FortiClientEMS vulnerabilities

An SQL Injection vulnerability in Fortinet FortiClientEMS allows an authenticated attacker with at least read-only admin permission to execute unauthorized SQL code or commands via crafted HTTP/HTTPS requests.

An improper neutralization of formula elements in a CSV file vulnerability in Fortinet FortiClientEMS across multiple versions. It allows an attacker to execute unauthorized code or commands via specially crafted packets.

A vulnerability in Fortinet FortiClientEMS allows an attacker to disclose information due to improper certificate validation. Affected versions include 7.4.3-7.4.5, 7.4.0-7.4.1, and all 7.2 versions.

FortiClientEMS versions 7.4.0 through 7.4.5 contain a hard-coded cryptographic key. An attacker can use this key to decrypt a database dump and disclose information.

An improper privilege management vulnerability (CWE-269) in Fortinet FortiClientEMS allows a site administrator with Super Admin privileges to perform global administrative operations affecting other sites via crafted HTTP or HTTPS requests.