Fortinet FortiManager Firmware vulnerabilities

15 CVEs affecting Fortinet FortiManager Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-17541, published 2018-07-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-8038, published 2015-11-02. Medium severity, CVSS 4.3. EPSS: 2.8% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote attackers to inject arbitrary web script or HTML via the…
CVE-2015-8037, published 2015-11-02. Medium severity, CVSS 4.3. EPSS: 2.8% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in the Graphical User Interface (GUI) in Fortinet FortiManager before 5.2.4 allow remote attackers to inject arbitrary web script or HTML via the…
CVE-2015-3620, published 2015-05-12. Medium severity, CVSS 4.3. EPSS: 2.4% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the advanced dataset reports page in Fortinet FortiAnalyzer 5.0.0 through 5.0.10 and 5.2.0 through 5.2.1 and FortiManager 5.0.3 through 5.0.10 and 5.2.0…
CVE-2015-3616, published 2017-08-11. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. SQL injection vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to execute arbitrary commands via unspecified parameters.
CVE-2015-3614, published 2017-08-11. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to obtain arbitrary files via vectors involving another unspecified vulnerability.
CVE-2015-3615, published 2017-08-11. Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote authenticated users to inject arbitrary web script or HTML via vectors…
CVE-2016-3195, published 2016-08-19. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Web-UI in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows remote…
CVE-2016-3194, published 2016-08-19. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the address added page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.6 allows…
CVE-2016-3196, published 2016-08-05. Medium severity, CVSS 5.4. EPSS: 1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.6 allows remote authenticated users…
CVE-2017-3126, published 2017-05-27. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. An Open Redirect vulnerability in Fortinet FortiAnalyzer 5.4.0 through 5.4.2 and FortiManager 5.4.0 through 5.4.2 allows attacker to execute unauthorized code or commands via the next parameter.

Latest

CVE-2017-17541, published 2018-07-16. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows inject Javascript code and HTML tags through…
CVE-2015-3617, published 2017-08-22. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. Fortinet FortiManager 5.0 before 5.0.11 and 5.2 before 5.2.2 allow local users to gain privileges via crafted CLI commands.
CVE-2016-8495, published 2017-02-13. High severity, CVSS 7.4. EPSS: 0.9% chance of exploitation in the next 30 days. An improper certificate validation vulnerability in Fortinet FortiManager 5.0.6 through 5.2.7 and 5.4.0 through 5.4.1 allows remote attacker to spoof a trusted entity by using a man-in-the-middle…
CVE-2015-7363, published 2016-10-07. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and FortiAnalyzer 5.x…