Fortinet disclosed multiple critical vulnerabilities affecting various products including OS command injection via API endpoint, unauthenticated authentication bypass and privilege escalation in FortiSandbox, heap-based buffer overflow in the oftpd daemon, and SQL injection via API. Affected products include FortiSandbox versions 4.4.0 to 4.4.8 and 5.0.0 to 5.0.5, FortiAnalyzer Cloud versions 7.6.2 to 7.6.4, FortiManager Cloud versions 7.6.2 to 7.6.4, and FortiDDoS-F versions 7.2.1 to 7.2.2.
| Vendor | Product | Versions |
|---|---|---|
| fortinet | — | FortiSandbox 4.4.0 - 4.4.8, FortiSandbox 5.0.0 - 5.0.5, FortiAnalyzer Cloud 7.6.2 - 7.6.4, FortiManager Cloud 7.6.2 - 7.6.4, FortiDDoS-F 7.2.1 - 7.2.2 |
