deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-43625
Published: 2023-10-10
Description: A vulnerability has been identified in Simcenter Amesim (All versions < V2021.1). The affected application contains a SOAP endpoint that could allow an unauthenticated remote attacker to perform DLL injection and execute arbitrary code in the context of the affected application process.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://cert-portal.siemens.com/productcert/pdf/ssa-386812.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-386812.pdf
CVE: CVE-2023-44081
Published: 2023-10-10
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf
CVE: CVE-2023-44082
Published: 2023-10-10
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf
CVE: CVE-2023-44083
Published: 2023-10-10
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted SPP file. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf
CVE: CVE-2023-44084
Published: 2023-10-10
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf
CVE: CVE-2023-44085
Published: 2023-10-10
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf
CVE: CVE-2023-44086
Published: 2023-10-10
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf
CVE: CVE-2023-44087
Published: 2023-10-10
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted SPP files. This could allow an attacker to execute code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf
CVE: CVE-2023-44315
Published: 2023-10-10
Description: A vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application improperly sanitizes certain SNMP configuration data retrieved from monitored devices. An attacker with access to a monitored device could prepare a stored cross-site scripting (XSS) attack that may lead to unintentional modification of application data by legitimate users.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://cert-portal.siemens.com/productcert/html/ssa-160243.html; https://cert-portal.siemens.com/productcert/pdf/ssa-160243.pdf; https://cert-portal.siemens.com/productcert/html/ssa-160243.html
CVE: CVE-2023-45204
Published: 2023-10-10
Description: A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected applications contain a type confusion vulnerability while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process.  (ZDI-CAN-21268)
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf
CVE: CVE-2023-45205
Published: 2023-10-10
Description: A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.20). The affected application is installed with specific files and folders with insecure permissions. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges to `NT AUTHORITY/SYSTEM`.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://cert-portal.siemens.com/productcert/html/ssa-035466.html; https://cert-portal.siemens.com/productcert/pdf/ssa-035466.pdf; https://cert-portal.siemens.com/productcert/html/ssa-035466.html
CVE: CVE-2023-45601
Published: 2023-10-10
Description: A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.262), Parasolid V35.1 (All versions < V35.1.250), Parasolid V36.0 (All versions < V36.0.169), Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected applications contain a stack overflow vulnerability while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21290)
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-524778.pdf
CVE: CVE-2023-44763
Published: 2023-10-10
Description: Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting (XSS). NOTE: the vendor's position is that a customer is supposed to know that "pdf" should be excluded from the allowed file types, even though pdf is one of the allowed file types in the default configuration.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-434
References: https://github.com/sromanhu/ConcreteCMS-Arbitrary-file-upload-Thumbnail; https://web.archive.org/web/[PII_REDACTED]4159/https://documentation.concretecms.org/user-guide/editors-reference/dashboard/system-and-maintenance/files/allowed-file-types; https://www.concretecms.org/about/project-news/security/security-advisory-2023-10-25-concrete-cms-rejects-cve-2023-44763
CVE: CVE-2023-39447
Published: 2023-10-10
Description: 
When BIG-IP APM Guided Configurations are configured, undisclosed sensitive information may be logged in restnoded log.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.




CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532
References: https://my.f5.com/manage/s/article/K47756555; https://my.f5.com/manage/s/article/K47756555
CVE: CVE-2023-40534
Published: 2023-10-10
Description: When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the HTTP_REQUEST event or Local Traffic Policy are associated with the virtual server, undisclosed requests can cause TMM to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://my.f5.com/manage/s/article/K000133467; https://my.f5.com/manage/s/article/K000133467
CVE: CVE-2023-40537
Published: 2023-10-10
Description: 
An authenticated user's session cookie may remain valid for a limited time after logging out from the BIG-IP Configuration utility on a multi-blade VIPRION platform. 

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.




CVSS Score: 8.1 (HIGH)
CWE: CWE-613
References: https://my.f5.com/manage/s/article/K29141800; https://my.f5.com/manage/s/article/K29141800
CVE: CVE-2023-40542
Published: 2023-10-10
Description: When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://my.f5.com/manage/s/article/K000134652; https://my.f5.com/manage/s/article/K000134652
CVE: CVE-2023-41085
Published: 2023-10-10
Description: 
When IPSec is configured on a Virtual Server, undisclosed traffic can cause TMM to terminate. 

