FortiOS / FortiProxy vulnerabilities

A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to information disclosure via <insert attack vector here>

An improper authorization vulnerability (CWE-285) in Fortinet FortiOS and FortiProxy allows an authenticated attacker to access static files of other VDOMs via crafted HTTP or HTTPS requests. Affects multiple versions of FortiOS (7.4.0-7.4.1, 7.2.0-7.2.8, 7.0.0-7.0.11) and FortiProxy (7.4.0-7.4.8, 7.2, 7.0, 2.0).

An out-of-bounds write vulnerability in Fortinet FortiOS and FortiProxy allows an authenticated attacker to execute unauthorized code or commands via specifically crafted requests.

A relative path traversal vulnerability (CWE-23) in Fortinet FortiOS (7.2.0–7.2.3, 7.0.0–7.0.8, 6.4.0–6.4.11, 6.2.0–6.2.12) and FortiProxy (7.2.0–7.2.1, 7.0.0–7.0.7, 2.0.0–2.0.11, 1.2, 01.02, 1.1, 01.01) allows privileged VDOM administrators to escalate to super admin via crafted CLI requests.

Fortinet FortiOS and FortiProxy contain an improper neutralization of CRLF sequences in HTTP headers (HTTP response splitting). An authenticated remote attacker can perform an HTTP request splitting attack, gaining control of the remaining headers and body of the response.