-17-014"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@fortinet.com",
"ID": "CVE-2017-3126",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Fortinet FortiAnalyzer, FortiManager",
"version": {
"version_data": [
{
"version_value": "FortiAnalyzer 5.4.2, 5.4.1, 5.4.0"
},
{
"version_value": "FortiManager 5.4.2, 5.4.1, 5.4.0"
}
]
}
}
]
},
"vendor_name": "Fortinet, Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute unauthorized code or commands via the next parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Open redirect"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1038540",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1038540"
},
{
"name": "98557",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/98557"
},
{
"name": "1038539",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1038539"
},
{
"name": "https://fortiguard.com/psirt/FG-IR-17-014",
"refsource": "CONFIRM",
"url": "https://fortiguard.com/psirt/FG-IR-17-014"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2017-3126",
"datePublished": "2017-05-26T22:00:00",
"dateReserved": "2016-12-02T00:00:00",
"dateUpdated": "2024-10-25T14:14:04.358Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-3196
Vulnerability from cvelistv5
Published
2016-08-05 14:00
Modified
2024-08-05 23:47
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an image uploaded in the report section.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/92203 | vdb-entry, x_refsource_BID | |
| http://seclists.org/fulldisclosure/2016/Aug/4 | mailing-list, x_refsource_FULLDISC | |
| http://www.securitytracker.com/id/1036550 | vdb-entry, x_refsource_SECTRACK | |
| http://www.vulnerability-lab.com/get_content.php?id=1687 | x_refsource_MISC | |
| http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability | x_refsource_CONFIRM | |
| http://www.securityfocus.com/archive/1/539069/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securitytracker.com/id/1036551 | vdb-entry, x_refsource_SECTRACK |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:47:58.322Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "92203",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92203"
},
{
"name": "20160801 Fortinet FortiManager \u0026 FortiAnalyzer - (filename) Persistent Web Vulnerability",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2016/Aug/4"
},
{
"name": "1036550",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1036550"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.vulnerability-lab.com/get_content.php?id=1687"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability"
},
{
"name": "20160801 Fortinet FortiManager \u0026 FortiAnalyzer - (filename) Persistent Web Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/539069/100/0/threaded"
},
{
"name": "1036551",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1036551"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-07-14T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an image uploaded in the report section."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "92203",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92203"
},
{
"name": "20160801 Fortinet FortiManager \u0026 FortiAnalyzer - (filename) Persistent Web Vulnerability",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2016/Aug/4"
},
{
"name": "1036550",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1036550"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.vulnerability-lab.com/get_content.php?id=1687"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability"
},
{
"name": "20160801 Fortinet FortiManager \u0026 FortiAnalyzer - (filename) Persistent Web Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/539069/100/0/threaded"
},
{
"name": "1036551",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1036551"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-3196",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an image uploaded in the report section."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "92203",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92203"
},
{
"name": "20160801 Fortinet FortiManager \u0026 FortiAnalyzer - (filename) Persistent Web Vulnerability",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2016/Aug/4"
},
{
"name": "1036550",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1036550"
},
{
"name": "http://www.vulnerability-lab.com/get_content.php?id=1687",
"refsource": "MISC",
"url": "http://www.vulnerability-lab.com/get_content.php?id=1687"
},
{
"name": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability",
"refsource": "CONFIRM",
"url": "http://fortiguard.com/advisory/fortimanager-and-fortianalyzer-persistent-xss-vulnerability"
},
{
"name": "20160801 Fortinet FortiManager \u0026 FortiAnalyzer - (filename) Persistent Web Vulnerability",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/539069/100/0/threaded"
},
{
"name": "1036551",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1036551"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-3196",
"datePublished": "2016-08-05T14:00:00",
"dateReserved": "2016-03-15T00:00:00",
"dateUpdated": "2024-08-05T23:47:58.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-6826
Vulnerability from cvelistv5
Published
2013-11-19 19:00
Modified
2024-09-16 23:56
Severity ?
EPSS score ?
Summary
cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrf_token parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks.
