Vulnerabilities > Fortinet > Fortiweb

DATE CVE VULNERABILITY TITLE RISK
2018-02-09 CVE-2012-6346 Cross-site Scripting vulnerability in Fortinet Fortiweb
Multiple cross-site scripting (XSS) vulnerabilities in FortiWeb before 4.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1) redir or (2) mkey parameter to waf/pcre_expression/validate.
network
low complexity
fortinet CWE-79
6.1
2017-11-22 CVE-2017-7736 Cross-site Scripting vulnerability in Fortinet Fortiweb
A stored Cross-site Scripting (XSS) vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import.
network
low complexity
fortinet CWE-79
5.4
2017-08-10 CVE-2017-7737 Files or Directories Accessible to External Parties vulnerability in Fortinet Fortiweb
An information disclosure vulnerability in Fortinet FortiWeb 5.8.2 and below versions allows logged-in admin user to view SNMPv3 user password in cleartext in webui via the HTML source code.
network
low complexity
fortinet CWE-552
4.9
2017-05-27 CVE-2017-3129 Cross-site Scripting vulnerability in Fortinet Fortiweb
A Cross-Site Scripting vulnerability in Fortinet FortiWeb versions 5.7.1 and below allows attacker to execute unauthorized code or commands via an improperly sanitized POST parameter in the FortiWeb Site Publisher feature.
network
low complexity
fortinet CWE-79
6.1
2016-07-13 CVE-2016-5092 Path Traversal vulnerability in Fortinet Fortiweb
Directory traversal vulnerability in Fortinet FortiWeb before 5.5.3 allows remote authenticated administrators with read and write privileges to read arbitrary files by leveraging the autolearn feature.
network
low complexity
fortinet CWE-22
4.9
2016-07-13 CVE-2016-4066 Cross-Site Request Forgery (CSRF) vulnerability in Fortinet Fortiweb
Cross-site request forgery (CSRF) vulnerability in Fortinet FortiWeb before 5.5.3 allows remote attackers to hijack the authentication of administrators for requests that change the password via unspecified vectors.
network
low complexity
fortinet CWE-352
8.8