CVE-2023-30804

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authenticated file disclosure vulnerability. A remote and authenticated attacker can read arbitrary system files using the svpnhtml/loadfile.php endpoint. This issue is exploitable by a remote and unauthenticated...

Sangfor NGAF Authentication Bypass

Sangfor NGAF are vulnerable to an Authentication Bypass allowing a remote to perform various unauthorized actions with a specially crafted HTTP request. Exploiting this vulnerability can lead to a Remote Code Execution. No source data...

CVE-2023-30805

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the /LogInOut.php endpoint. This is due to mishandling ...

CVE-2023-30806

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the /cgi-bin/login.cgi endpoint. This is due to...

CVE-2023-30805

CVE-2023-30805 - Sangfor NGAF Affected: Sangfor Next-Gen Application Firewall NGAF version 8.0.17. Vulnerability: An operating system command injection vulnerability exists when processing the value of the un parameter sent via an HTTP POST to /LogInOut.php . Root cause cited as mishandling of sh...

CVE-2023-30804

CVE-2023-30804 affects Sangfor NGAF 8.0.17. The issue is an authenticated file-disclosure vulnerability exposed via svpn_html/loadfile.php, allowing a remote, authenticated attacker to read arbitrary system files. The description notes this can be exploited when paired with CVE-2023-30803, which ...

CVE-2023-30803

The CVE-2023-30803 entry concerns the Sangfor Next-Gen Application Firewall (NGAF) version NGAF8.0.17. The vulnerability is an authentication bypass where a remote, unauthenticated attacker can bypass login and gain access to administrative functionality by sending HTTP requests with a crafted Y-...

CVE-2023-30802

CVE-2023-30802 affects Sangfor Next-Gen Application Firewall NGAF 8.0.17. Multiple connected sources confirm a source-code disclosure vulnerability exploitable remotely by an unauthenticated attacker through HTTP requests with an invalid Content-Length header, enabling access to PHP source code. ...