References
| ▼ | URL | Tags |
|---|---|---|
| http://packetstormsecurity.com/files/123980/fortianalyzer-xsrf.txt | x_refsource_MISC | |
| http://www.securityfocus.com/bid/63663 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T17:46:23.905Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/123980/fortianalyzer-xsrf.txt"
},
{
"name": "63663",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/63663"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrf_token parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-11-19T19:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/123980/fortianalyzer-xsrf.txt"
},
{
"name": "63663",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/63663"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-6826",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "cgi-bin/module//sysmanager/admin/SYSAdminUserDialog in Fortinet FortiAnalyzer before 5.0.5 does not properly validate the csrf_token parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/123980/fortianalyzer-xsrf.txt",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/123980/fortianalyzer-xsrf.txt"
},
{
"name": "63663",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/63663"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-6826",
"datePublished": "2013-11-19T19:00:00Z",
"dateReserved": "2013-11-19T00:00:00Z",
"dateUpdated": "2024-09-16T23:56:53.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-2335
Vulnerability from cvelistv5
Published
2014-10-31 14:00
Modified
2024-08-06 10:14
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.fortiguard.com/advisory/FG-IR-14-033/ | x_refsource_CONFIRM | |
| http://secunia.com/advisories/61309 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/98478 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:14:25.031Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.fortiguard.com/advisory/FG-IR-14-033/"
},
{
"name": "61309",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/61309"
},
{
"name": "fortimanageranalyzer-cve20142335-xss(98478)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98478"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-10-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.fortiguard.com/advisory/FG-IR-14-033/"
},
{
"name": "61309",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/61309"
},
{
"name": "fortimanageranalyzer-cve20142335-xss(98478)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98478"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-2335",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.fortiguard.com/advisory/FG-IR-14-033/",
"refsource": "CONFIRM",
"url": "http://www.fortiguard.com/advisory/FG-IR-14-033/"
},
{
"name": "61309",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/61309"
},
{
"name": "fortimanageranalyzer-cve20142335-xss(98478)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98478"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-2335",
"datePublished": "2014-10-31T14:00:00",
"dateReserved": "2014-03-12T00:00:00",
"dateUpdated": "2024-08-06T10:14:25.031Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2015-7363
Vulnerability from cvelistv5
Published
2016-10-07 14:00
Modified
2024-08-06 07:43
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3 allows remote administrators to inject arbitrary web script or HTML via vectors related to report filters.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securitytracker.com/id/1036981 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securitytracker.com/id/1036982 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securityfocus.com/bid/93413 | vdb-entry, x_refsource_BID | |
| http://fortiguard.com/advisory/fortianalyzer-and-fortimanager-stored-xss-vulnerability-in-report-filters | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T07:43:46.315Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1036981",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1036981"
},
{
"name": "1036982",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1036982"
},
{
"name": "93413",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/93413"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://fortiguard.com/advisory/fortianalyzer-and-fortimanager-stored-xss-vulnerability-in-report-filters"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-10-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3 allows remote administrators to inject arbitrary web script or HTML via vectors related to report filters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-29T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1036981",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1036981"
},
{
"name": "1036982",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1036982"
},
{
"name": "93413",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/93413"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://fortiguard.com/advisory/fortianalyzer-and-fortimanager-stored-xss-vulnerability-in-report-filters"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-7363",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3 allows remote administrators to inject arbitrary web script or HTML via vectors related to report filters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1036981",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1036981"
},
{
"name": "1036982",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1036982"
},
{
"name": "93413",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/93413"
},
{
"name": "http://fortiguard.com/advisory/fortianalyzer-and-fortimanager-stored-xss-vulnerability-in-report-filters",
"refsource": "CONFIRM",
"url": "http://fortiguard.com/advisory/fortianalyzer-and-fortimanager-stored-xss-vulnerability-in-report-filters"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-7363",
"datePublished": "2016-10-07T14:00:00",
"dateReserved": "2015-09-25T00:00:00",
"dateUpdated": "2024-08-06T07:43:46.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}