80 matches found
CVE-2018-16116
SQL injection vulnerability in AccountStatus.jsp in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitrary SQL commands via the "username" GET parameter...
CVE-2018-16117
A shell escape vulnerability in /webconsole/Controller in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitrary OS commands via shell metacharacters in the "dbName" POST parameter...
CVE-2018-16117
Sophos XG firewall Admin Portal (17.0.8 MR-8) contains a shell escape vulnerability in /webconsole/Controller where the POST parameter dbName can be tainted with shell metacharacters. An authenticated remote attacker can execute arbitrary OS commands on the device. The CVE is CVE-2018-16117; CV...
CVE-2018-16118
CVE-2018-16118 affects Sophos XG firewall, API Configuration component: /webconsole/APIController. A shell escape flaw allows remote attackers to execute arbitrary OS commands via shell metacharacters in the X-Forwarded-for header. Documents confirm the vulnerability and affected software (17.0.8...
CVE-2018-16118
A shell escape vulnerability in /webconsole/APIController in the API Configuration component of Sophos XG firewall 17.0.8 MR-8 allows remote attackers to execute arbitrary OS commands via shell metachracters in the "X-Forwarded-for" HTTP header...
CVE-2017-18014
An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.0.3 MR3. An unauthenticated user can trigger a persistent XSS vulnerability found in the WAF log page Control Center - Log Viewer - in the filter option "Web Server Protection" in the webadmin...
CVE-2017-18014
An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.0.3 MR3. An unauthenticated user can trigger a persistent XSS vulnerability found in the WAF log page Control Center - Log Viewer - in the filter option "Web Server Protection" in the webadmin...
Cross site scripting
An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.0.3 MR3. An unauthenticated user can trigger a persistent XSS vulnerability found in the WAF log page Control Center - Log Viewer - in the filter option "Web Server Protection" in the webadmin...
CVE-2017-18014
An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.0.3 MR3. An unauthenticated user can trigger a persistent XSS vulnerability found in the WAF log page Control Center - Log Viewer - in the filter option "Web Server Protection" in the webadmin...
CVE-2017-18014
Summary: CVE-2017-18014 affects Sophos XG Firewall with SFOS before 17.0.3 MR3. The vulnerability is a persistent XSS in the WAF log page (Control Center → Log Viewer → filter “Web Server Protection”) that is triggered by the HTTP POST User-Agent parameter. It is exploitable by an unauthenticated...
Sophos XG Firewall < 16.05.5 MR5 Multiple Vulnerabilities
Sophos XG Firewall is prone multiple vulnerabilities. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Sophos XG Firewall 16.05.4 MR-4 - Path Traversal
Sophos XG Firewall 16.05.4 MR-4 - Path Traversal Vulnerabilities Summary The following advisory describe two 2 vulnerabilities, a Path Traversal and a Missing Function Level Access Control, in Sophos XG Firewall 16.05.4 MR-4. Sophos XG Firewall provides “unprecedented visibility into your network...
Sophos XG Firewall 16.05.4 MR-4 - Path Traversal
Vulnerabilities Summary The following advisory describe two 2 vulnerabilities, a Path Traversal and a Missing Function Level Access Control, in Sophos XG Firewall 16.05.4 MR-4. Sophos XG Firewall provides “unprecedented visibility into your network, users, and applications directly from the all-n...
Sophos XG Firewall Detection
Binary data sophosxgfirewalldetect.nbin...
Sophos XG Firewall Controller filter SQL Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Sophos XG Firewall. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of the filter parameter provided to the /userportal/Controller endpoint. T...
Sophos XG Firewall (SF01V) Cross Site Scripting
Document Title: =============== Sophos XG Firewall SF01V - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1734 ID: 5740075 Release Date: ============= 2016-04-25 Vulnerability Laboratory ID VL-ID:...
Sophos XG Firewall Detection (HTTP, Admin Portal)
HTTP based detection of a Sophos XG Firewall from the admin portal. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...
Sophos XG Firewall Detection (HTTP, User Portal)
HTTP based detection of a Sophos XG Firewall from the user portal. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...
Sophos XG Firewall (SF01V) - Persistent Web Vulnerability
Document Title: =============== Sophos XG Firewall SF01V - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1734 ID: 5740075 Release Date: ============= 2016-04-25 Vulnerability Laboratory ID VL-ID:...
Sophos XG Firewall (SF01V) - Persistent Web Vulnerability
Document Title: =============== Sophos XG Firewall SF01V - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1734 ID: 5740075 Release Date: ============= 2016-04-24 Vulnerability Laboratory ID VL-ID:...