Vulnerabilities > Fortinet > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2016-04-08 | CVE-2016-3978 | Cross-site Scripting vulnerability in Fortinet Fortios The Web User Interface (WebUI) in FortiOS 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via the "redirect" parameter to "login." | 4.3 |
| 2015-11-02 | CVE-2015-8038 | Cross-site Scripting vulnerability in Fortinet Fortimanager Firmware Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) sharedjobmanager or (2) SOMServiceObjDialog. | 4.3 |
| 2015-11-02 | CVE-2015-8037 | Cross-site Scripting vulnerability in Fortinet Fortimanager Firmware Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) SOMVpnSSLPortalDialog or (2) FGDMngUpdHistory. | 4.3 |
| 2015-08-11 | CVE-2015-5965 | Improper Input Validation vulnerability in Fortinet Fortios The SSL-VPN feature in Fortinet FortiOS before 4.3.13 only checks the first byte of the TLS MAC in finished messages, which makes it easier for remote attackers to spoof encrypted content via a crafted MAC field. | 5.0 |
| 2015-08-11 | CVE-2015-3626 | Cross-site Scripting vulnerability in Fortinet Fortios Cross-site scripting (XSS) vulnerability in the DHCP Monitor page in the Web User Interface (WebUI) in Fortinet FortiOS before 5.2.4 on FortiGate devices allows remote attackers to inject arbitrary web script or HTML via a crafted hostname. | 4.3 |
| 2015-08-11 | CVE-2015-2323 | Cryptographic Issues vulnerability in Fortinet Fortios FortiOS 5.0.x before 5.0.12 and 5.2.x before 5.2.4 supports anonymous, export, RC4, and possibly other weak ciphers when using TLS to connect to FortiGuard servers, which allows man-in-the-middle attackers to spoof TLS content by modifying packets. | 6.4 |
| 2015-05-12 | CVE-2015-3620 | Cross-site Scripting vulnerability in Fortinet Fortianalyzer Firmware and Fortimanager Firmware Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
| 2015-05-12 | CVE-2015-1880 | Cross-site Scripting vulnerability in Fortinet Fortios 5.2.0/5.2.1/5.2.2 Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
| 2015-05-12 | CVE-2014-8619 | Cross-site Scripting vulnerability in Fortinet Fortiweb Cross-site scripting (XSS) vulnerability in the autolearn configuration page in Fortinet FortiWeb 5.1.2 through 5.3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
| 2015-05-12 | CVE-2014-8618 | Cross-site Scripting vulnerability in Fortinet products Cross-site scripting (XSS) vulnerability in the theme login page in Fortinet FortiADC D models before 4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |