CVE-2013-2641

CVE-2013-2641 concerns Sophos Web Protection Appliance (patience.cgi) with a directory traversal vulnerability. Exploitation via the id parameter could allow an unauthenticated remote attacker to read arbitrary files on the affected appliance. Public references in connected documents indicate the...

CVE-2013-4983

CVE-2013-4983 affects Sophos Web Protection Appliance via the sblistpack component (get_referers) in /opt/ws/bin/sblistpack. Versions affected: pre-3.7.9.1 and pre-3.8.1.1 (i.e., 3.7.9.1 and 3.8.1.1 patched). The vulnerability allows remote command execution by injecting shell metacharacters into...

CVE-2014-2850

CVE-2014-2850 affects Sophos Web Appliance: the netinterface (network interface configuration) page allows remote administrators to execute arbitrary shell commands via metacharacters in the address parameter, on affected versions prior to 3.8.2. Public references and feeds corroborate remote com...

CVE-2013-2642

Vulnerability : CVE-2013-2642 affects Sophos Web Protection Appliance (pre-3.7.8.2). The issue enables OS command injection in multiple contexts: (1) OS commands via the Block page when a customized template uses the client-ip variable, (2) commands via the Diagnostic Tools URL parameter, and (3)...

CVE-2013-2643

CVE-2013-2643 is a reflected XSS affecting Sophos Web Protection Appliance up to version 3.7.8.1 (fixed in 3.7.8.2). The vulnerability arises from improper sanitization in multiple web interfaces, allowing remote attackers to inject arbitrary script/HTML via: the xss parameter in rss.php, the msg...

CVE-2014-2849

The CVE-2014-2849 issue affects Sophos Web Appliance (versions up to 3.8.1.x). A flaw in the Change Password dialog (change_password) allows remote authenticated users to change the admin password, potentially enabling privilege escalation. Red Hat confirms the vulnerability; ZDI and other adviso...