13905 matches found
CVE-2025-7382
Summary (CVE-2025-7382) : A command-injection vulnerability exists in the WebAdmin component of Sophos Firewall versions older than 21.0 MR2 (21.0.2). If OTP authentication for the admin user is enabled, adjacent attackers can achieve pre-auth code execution on High Availability (HA) auxiliary de...
CVE-2025-7624
An SQL injection vulnerability in the legacy transparent SMTP proxy of Sophos Firewall versions older than 21.0 MR2 21.0.2 can lead to remote code execution, if a quarantining policy is active for Email and SFOS was upgraded from a version older than 21.0 GA...
CVE-2025-7624
An SQL injection vulnerability in the legacy transparent SMTP proxy of Sophos Firewall versions older than 21.0 MR2 21.0.2 can lead to remote code execution, if a quarantining policy is active for Email and SFOS was upgraded from a version older than 21.0 GA...
CVE-2025-7624
CVE-2025-7624 is a SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall, fixed in 21.0 MR2 (21.0.2) and older versions may allow remote code execution if a quarantining policy is active and SFOS was upgraded from a version older than 21.0 GA. The affected software...
CVE-2025-6704
An arbitrary file writing vulnerability in the Secure PDF eXchange SPX feature of Sophos Firewall versions older than 21.0 MR2 21.0.2 can lead to pre-auth remote code execution, if a specific configuration of SPX is enabled in combination with the firewall running in High Availability HA mode...
CVE-2025-6704
CVE-2025-6704 is an arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall . The pre-auth remote code execution condition requires a specific SPX configuration enabled in combination with the firewall running in High Availability (HA) mode. Multiple sourc...
CVE-2025-6704
An arbitrary file writing vulnerability in the Secure PDF eXchange SPX feature of Sophos Firewall versions older than 21.0 MR2 21.0.2 can lead to pre-auth remote code execution, if a specific configuration of SPX is enabled in combination with the firewall running in High Availability HA mode...
PT-2025-30272 ยท Sophos ยท Sophos Firewall
Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 21.0 MR2 21.0.2 Description: A command injection vulnerability exists in the WebAdmin component of Sophos Firewall. This issue can allow adjacent attackers to achieve pre-authentication code execution on High...
(Pwn2Own) Phoenix Contact CHARX SEC-3150 Origin Validation Error Firewall Bypass Vulnerability
This vulnerability allows network-adjacent attackers to bypass firewall rules and access another interface on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of firewa...
Sophos Firewall ๅฎๅ จๆผๆด
Sophos Firewall is a firewall from Sophos UK. A security vulnerability exists in Sophos Firewall versions prior to 21.0 MR1, which stems from a SQL injection in WebAdmin that could lead to the execution of arbitrary code by an administrator...
PT-2025-30270 ยท Sophos ยท Sophos Firewall
Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 21.0 MR1 20.0.1 Description: A business logic vulnerability exists in the Up2Date component of Sophos Firewall. This vulnerability could allow attackers to control the firewallโs DNS environment, potentially...
Sophos Firewall ๅฎๅ จๆผๆด
Sophos Firewall is a firewall from Sophos UK. A security vulnerability exists in Sophos Firewall versions prior to 21.0 MR2, which stems from the presence of an arbitrary file write in the Secure PDF eXchange feature that could lead to pre-authenticated remote code execution...
Sophos Firewall ๅฎๅ จๆผๆด
Sophos Firewall is a firewall from Sophos UK. A security vulnerability exists in Sophos Firewall versions prior to 21.0.2, which stems from a command injection issue in WebAdmin that could lead to pre-authenticated code execution...
PT-2025-30273 ยท Sophos ยท Sophos Firewall
Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 21.0 MR2 21.0.2 Description: An SQL injection vulnerability exists in the legacy transparent SMTP proxy. Successful exploitation can lead to remote code execution if a quarantining policy is active for Email...
Sophos Firewall ๅฎๅ จๆผๆด
Sophos Firewall is a firewall from Sophos UK. A security vulnerability exists in Sophos Firewall versions prior to 21.0.2, which stems from a SQL injection issue in the SMTP proxy that could lead to remote code execution...
PT-2025-30269 ยท Sophos ยท Sophos Firewall
Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 21.0 MR1 21.0.1 Description: A post-authentication SQL injection vulnerability exists in the WebAdmin component. Successful exploitation can potentially allow administrators to achieve arbitrary code executio...
Sophos Firewall ๅฎๅ จๆผๆด
Sophos Firewall is a firewall from Sophos UK. A security vulnerability exists in Sophos Firewall versions prior to 21.0 MR1 that stems from a business logic issue in the Up2Date component that could allow an attacker to take control of the DNS environment and execute remote code...
PT-2025-30271 ยท Sophos ยท Sophos Firewall
Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 21.0 MR2 21.0.2 Description: An arbitrary file writing vulnerability exists in the Secure PDF eXchange SPX feature. This can lead to pre-authentication remote code execution when SPX is enabled with a specifi...
Panoramic Corporation Digital Imaging Software
RISK EVALUATION Successful exploitation of this vulnerability could allow a standard user to obtain NT Authority/SYSTEM privileges. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network...
Fortinet FortiWeb SQLๆณจๅ ฅๆผๆด
Fortinet FortiWeb is a Web application layer firewall from Fiat Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures Web applications and protects sensitive database content. A SQL injection vulnerability exists in...