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.




CVSS Score: 7.5 (HIGH)
CWE: CWE-755, CWE-755
References: https://my.f5.com/manage/s/article/K000132420; https://my.f5.com/manage/s/article/K000132420
CVE: CVE-2023-41253
Published: 2023-10-10
Description: 
When on BIG-IP DNS or BIG-IP LTM enabled with DNS Services License, and a TSIG key is created, it is logged in plaintext in the audit log.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://my.f5.com/manage/s/article/K98334513; https://my.f5.com/manage/s/article/K98334513
CVE: CVE-2023-41373
Published: 2023-10-10
Description: 
A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker to execute commands on the BIG-IP system. For BIG-IP system running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary. 

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.


CVSS Score: 9.9 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://my.f5.com/manage/s/article/K000135689; https://my.f5.com/manage/s/article/K000135689
CVE: CVE-2023-41964
Published: 2023-10-10
Description: 
The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables. 

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-312
References: https://my.f5.com/manage/s/article/K20850144; https://my.f5.com/manage/s/article/K20850144
CVE: CVE-2023-42768
Published: 2023-10-10
Description: 
When a non-admin user has been assigned an administrator role via an iControl REST PUT request and later the user's role is reverted back to a non-admin role via the Configuration utility, tmsh, or iControl REST. BIG-IP non-admin user can still have access to iControl REST admin resource.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.2 (HIGH)
CWE: CWE-613
References: https://my.f5.com/manage/s/article/K26910459; https://my.f5.com/manage/s/article/K26910459
CVE: CVE-2023-43485
Published: 2023-10-10
Description: 
When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: https://my.f5.com/manage/s/article/K06110200; https://my.f5.com/manage/s/article/K06110200
CVE: CVE-2023-43611
Published: 2023-10-10
Description: 
The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process.  This vulnerability is due to an incomplete fix for CVE-2023-38418.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated


CVSS Score: 7.8 (HIGH)
CWE: CWE-347
References: https://my.f5.com/manage/s/article/K000136185; https://my.f5.com/manage/s/article/K000136185
CVE: CVE-2023-43746
Published: 2023-10-10
Description: 
When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system.  A successful exploit can allow the attacker to cross a security boundary.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 8.7 (HIGH)
CWE: CWE-267
References: https://my.f5.com/manage/s/article/K41072952; https://my.f5.com/manage/s/article/K41072952
CVE: CVE-2023-43785
Published: 2023-10-10
Description: A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function. This flaw allows a local user to trigger an out-of-bounds read error and read the contents of memory on the system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787, CWE-125
References: https://access.redhat.com/errata/RHSA-2024:2145; https://access.redhat.com/errata/RHSA-2024:2973; https://access.redhat.com/security/cve/CVE-2023-43785
CVE: CVE-2023-43786
Published: 2023-10-10
Description: A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-835
References: https://access.redhat.com/errata/RHSA-2024:2145; https://access.redhat.com/errata/RHSA-2024:2973; https://access.redhat.com/security/cve/CVE-2023-43786
CVE: CVE-2023-43787
Published: 2023-10-10
Description: A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-190
References: https://access.redhat.com/errata/RHSA-2024:2145; https://access.redhat.com/errata/RHSA-2024:2973; https://access.redhat.com/security/cve/CVE-2023-43787
CVE: CVE-2023-43788
Published: 2023-10-10
Description: A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents of memory on the system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://access.redhat.com/errata/RHSA-2024:2146; https://access.redhat.com/errata/RHSA-2024:2217; https://access.redhat.com/errata/RHSA-2024:2974
CVE: CVE-2023-45219
Published: 2023-10-10
Description: 
Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.




CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200
References: https://my.f5.com/manage/s/article/K20307245; https://my.f5.com/manage/s/article/K20307245
CVE: CVE-2023-45226
Published: 2023-10-10
Description: 
The BIG-IP SPK TMM (Traffic Management Module) f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with the ability to intercept traffic to impersonate the SPK Secure Shell (SSH) server on those containers. This is only exposed when ssh debug is enabled.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.4 (HIGH)
CWE: CWE-798
References: https://my.f5.com/manage/s/article/K000135874; https://my.f5.com/manage/s/article/K000135874
CVE: CVE-2023-5450
Published: 2023-10-10
Description: 
An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during the installation process. 

