Fortinet - PSIRT Advisories

PSIRT Advisories

PSIRT Advisories

• FortiAuthenticator - Command injection in CLI
• FortiClient Linux - Command injection vulnerability
• FortiManager - Access Control missing in P&O module assignment vulnerability
• FortiManager - Excel formula injection in P&O IPv4 Policy names Vulnerability
• FortiOS - Disclosure of other VDOMs information through CLI commands
• FortiOS - Host header injection vulnerability
• FortiOS - debug commands allow memory manipulation
• FortiOS SSL VPN user credential plaintext storage
• FortiSandbox - Session ID does not expire after logout
• FortiWeb - Multiple stack-based buffer overflow vulnerabilities in CLI command
• FortiWeb - OS Command Injection because of missing input parameter sanitization
• Insufficient validation logic in Fortisandbox sniffer's max file size
• FortiWeb - OS command injection vulnerability
• FortiManager & FortiAnalyzer - HTTP response splitting vulnerability
• FortiManager & FortiAnalyzer - Improper access control on the administrators account list
• FortiManager & FortiAnalyzer - Improper validation of dispatcher socket parameters
• FortiManager and FortiAnalyzer - Multiple reflected XSS
• FortiManager, FortiAnalyzer and FortiPortal - Multiple OS command injection vulnerabilities
• FortiManager- Improper access control in SD-WAN Orchestrator
• FortiOS - Buffer Underwrite in firmware verification
• FortiPortal - Authentication bypass and remote code execution as root
• FortiPortal - Path traversal in controller
• FortiPortal - Pervasive SQL injections
• FortiPortal - Unrestricted file upload vulnerability
• FortiPortal - Use of a predictable salt and digest-based algorithm for password hashing