U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • CPE Product Version: cpe:/o:fortinet:fortimanager_firmware:5.0.9
There are 14 matching records.
Displaying matches 1 through 14.
Vuln ID Summary CVSS Severity
CVE-2017-17541

A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows inject Javascript code and HTML tags through the CN value of CA and CRL certificates via the import CA and CRL certificates feature.

Published: July 16, 2018; 4:29:00 PM -0400 		V3.0: 6.1 MEDIUM
 V2.0: 4.3 MEDIUM
CVE-2015-3617

Fortinet FortiManager 5.0 before 5.0.11 and 5.2 before 5.2.2 allow local users to gain privileges via crafted CLI commands.

Published: August 22, 2017; 11:29:00 AM -0400 		V3.0: 7.8 HIGH
 V2.0: 4.6 MEDIUM
CVE-2015-3616

SQL injection vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to execute arbitrary commands via unspecified parameters.

Published: August 11, 2017; 5:29:00 PM -0400 		V3.0: 9.8 CRITICAL
 V2.0: 7.5 HIGH
CVE-2015-3615

Cross-site scripting (XSS) vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving unspecified parameters and a privilege escalation attack.

Published: August 11, 2017; 5:29:00 PM -0400 		V3.0: 5.4 MEDIUM
 V2.0: 3.5 LOW
CVE-2015-3614

Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to obtain arbitrary files via vectors involving another unspecified vulnerability.

Published: August 11, 2017; 5:29:00 PM -0400 		V3.0: 7.5 HIGH
 V2.0: 5.0 MEDIUM
CVE-2016-8495

An improper certificate validation vulnerability in Fortinet FortiManager 5.0.6 through 5.2.7 and 5.4.0 through 5.4.1 allows remote attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack via the Fortisandbox devices probing feature.

Published: February 13, 2017; 10:59:00 AM -0500 		V3.0: 7.4 HIGH
 V2.0: 5.8 MEDIUM
CVE-2015-7363

Cross-site scripting (XSS) vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3 allows remote administrators to inject arbitrary web script or HTML via vectors related to report filters.

Published: October 07, 2016; 10:59:02 AM -0400 		V3.0: 5.4 MEDIUM
 V2.0: 3.5 LOW
CVE-2016-3195

Cross-site scripting (XSS) vulnerability in the Web-UI in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Published: August 19, 2016; 5:59:07 PM -0400 		V3.0: 6.1 MEDIUM
 V2.0: 4.3 MEDIUM
CVE-2016-3194

Cross-site scripting (XSS) vulnerability in the address added page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Published: August 19, 2016; 5:59:06 PM -0400 		V3.0: 6.1 MEDIUM
 V2.0: 4.3 MEDIUM
CVE-2016-3193

Cross-site scripting (XSS) vulnerability in the appliance web-application in Fortinet FortiManager 5.x before 5.0.12, 5.2.x before 5.2.6, and 5.4.x before 5.4.1 and FortiAnalyzer 5.x before 5.0.13, 5.2.x before 5.2.6, and 5.4.x before 5.4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Published: August 19, 2016; 5:59:05 PM -0400 		V3.0: 5.4 MEDIUM
 V2.0: 3.5 LOW
CVE-2016-3196

Cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 allows remote authenticated users to inject arbitrary web script or HTML via the filename of an image uploaded in the report section.

Published: August 05, 2016; 10:59:06 AM -0400 		V3.0: 5.4 MEDIUM
 V2.0: 3.5 LOW
CVE-2015-8038

Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) sharedjobmanager or (2) SOMServiceObjDialog.

Published: November 02, 2015; 2:59:18 PM -0500 		V3.x:(not available)
 V2.0: 4.3 MEDIUM
CVE-2015-8037

Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote attackers to inject arbitrary web script or HTML via the (1) SOMVpnSSLPortalDialog or (2) FGDMngUpdHistory.

Published: November 02, 2015; 2:59:17 PM -0500 		V3.x:(not available)
 V2.0: 4.3 MEDIUM
CVE-2015-3620

Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0 through 5.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Published: May 12, 2015; 3:59:23 PM -0400 		V3.x:(not available)
 V2.0: 4.3 MEDIUM