CVE-2022-48310

Sophos Connect has an information disclosure vulnerability affecting versions earlier than 2.2.90, where sensitive key material can be included in technical support archives. This issue is confirmed across multiple sources (e.g., Red Hat, PT Security, CVE records) and is resolved by upgrading to ...

CVE-2022-4901

Sophos Connect (VPN client) is affected by multiple stored XSS vulnerabilities in versions prior to 2.2.90, allowing Javascript execution in the local UI when a malicious VPN configuration is manually loaded by the victim. Impact is limited to the local UI; no exploitation details are provided be...

CVE-2022-48309

CVE-2022-48309 is a CSRF vulnerability in Sophos Connect prior to 2.2.90. Exploitation could allow a malicious site to retrieve logs and technical support archives, impacting confidentiality (CVSS v3.1 base score 4.3, MEDIUM). Affected product: Sophos Connect (versions before 2.2.90). Root cause:...

CVE-2021-25265

CVE-2021-25265 affects Sophos Connect Client prior to v2.1, where a malicious website could remotely execute code on a user’s system. The vulnerability is triggered when a user visits a malicious site, with network-based access and user interaction potentially required depending on variant, and r...