anti-gen-wippingen.de Improper Access Control vulnerability OBB-3769259

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Input validation

An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privileges to execute arbitrary code...

CVE-2022-4573

An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privileges to execute arbitrary code...

CVE-2022-4573

Summary: CVE-2022-4573 is described across multiple sources as an input-validation flaw in the SMI handler of the ThinkPad X1 Fold Gen 1 BIOS firmware. The vulnerability could allow a local, high-privilege attacker to execute arbitrary code due to improper validation in the SMI handler. Affected ...

CVE-2022-4573

An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privileges to execute arbitrary code...

CVE-2023-3112

A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to execute code with elevated privileges...

Security feature bypass

A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to execute code with elevated privileges...

Lenovo ThinkPad T14 Gen 3 Security Vulnerability

Lenovo ThinkPad is a portable computer from Lenovo, a Chinese company. A security vulnerability exists in the Lenovo ThinkPad T14 Gen 3, which stems from Elliptic Labs Virtual Lock Sensor allows an attacker with local access rights to execute code with elevated privileges...

CVE-2023-3112

CVE-2023-3112 concerns the Elliptic Labs Virtual Lock Sensor used by ThinkPad T14 Gen 3. Documents confirm a local attacker could execute code with elevated privileges via this sensor. The vulnerability affects the sensor component embedded in ThinkPad laptops, with no public details on affected ...

CVE-2023-3112

A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to execute code with elevated privileges...

CVE-2023-3112

A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to execute code with elevated privileges...

HPESBHF04544 rev.1 - HPE Integrated Lights-Out 5 (iLO 5), and HPE Integrated Lights-Out 6 (iLO 6), Remote Denial of Service

Potential Security Impact: Remote: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Integrated Lights-Out 6 iLO 6 - Prior to iLO 6 v1.53 HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers - Prior to iLO 5 v2.98 HPE ProLiant BL460c Gen10 Server Blade -...

CVE-2023-30804

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authenticated file disclosure vulnerability. A remote and authenticated attacker can read arbitrary system files using the svpnhtml/loadfile.php endpoint. This issue is exploitable by a remote and unauthenticated...

CVE-2023-30805

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the /LogInOut.php endpoint. This is due to mishandling ...

CVE-2023-30803

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can bypass authentication and access administrative functionality by sending HTTP requests using a crafted Y-forwarded-for header...

CVE-2023-30806 Sangfor Next-Gen Application Firewall PHPSESSID Command Injection

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the /cgi-bin/login.cgi endpoint. This is due to...

CVE-2023-30806

Sangfor NGAF (Next-Gen Application Firewall) version NGAF8.0.17 is affected by an OS command injection vulnerability exploitable via a crafted HTTP POST to /cgi-bin/login.cgi due to mishandling of shell meta-characters in the PHPSESSID cookie. The issue is remote and unauthenticated with potentia...

CVE-2023-30805 Sangfor Next-Gen Application Firewall Login Un Param Command Injection

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the /LogInOut.php endpoint. This is due to mishandling ...

CVE-2023-30803 Sangfor Next-Gen Application Firewall Authentication Bypass

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can bypass authentication and access administrative functionality by sending HTTP requests using a crafted Y-forwarded-for header...

CVE-2023-30802 Sangfor Next-Gen Application Firewall Source Code Disclosure

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to a source code disclosure vulnerability. A remote and unauthenticated attacker can obtain PHP source code by sending an HTTP request with an invalid Content-Length field...