Sophos: Security Vulnerabilities
A local attacker could read or write arbitrary files with administrator privileges in HitmanPro before version Build 318.
CVSS Score
6.0
EPSS Score
0.002
Published
2021-10-08
Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.
CVSS Score
4.8
EPSS Score
0.008
Published
2021-07-29
In multiple versions of Sophos Endpoint products for MacOS, a local attacker could execute arbitrary code with administrator privileges.
CVSS Score
6.7
EPSS Score
0.003
Published
2021-05-17
A malicious website could execute code remotely in Sophos Connect Client before version 2.1.
CVSS Score
8.8
EPSS Score
0.018
Published
2021-03-22
CVE-2020-29574
An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.
Known exploited
CVSS Score
9.8
EPSS Score
0.047
Published
2020-12-11
CVE-2020-25223
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11
Known exploited
CVSS Score
9.8
EPSS Score
0.967
Published
2020-09-25
Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through 2020-08-05 potentially allow an authenticated attacker to remotely execute arbitrary code.
CVSS Score
8.8
EPSS Score
0.041
Published
2020-08-07
A SQL injection vulnerability in the user and admin web interfaces of Sophos XG Firewall v18.0 MR1 and older potentially allows an attacker to run arbitrary code remotely. The fix is built into the re-release of XG Firewall v18 MR-1 (named MR-1-Build396) and the v17.5 MR13 release. All other versions >= 17.0 have received a hotfix.
CVSS Score
9.8
EPSS Score
0.021
Published
2020-07-10
CVE-2020-15069
Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.
Known exploited
CVSS Score
9.8
EPSS Score
0.107
Published
2020-06-29
The Sophos Secure Email application through 3.9.4 for Android has Missing SSL Certificate Validation.
CVSS Score
5.9
EPSS Score
0.011
Published
2020-06-22