Cross site scripting

A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version 19.5 GA...

Command injection

An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA...

Sql injection

A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API controller of Sophos Firewall releases older than version 19.5 GA...

Code injection

A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA...

PT-2022-23805 · Sophos · Sophos Firewall

Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 19.5 GA Description: A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard. Recommendations: For Sophos Firewall versions prior to 19.5 GA, update to...

PT-2022-5775 · NetGear · Netgear Rax30 Ax2400

Name of the Vulnerable Software and Affected Versions: NETGEAR RAX30 AX2400 series of routers versions prior to 1.0.9.90 Description: A network misconfiguration is present in the affected devices, where IPv6 is enabled for the WAN interface by default. However, the firewall restrictions in place...

PT-2022-6071 · Sophos · Sophos Firewall

Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 19.5 GA Description: The issue is related to a post-auth read-only SQL injection vulnerability in the User Portal component of Sophos Firewall. This vulnerability can be exploited by a remote attacker to gain...

Sophos Firewall 代码注入漏洞

Sophos Firewall is a firewall from Sophos UK. A code injection vulnerability exists in versions prior to Sophos Firewall 19.5GA, which originates from an administrator being able to implement code execution in Webadmin via code injection...

Sophos Firewall 代码注入漏洞

Sophos Firewall is a firewall from Sophos UK. A code injection vulnerability exists in versions prior to Sophos Firewall 19.5GA, which stems from an adjacent attacker being able to execute code in its Wifi controller via code injection implementation...

CVE-2022-3696

The CVE-2022-3696 entry describes a post-auth code-injection vulnerability in Sophos Firewall Webadmin, affecting releases prior to 19.5 GA. The issue allows an administrator to execute code via the Webadmin interface with high impact (code execution, confidentiality/ integrity/ availability impa...

CVE-2022-3226

The CVE-2022-3226 issue affects Sophos Firewall (older than 19.5 GA), where an OS command injection can be triggered by uploading SSL VPN configuration files. Root cause details are not elaborated beyond the exposure via configuration uploads in the cited advisories. The vulnerability impacts adm...

CVE-2022-3226

An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA...

CVE-2022-3709

The CVE-2022-3709 entry describes a stored XSS in Sophos Firewall’s Webadmin import group wizard that enables a regular admin to escalate to super-admin privileges on versions older than 19.5 GA. Affected product: Sophos Firewall (Webadmin import group wizard). Root cause: stored cross-site scrip...

CVE-2022-3713

CVE-2022-3713 affects Sophos Firewall pre-19.5 GA. An adjacent attacker can inject code into the Wifi controller, with CVSSv3.1: AV Adjacent, AC Low, PR None, UI None, S Unchanged, C/H/I/A High (base 8.8). Exploitation is described as requiring no user interaction. Remediation per sources is to u...

Sophos Firewall SQL注入漏洞

Sophos Firewall is a firewall from Sophos UK. A SQL injection vulnerability exists in versions prior to Sophos Firewall 19.5GA that allows an API client to read the contents of its user's configuration database via SQL injection...

CVE-2022-3709

A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version 19.5 GA...

CVE-2022-3713

A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA...

PT-2022-6069 · Sophos · Sophos Firewall

Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 19.5 GA Description: A post-auth read-only SQL injection issue allows API clients to read non-sensitive configuration database contents in the API controller. This can enable a remote attacker to gain...

CVE-2022-3710

A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API controller of Sophos Firewall releases older than version 19.5 GA...

CVE-2022-3709

A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version 19.5 GA...