Sophos UTM 9 loginuser Privilege Escalation Via Insecure Directory Permissions

KL-001-2017-020 : Sophos UTM 9 loginuser Privilege Escalation via Insecure Directory Permissions Title: Sophos UTM 9 loginuser Privilege Escalation via Insecure Directory Permissions Advisory ID: KL-001-2017-020 Publication Date: 2017.10.24 Publication URL:...

Sophos UTM 9 loginuser Privilege Escalation via Insecure Directory Permissions

Vulnerability Details Affected Vendor: Sophos Affected Product: UTM 9 Affected Version: 9.410 Platform: Embedded Linux CWE Classification: CWE-280: Improper Handling of Insufficient Permissions or Privileges Impact: Root Access Attack vector: SSH 2. Vulnerability Description The attacker must...

Sophos UTM 9 Management Application Local File Inclusion

Vulnerability Details Affected Vendor: Sophos Affected Product: UTM 9 Affected Version: 9.410 Platform: Embedded Linux CWE Classification: CWE-538: File and Directory Information Exposure, CWE-264: Permissions, Privileges, and Access Controls, CWE-532: Information Exposure Through Log Files...

Sophos Cyberoam UTM/NGFW Detection (HTTP)

HTTP based detection of Sophos Cyberoam UTM/NGFW. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2016-7786

Sophos Cyberoam UTM CR25iNG 10.6.3 MR-5 allows remote authenticated users to bypass intended access restrictions via direct object reference, as demonstrated by a request for Licenseinformation.jsp. This is fixed in 10.6.5...

Design/Logic Flaw

Sophos Cyberoam UTM CR25iNG 10.6.3 MR-5 allows remote authenticated users to bypass intended access restrictions via direct object reference, as demonstrated by a request for Licenseinformation.jsp. This is fixed in 10.6.5...

CVE-2016-7786

Sophos Cyberoam UTM CR25iNG 10.6.3 MR-5 allows remote authenticated users to bypass intended access restrictions via direct object reference, as demonstrated by a request for Licenseinformation.jsp. This is fixed in 10.6.5...

CVE-2016-7786

CVE-2016-7786 affects Sophos Cyberoam UTM CR25iNG 10.6.3 MR-5. The vulnerability is an Insecure Direct Object Reference in Licenseinformation.jsp that allows remote authenticated users to bypass access controls. The issue stems from insufficient input handling in the Access Restriction component,...

Sophos UTM Frontend Component Information Disclosure Vulnerability

Sophos UTM aka Astaro Security Gateway is a suite of unified threat management appliances from Sophos UK. The appliance provides gateway security protection and endpoint security protection. An information disclosure vulnerability exists in the Frontend component of Sophos UTM using firmware...

Cyberoam iview UTM 0.1.2.7 Cross Site Scripting

Document Title: =============== Cyberoam iview UTM v0.1.2.7 - Ajax XSS Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1850 Cyberoam ID: 1059276 Security ID: NCR-2064 Release Date: ============= 2016-10-04 Vulnerability Laboratory ID...

CVE-2016-7442

The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "value" field of the proxy user settings in "system settings / scan settings / anti spam" configuration tab...

CVE-2016-7397

The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "value" field of the SMTP user settings in the notifications configuration tab...

CVE-2016-7397

The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "value" field of the SMTP user settings in the notifications configuration tab...

Design/Logic Flaw

The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "value" field of the SMTP user settings in the notifications configuration tab...

Design/Logic Flaw

The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "value" field of the proxy user settings in "system settings / scan settings / anti spam" configuration tab...

CVE-2016-7442

The CVE-2016-7442 entry concerns Sophos UTM, specifically the Frontend component. Firmware 9.405-5 and earlier expose an information-disclosure vulnerability by allowing local administrators to read the password value from the proxy user settings in System Settings / Scan Settings / Anti Spam. Af...

CVE-2016-7397

The CVE-2016-7397 vulnerability affects the Sophos UTM Frontend component (firmware 9.405-5 and earlier). A local administrator can disclose sensitive password information by reading the value field of the SMTP user settings in the Notifications configuration tab. Public disclosures and multiple ...

CVE-2016-7397

The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "value" field of the SMTP user settings in the notifications configuration tab...

Sophos UTM 9.405-5 / 9.404-5 Information Disclosure Vulnerability

Sophos UTM versions 9.405-5 and 9.404-5 suffer from information disclosure vulnerabilities. Product: Sophos UTM Vendor: Sophos ltd. Internal reference: ? Bug ID Vulnerability type: Information Disclosure Vulnerable version: 9.405-5, 9.404-5 and possible other versions affected not tested Vulnerab...

Sophos UTM 9.405-5 / 9.404-5 Information Disclosure

Product: Sophos UTM Vendor: Sophos ltd. Internal reference: ? Bug ID Vulnerability type: Information Disclosure Vulnerable version: 9.405-5, 9.404-5 and possible other versions affected not tested Vulnerable component: Frontend Report confidence: yes Solution status: Not fixed by Vendor, no furth...