"Fortinet Patches 6 High-Severity Vulnerabilities"

Fortinet recently informed customers about 16 vulnerabilities discovered in the company's products, including six flaws that have been assigned a "high" severity rating.  One of the high-severity issues affects FortiTester, and it allows an authenticated attacker to execute commands via specially crafted arguments to existing commands.  The company noted that FortiSIEM is affected by a vulnerability that allows a local attacker with command-line access to perform operations on the Glassfish server directly via a hardcoded password.  The remaining high-severity flaws are stored and reflected cross-site scripting (XSS) bugs.  They impact FortiADC, FortiDeceptor, FortiManager, and FortiAnalyzer. Some of them can be exploited remotely without authentication.  The company stated that medium and low-severity vulnerabilities have been patched in FortiOS, FortiTester, FortiSOAR, FortiMail, FortiEDR CollectorWindows, FortiClient for Mac, and FortiADC.  These security holes can be exploited for privilege escalation, XSS attacks, obtaining sensitive information, DoS attacks, bypassing protections, changing settings, and executing arbitrary commands.

SecurityWeek reports: "Fortinet Patches 6 High-Severity Vulnerabilities"