FortiVoice vulnerabilities

An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7, FortiVoice 6.4 all versions, FortiVoice 6.0 all versions may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted requests.

Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 may allow a privileged authenticated attacker to write arbitrary files via specifically crafted HTTP or HTTPS commands.

Fortinet FortiVoice versions 7.2.0, 7.0.0 through 7.0.6, and before 6.4.10 contain two OS command injection vulnerabilities (CWE-78). A privileged attacker can execute arbitrary code or commands via crafted HTTP/HTTPS or CLI requests.