CVE-2024-12728

A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 20.0.3...

CVE-2024-12729

A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1 21.0.1...

CVE-2024-12727

A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 21.0.1 allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eXchange SPX is enabled in combination with the...

CVE-2024-12729

A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1 21.0.1...

CVE-2024-12729

CVE-2024-12729 is a post-auth code injection vulnerability in the Sophos Firewall User Portal, affecting versions prior to 21.0 MR1 (21.0.1). The issue allows authenticated users to remotely execute code on the device. Public documentation highlights remediation by upgrading to 21.0 MR1 or newer ...

CVE-2024-12729

A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1 21.0.1...

CVE-2024-12728

CVE-2024-12728 is a weak credentials vulnerability in Sophos Firewall prior to 20.0 MR3 (20.0.3) that could allow privileged SSH access, notably in HA clusters. Affects HA initialisation with non-random passphrases; CVSS 9.8. Remediation: upgrade to 20.0 MR3 or newer (and 21.x MR1+ where applicab...

CVE-2024-12728

A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 20.0.3...

CVE-2024-12728

A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 20.0.3...

CVE-2024-12727

CVE-2024-12727 is a pre-auth SQL injection affecting Sophos Firewall’s email protection feature on versions older than 21.0 MR1 (21.0.1). The underlying issue can allow access to the reporting database and, in combination with a specific Secure PDF eXchange (SPX) configuration and HA mode, may le...

CVE-2024-12727

A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 21.0.1 allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eXchange SPX is enabled in combination with the...

CVE-2024-12727

A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 21.0.1 allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eXchange SPX is enabled in combination with the...

QNAP Systems QuFirewall 命令注入漏洞

QNAP Systems QuFirewall is a built-in firewall application for QNAP devices from China Weilian Technology QNAP Systems. A command injection vulnerability exists in QNAP Systems QuFirewall version 2.3 that originates from allowing a remote attacker who has gained administrator access to execute...

PT-2024-9755

Name of the Vulnerable Software and Affected Versions Sophos Firewall versions prior to 21.0 MR1 21.0.1 Description A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely. The issue is related to incorrect code generation management. This...

Sophos Firewall 安全漏洞

Sophos Firewall is a firewall from Sophos UK. A security vulnerability exists in versions prior to Sophos Firewall 21.0 MR1 21.0.1. An attacker can inject code by exploiting the vulnerability...

(0Day) Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Arista NG Firewall. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the uvmlogin...

PT-2024-17750 · Arista · Arista Ng Firewall

Name of the Vulnerable Software and Affected Versions: Arista NG Firewall affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is not required to exploit this issue. The specific...

Sophos Firewall 安全漏洞

Sophos Firewall is a firewall from Sophos UK. A security vulnerability exists in versions prior to Sophos Firewall 20.0 MR3 20.0.3. An attacker exploiting this vulnerability could access the firewall as a privileged system via SSH...

PT-2024-9754

Name of the Vulnerable Software and Affected Versions Sophos Firewall versions prior to 21.0 MR1 21.0.1 Description A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall allows access to the reporting database and can lead to remote code execution if a specific...

(0Day) Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability

This vulnerability allows remote attackers to create arbitrary files and disclose sensitive information on affected installations of Arista NG Firewall. Authentication is required to exploit this vulnerability. The specific flaw exists within the ReportEntry class. The issue results from the lack...