CVE-2016-8494

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
Fortinet	Fortinet Connect	14.2; 14.10; 15.10; 16.7

References

http://www.securityfocus.com/bid/96159
https://fortiguard.com/advisory/FG-IR-16-080Vendor Advisory
http://www.securityfocus.com/bid/96159
https://fortiguard.com/advisory/FG-IR-16-080Vendor Advisory

Timeline

Published: Feb 9, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-84957.4An improper certificate validation vulnerability in Fortinet FortiManager 5.0.6 through 5.2.7 and 5.4.0 through 5.4.1 allows remote attacker CVE-2016-85015.3Security WiFi bypass in Yandex Browser from version 15.10 to 15.12 allows remote attacker to sniff traffic in open or WEP-protected wi-fi ne CVE-2016-85027.3Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 15.12.0 to 16.2 could be used by remote attacker for brute-f CVE-2016-85037.3Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 16.7 to 16.9 could be used by remote attacker for brute-forc CVE-2016-85044.3CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in brows CVE-2016-85056.1XSS in Yandex Browser BookReader in Yandex browser for desktop for versions before 16.6. could be used by remote attacker for evaluation arb CVE-2016-85066.1XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluati CVE-2016-85076.5Yandex Browser for iOS before 16.10.0.2357 does not properly restrict processing of facetime:// URLs, which allows remote attackers to initi CVE-2016-85086.5Yandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in Chromium) warnings in web-sites with special CVE-2016-85119.8A Remote Code Execution vulnerability in HPE Network Automation using RPCServlet and Java Deserialization version v9.1x, v9.2x, v10.00, v10.CVE-2016-85129.8A Remote Code Execution vulnerability in all versions of HPE LoadRunner and Performance Center was found.CVE-2016-85138.0A Cross-Site Request Forgery (CSRF) vulnerability in HPE Version Control Repository Manager (VCRM) was found. The problem impacts all versio