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.




CVSS Score: 7.3 (HIGH)
CWE: CWE-345
References: https://my.f5.com/manage/s/article/K000135040; https://my.f5.com/manage/s/article/K000135040
CVE: CVE-2023-30801
Published: 2023-10-10
Description: All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1392, CWE-798
References: https://github.com/qbittorrent/qBittorrent/issues/18731; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T5WXBKELVZFZNIDONIJESOCSRPIQNCGI/; https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U4BNFJR3ZWVLE2YSYIQYBWVDQBBZOLEL/
CVE: CVE-2023-44241
Published: 2023-10-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in Keap Keap Landing Pages plugin <= 1.4.2 versions.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/infusionsoft-landing-pages/wordpress-keap-landing-pages-plugin-1-4-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/infusionsoft-landing-pages/wordpress-keap-landing-pages-plugin-1-4-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-44470
Published: 2023-10-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in Kvvaradha Kv TinyMCE Editor Add Fonts plugin <= 1.1 versions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/kv-tinymce-editor-fonts/wordpress-kv-tinymce-editor-add-fonts-plugin-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/kv-tinymce-editor-fonts/wordpress-kv-tinymce-editor-add-fonts-plugin-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2023-44487
Published: 2023-10-10
Description: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://www.openwall.com/lists/oss-security/2023/10/10/6; http://www.openwall.com/lists/oss-security/2023/10/10/7; http://www.openwall.com/lists/oss-security/2023/10/13/4
CVE: CVE-2023-4966
Published: 2023-10-10
Description: Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-119
References: http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html; https://support.citrix.com/article/CTX579459; http://packetstormsecurity.com/files/175323/Citrix-Bleed-Session-Token-Leakage-Proof-Of-Concept.html
CVE: CVE-2023-5488
Published: 2023-10-10
Description: A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. It has been rated as critical. Affected by this issue is some unknown functionality of the file /sysmanage/updatelib.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241640. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://github.com/llixixi/cve/blob/main/s45_upload_%20updatelib.md; https://vuldb.com/?ctiid.241640; https://vuldb.com/?id.241640
CVE: CVE-2023-5499
Published: 2023-10-10
Description: Information exposure vulnerability in Shenzhen Reachfar v28, the exploitation of which could allow a remote attacker to retrieve all the week's logs stored in the 'log2' directory. An attacker could retrieve sensitive information such as remembered wifi networks, sent messages, SOS device locations and device configurations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532, CWE-532
References: https://www.incibe.es/en/incibe-cert/notices/aviso/shenzhen-reachfar-v28-information-exposure; https://www.incibe.es/en/incibe-cert/notices/aviso/shenzhen-reachfar-v28-information-exposure
CVE: CVE-2023-30802
Published: 2023-10-10
Description: The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to a source code disclosure vulnerability. A remote and unauthenticated attacker can obtain PHP source code by sending an HTTP request with an invalid Content-Length field.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-540, CWE-668
References: https://aws.amazon.com/marketplace/pp/prodview-uujwjffddxzp4; https://labs.watchtowr.com/yet-more-unauth-remote-command-execution-vulns-in-firewalls-sangfor-edition/; https://vulncheck.com/advisories/sangfor-ngaf-source
CVE: CVE-2023-30803
Published: 2023-10-10
Description: The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can bypass authentication and access administrative functionality by sending HTTP requests using a crafted Y-forwarded-for header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-290, CWE-290
References: https://aws.amazon.com/marketplace/pp/prodview-uujwjffddxzp4; https://labs.watchtowr.com/yet-more-unauth-remote-command-execution-vulns-in-firewalls-sangfor-edition/; https://vulncheck.com/advisories/sangfor-ngaf-auth-bypass
CVE: CVE-2023-30804
Published: 2023-10-10
Description: The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authenticated file disclosure vulnerability. A remote and authenticated attacker can read arbitrary system files using the svpn_html/loadfile.php endpoint. This issue is exploitable by a remote and unauthenticated attacker when paired with CVE-2023-30803.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://aws.amazon.com/marketplace/pp/prodview-uujwjffddxzp4; https://labs.watchtowr.com/yet-more-unauth-remote-command-execution-vulns-in-firewalls-sangfor-edition/; https://vulncheck.com/advisories/sangfor-ngaf-auth-file-disclosure