Filtered by vendor Sangfor Subscriptions
Filtered by product Next-gen Application Firewall Subscriptions
Total 5 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-30806 1 Sangfor 1 Next-gen Application Firewall 2024-11-21 9.8 Critical
The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the /cgi-bin/login.cgi endpoint. This is due to mishandling of shell meta-characters in the PHPSESSID cookie.
CVE-2023-30805 1 Sangfor 1 Next-gen Application Firewall 2024-11-21 9.8 Critical
The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the /LogInOut.php endpoint. This is due to mishandling of shell meta-characters in the "un" parameter.
CVE-2023-30804 1 Sangfor 1 Next-gen Application Firewall 2024-11-21 4.9 Medium
The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authenticated file disclosure vulnerability. A remote and authenticated attacker can read arbitrary system files using the svpn_html/loadfile.php endpoint. This issue is exploitable by a remote and unauthenticated attacker when paired with CVE-2023-30803.
CVE-2023-30803 1 Sangfor 1 Next-gen Application Firewall 2024-11-21 9.8 Critical
The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can bypass authentication and access administrative functionality by sending HTTP requests using a crafted Y-forwarded-for header.
CVE-2023-30802 1 Sangfor 1 Next-gen Application Firewall 2024-11-21 5.3 Medium
The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to a source code disclosure vulnerability. A remote and unauthenticated attacker can obtain PHP source code by sending an HTTP request with an invalid Content-Length field.