FortiAnalyzer / FortiManager vulnerabilities

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in Fortinet FortiAnalyzer and FortiManager (including Cloud versions) may allow a low privileged user to execute arbitrary commands via crafted requests.

A privilege escalation vulnerability in Fortinet FortiAnalyzer and FortiManager allows an attacker to escalate privileges via specific shell commands. The flaw is due to incorrect privilege assignment in multiple versions of these products.

A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer and FortiManager allows a remote attacker to execute unauthorized code or commands via specially crafted packets. The issue affects multiple versions of these products, including cloud variants.