CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-3713
https://notcve.org/view.php?id=CVE-2022-3713
A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA. Una vulnerabilidad de inyección de código permite a atacantes adyacentes ejecutar código en el controlador Wifi de versiones de Sophos Firewall anteriores a la versión 19.5 GA. • https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.4EPSS: 0%CPEs: 2EXPL: 0CVE-2021-25268
https://notcve.org/view.php?id=CVE-2021-25268
Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA. Múltiples vulnerabilidades de tipo XSS en Webadmin permiten la escalada de privilegios de MySophos admin a SFOS admin en Sophos Firewall versiones anteriores a 19.0 GA • https://www.sophos.com/en-us/security-advisories/sophos-sa-20220505-sfos-19-0-0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-25267
https://notcve.org/view.php?id=CVE-2021-25267
Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 GA. Múltiples vulnerabilidades de tipo XSS en Webadmin permiten una escalada de privilegios de admin a super-admin en Sophos Firewall versiones anteriores a 19.0 GA • https://www.sophos.com/en-us/security-advisories/sophos-sa-20220505-sfos-19-0-0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 14EXPL: 0CVE-2020-17352
https://notcve.org/view.php?id=CVE-2020-17352
Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through 2020-08-05 potentially allow an authenticated attacker to remotely execute arbitrary code. Dos vulnerabilidades de inyección de comandos de Sistema Operativo en el portal de Usuario de Sophos XG Firewall hasta el 05-08-2020, permiten potencialmente a un atacante autenticado ejecutar código arbitrario remotamente • https://community.sophos.com/b/security-blog https://community.sophos.com/b/security-blog/posts/advisory-resolved-authenticated-rce-issues-in-user-portal-cve-2020-17352 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 14EXPL: 0CVE-2020-15504
https://notcve.org/view.php?id=CVE-2020-15504
A SQL injection vulnerability in the user and admin web interfaces of Sophos XG Firewall v18.0 MR1 and older potentially allows an attacker to run arbitrary code remotely. The fix is built into the re-release of XG Firewall v18 MR-1 (named MR-1-Build396) and the v17.5 MR13 release. All other versions >= 17.0 have received a hotfix. Una vulnerabilidad de inyección SQL en las interfaces web de usuario y administrador de Sophos XG Firewall versiones v18.0 MR1 y anteriores, permite potencialmente a un atacante ejecutar código arbitrario remotamente. La corrección está incorporada en el relanzamiento de XG Firewall versión v18 MR-1 (llamado MR-1-Build396) y la versión v17.5 MR13. • https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-via-sqli-cve-2020-15504 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •