Fortinet FortiAnalyzer/FortiManager vulnerabilities

An SQL Injection vulnerability (CWE-89) in Fortinet FortiAnalyzer and FortiManager (including Cloud versions) allows a low-privileged user to execute arbitrary commands via crafted requests. It affects multiple versions of Fortinet software.

An SQL Injection vulnerability (CWE-89) in Fortinet FortiAnalyzer and FortiManager allows a low-privileged user to execute arbitrary commands via crafted requests. It affects multiple versions of these products.

A use of potentially dangerous function vulnerability in Fortinet FortiAnalyzer and FortiManager allows an authenticated attacker to cause a system hang via multiple specially crafted HTTP requests causing crashes. Exploitation depends on internal locks being aligned, which is out of the attacker's control.

A path traversal vulnerability in Fortinet FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, and FortiManager Cloud allows a privileged attacker to delete files from the underlying filesystem via crafted CLI requests. The issue stems from improper limitation of a pathname to a restricted directory.