426 matches found
Rockwell Automation ISaGRAF5 Runtime Uncontrolled Search Path Element (CVE-2020-25182)
Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allow a local, unauthenticated attacker to execute arbitrary code. This vulnerability only affects ISaGRAF Runtime when running on Microsoft...
Sophos SG UTM Remote Code Execution Vulnerability
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM...
VulnCheck KEV: CVE-2020-25223
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM...
Sophos UTM log information leakage vulnerability
Sophos UTM is a next-generation firewall. a security vulnerability existed prior to Sophos UTM 9.710, which stems from the fact that Confd log files contain SHA512crypt password hashes for local users including the root user with insecure access rights, which can be exploited by attackers to...
CVE-2022-0386
A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM before version 9.710...
CVE-2022-0386
A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM before version 9.710...
CVE-2022-0386
A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM before version 9.710...
CVE-2022-0652
Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt off-line brute-force attacks against these password hashes in Sophos UTM before version 9.710...
Default credentials
Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt off-line brute-force attacks against these password hashes in Sophos UTM before version 9.710...
Sql injection
A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM before version 9.710...
CVE-2022-0652
Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt off-line brute-force attacks against these password hashes in Sophos UTM before version 9.710...
CVE-2022-0652
Sophos UTM vulnerability CVE-2022-0652 involves insecure permissions on Confd log files containing SHA512crypt password hashes for local users (including root). A local attacker could perform offline brute-force attacks on these hashes. Affected products are Sophos UTM versions prior to 9.710. Re...
CVE-2022-0386
A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM before version 9.710...
CVE-2022-0386
CVE-2022-0386 is a post-auth SQL injection vulnerability in Sophos UTM’s Mail Manager. The issue could allow an authenticated attacker to execute code on affected appliances, prior to version 9.710. Evidence from multiple sources confirms the vulnerability in Sophos UTM, with CVSS data indicating...
Vulnerabilities fixed in Sophos SG UTM
Vulnerabilities have been fixed in Sophos SG UTM. The vulnerabilities allow a malicious person to launch attacks that lead to the following categories of damage: Denial-of-Service DoS SQL Injection Access to sensitive data Sophos has fixed the vulnerabilities in SG UTM version 9.710. More...
Stormshield Network Security Code Issue Vulnerability
Stormshield Network Security is a next-generation UTM Unified Threat Management firewall from Stormshield France. Stormshield Network Security SNS suffers from a code issue vulnerability that stems from the first SSH password change not properly clearing the old password under certain update...
Vulnerability fixed in Sophos SG UTM
A SQL injection vulnerability has been fixed in the user portal of Sophos SG UTM. An authenticated user could potentially execute arbitrary code. Sophos has released updates to fix the vulnerabilities. For more information, see: https://www.sophos.com/en-us/security-advisories...
Code injection
An authenticated user could potentially execute code via an SQLi vulnerability in the user portal of SG UTM before version 9.708 MR8...
CVE-2021-36807
Sophos SG UTM (user portal) is affected by an SQL injection vulnerability that allows an authenticated user to potentially execute code. Root cause: improper SQL handling in the user portal before version 9.708 MR8. Impact: authenticated code execution with high severity; affects confidentiality,...