GCVE - cpe:2.3:a:fortinet,_inc.:fortios:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:fortinet,_inc.:fortios:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Fortinet, Inc. (`773fb5aa-3c05-572f-a299-a4d7a511c4a7`)
Product	Fortios (`4781f75a-f3f9-5a71-b8d5-cd724a214686`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2018-9194`	vulnerable	2026-06-03 14:39:10.699091	Details available A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under VIP SSL feature when CPx being used. Published: 2018-09-05T13:00:00.000Z Updated: 2024-10-25T14:08:00.472Z Open on db.gcve.eu Reference links https://robotattack.org/ https://fortiguard.com/advisory/FG-IR-17-302 https://www.kb.cert.org/vuls/id/144389	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-9192`	vulnerable	2026-06-03 14:39:10.694652	Details available A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9, 6.0.0 and 6.0.1 are vulnerable by such attack under SSL Deep Inspection feature when CPx being used. Published: 2018-09-05T13:00:00.000Z Updated: 2024-10-25T14:08:14.725Z Open on db.gcve.eu Reference links https://robotattack.org/ https://fortiguard.com/advisory/FG-IR-17-302 https://www.kb.cert.org/vuls/id/144389	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-7739`	vulnerable	2026-06-03 14:37:37.984719	Details available A reflected Cross-site Scripting (XSS) vulnerability in web proxy disclaimer response web pages in Fortinet FortiOS 5.6.0, 5.4.0 to 5.4.5, 5.2.0 to 5.2.11 allows an unauthenticated attacker to inject arbitrary web script or HTML in the context of the victim's browser via sending a maliciously crafted URL to the victim. Published: 2017-11-13T14:00:00.000Z Updated: 2024-10-25T14:10:42.993Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/101679 http://www.securitytracker.com/id/1039741 https://fortiguard.com/advisory/FG-IR-17-168	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-7738`	vulnerable	2026-06-03 14:37:37.983523	Details available An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, 5.2 and below versions allow an admin user with super_admin privileges to view the current SSL VPN web portal session info which may contains user credentials through the fnsysctl CLI command. Published: 2017-12-13T22:00:00.000Z Updated: 2024-10-25T14:33:09.500Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/102151 https://fortiguard.com/advisory/FG-IR-17-172	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-14190`	vulnerable	2026-06-03 14:36:38.708101	Details available A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attacker to inject arbitrary web script or HTML via maliciously crafted "Host" header in user HTTP requests. Published: 2018-01-29T16:00:00.000Z Updated: 2024-10-25T14:10:07.889Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1040284 http://www.securityfocus.com/bid/102779 https://fortiguard.com/advisory/FG-IR-17-262	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-14187`	vulnerable	2026-06-03 14:36:38.704718	Details available A local privilege escalation and local code execution vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8, and 5.2 and below versions allows attacker to execute unauthorized binary program contained on an USB drive plugged into a FortiGate via linking the aforementioned binary program to a command that is allowed to be run by the fnsysctl CLI command. Published: 2018-05-24T20:00:00.000Z Updated: 2024-10-25T14:31:57.582Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1040983 http://www.securityfocus.com/bid/104312 https://fortiguard.com/advisory/FG-IR-17-245	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-14186`	vulnerable	2026-06-03 14:36:38.704244	Details available A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote user to inject arbitrary web script or HTML in the context of the victim's browser via the login redir parameter. An URL Redirection attack may also be feasible by injecting an external URL via the affected parameter. Published: 2017-11-29T19:00:00.000Z Updated: 2024-10-25T14:10:19.555Z Open on db.gcve.eu Reference links http://www.securitytracker.com/id/1039891 http://www.securityfocus.com/bid/101955 https://fortiguard.com/advisory/FG-IR-17-242	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-14185`	vulnerable	2026-06-03 14:36:38.703085	Details available An Information Disclosure vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.8 and 5.2 all versions allows SSL VPN web portal users to access internal FortiOS configuration information (eg:addresses) via specifically crafted URLs inside the SSL-VPN web portal. Published: 2018-05-25T16:00:00.000Z Updated: 2024-10-25T14:31:46.387Z Open on db.gcve.eu Reference links https://fortiguard.com/advisory/FG-IR-17-231 http://www.securityfocus.com/bid/104288	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.