Cross site request forgery (csrf)

A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90...

Information disclosure

An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versions older than 2.2.90...

GHSA-9HHC-PJ4W-W5RV Keycloak Cross-site Scripting on OpenID connect login service

A reflected cross-site scripting XSS vulnerability was found in the oob OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page...

CVE-2022-48310

An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versions older than 2.2.90...

CVE-2022-48309

A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90...

PT-2023-15687 · Sophos · Sophos Connect

Name of the Vulnerable Software and Affected Versions: Sophos Connect versions prior to 2.2.90 Description: A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives. Recommendations: For Sophos Connect versions prior to 2.2.90, update to version 2.2.90 or lat...

Sophos Connect 安全漏洞

Sophos Connect is a VPN client from Sophos UK. A security vulnerability exists in Sophos Connect version 2.2.90 and prior versions, which stems from an information disclosure vulnerability in the technical support archive. An attacker could exploit the vulnerability to obtain sensitive key materi...

PT-2023-15689 · Sophos · Sophos Connect

Name of the Vulnerable Software and Affected Versions: Sophos Connect versions prior to 2.2.90 Description: An information disclosure issue allows sensitive key material to be included in technical support archives. Recommendations: For Sophos Connect versions prior to 2.2.90, update to version...

CVE-2022-4901

Sophos Connect (VPN client) is affected by multiple stored XSS vulnerabilities in versions prior to 2.2.90, allowing Javascript execution in the local UI when a malicious VPN configuration is manually loaded by the victim. Impact is limited to the local UI; no exploitation details are provided be...

PT-2023-15910 · Sophos · Sophos Connect

Name of the Vulnerable Software and Affected Versions: Sophos Connect versions prior to 2.2.90 Description: The issue allows Javascript code to run in the local UI via a malicious VPN configuration that must be manually loaded by the victim. This is achieved through multiple stored XSS...

CVE-2022-48309

A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90...

CVE-2022-4901

Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a malicious VPN configuration that must be manually loaded by the victim...

Sophos Connect 跨站请求伪造漏洞

Sophos Connect is a VPN client from Sophos UK. A security vulnerability exists in Sophos Connect version 2.2.90 and prior versions. An attacker could exploit this vulnerability to perform cross-site request forgery attacks...

CVE-2022-48310

An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versions older than 2.2.90...

CVE-2022-4901

Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a malicious VPN configuration that must be manually loaded by the victim...

Sophos Connect 跨站脚本漏洞

Sophos Connect is a VPN client from Sophos UK. A security vulnerability exists in Sophos Connect versions prior to 2.2.90, which stems from the presence of a stored XSS vulnerability that can be exploited by an attacker to execute Javascript code...

CVE-2022-48310

Sophos Connect has an information disclosure vulnerability affecting versions earlier than 2.2.90, where sensitive key material can be included in technical support archives. This issue is confirmed across multiple sources (e.g., Red Hat, PT Security, CVE records) and is resolved by upgrading to ...

CVE-2022-48309

CVE-2022-48309 is a CSRF vulnerability in Sophos Connect prior to 2.2.90. Exploitation could allow a malicious site to retrieve logs and technical support archives, impacting confidentiality (CVSS v3.1 base score 4.3, MEDIUM). Affected product: Sophos Connect (versions before 2.2.90). Root cause:...

CVE-2023-0264

A flaw was found in Keycloak's OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issu...

The vulnerability of Adobe Connect’s instant messaging program, related to deficiencies in access control, allows attackers to circumvent existing security restrictions.

The vulnerability of Adobe Connect’s instant messaging program is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to bypass existing security restrictions remotely...