CVE-2015-1880

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.fortiguard.com/advisory/FG-IR-15-005/Vendor Advisory
http://www.securityfocus.com/bid/74652Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032261Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032262Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032264Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032265Third Party Advisory, VDB Entry
http://www.fortiguard.com/advisory/FG-IR-15-005/Vendor Advisory
http://www.securityfocus.com/bid/74652Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032261Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032262Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032264Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032265Third Party Advisory, VDB Entry

Timeline

Published: May 12, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-18814.0OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenti CVE-2015-18828.5Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to ga CVE-2015-18834.0IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated use CVE-2015-18844.0Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1,CVE-2015-18859.3WebSphereOauth20SP.ear in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.CVE-2015-18867.8The Remote Document Conversion Service (DCS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7 CVE-2015-18875.0IBM WebSphere Portal 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to obtain sensitiv CVE-2015-18883.5Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.0.2 before 2.0.2-ICN-FP007 and 2.0.3 before 2.0.3-ICN-FP003, as used in CVE-2015-18896.5The Big SQL component in IBM InfoSphere BigInsights 3.0 through 3.0.0.2 allows remote authenticated users to bypass intended HDFS data-acces CVE-2015-18903.5/usr/lpp/mmfs/bin/gpfs.snap in IBM General Parallel File System (GPFS) 4.1 before 4.1.0.7 produces an archive potentially containing clearte CVE-2015-18925.0The Multicast DNS (mDNS) responder in IBM Security Access Manager for Web 7.x before 7.0.0 FP12 and 8.x before 8.0.1 FP1 inadvertently respo CVE-2015-18936.8The IBM WebSphere DataPower XC10 appliance 2.1 before 2.1.0.3 allows remote attackers to hijack the sessions of arbitrary users, and consequ