CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 0CVE-2012-4736
https://notcve.org/view.php?id=CVE-2012-4736
The Device Encryption Client component in Sophos SafeGuard Enterprise 6.0, when a volume-based encryption policy is enabled in conjunction with a user-defined key, does not properly block use of exFAT USB flash drives, which makes it easier for local users to bypass intended access restrictions and copy sensitive information to a drive via multiple removal and reattach operations. El componente Device Encryption Client en Sophos SafeGuard Enterprise 6.0 cuando una política de cifrado volume-based es habilitada en conjunción con una clave user-defined, no bloquea el acceso adecuadamente a dispositivos USB exFAT, lo que hace más fácil para usuarios locales evitar restricciones de acceso establecidas y copiar información sensible en un disco a través de múltiples operaciones de removal y reattach. • http://www.sophos.com/support/knowledgebase/1376/1380/114138.aspx https://exchange.xforce.ibmcloud.com/vulnerabilities/78580 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.2EPSS: 0%CPEs: 2EXPL: 0CVE-2010-5177
https://notcve.org/view.php?id=CVE-2010-5177
Race condition in Sophos Endpoint Security and Control 9.0.5 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack. NOTE: the vendor disputes this issue because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute ** EN DISPUTA ** Condición de carrera en Sophos Endpoint Security and Control v9.0.5 sobre Windows XP permite a usuarios locales evitar manejadores de kernel-mode hook, y ejecutar código malicioso que podría ser bloquedo por un manejador pero no por un detector de malware signature-based, a través de ciertos cambios en memoria user-space durante la ejecución de hook-handler , también conocido por argument-switch attack o ataque KHOBE. Nota: este problema está en disputa por terceras partes. • http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php http://nakedsecurity.sophos.com/2010/05/11/khobe-vulnerability-earth-shaker http://nakedsecurity.sophos.com/2010 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.9EPSS: 0%CPEs: 15EXPL: 0CVE-2011-5117
https://notcve.org/view.php?id=CVE-2011-5117
Sophos SafeGuard Enterprise Device Encryption 5.x through 5.50.8.13, Sophos SafeGuard Easy Device Encryption Client 5.50.x, and Sophos Disk Encryption 5.50.x have a delay before removal of (1) out-of-date credentials and (2) invalid credentials, which allows physically proximate attackers to defeat the full-disk encryption feature by leveraging knowledge of these credentials. Sophos SafeGuard Enterprise Device Encryption v5.x hasta v5.50.8.13, Sophos SafeGuard Easy Device Encryption Client v5.50.x, y Sophos Disk Encryption 5.50.x tienen cierto retraso antes de eliminar (1) credenciales antiguas y(2) credenciales inválidas, lo que podría permitir a atacantes físicamente próximos, conseguir vulnerar la función de cifrado del disco, aprovechando el conocimiento de estas credenciales. • http://www.sophos.com/en-us/support/knowledgebase/112655.aspx • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 1CVE-2012-3238
https://notcve.org/view.php?id=CVE-2012-3238
Cross-site scripting (XSS) vulnerability in the Backup/Restore component in WebAdmin in Astaro Security Gateway before 8.305 allows remote attackers to inject arbitrary web script or HTML via the "Comment (optional)" field. vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el componente Backup/Restore en WebAdmin en Astaro Security Gateway anteriores a v8.305, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del campo "Comment (opcional)". • http://archives.neohapsis.com/archives/fulldisclosure/2012-06/0206.html http://security.inshell.net/advisory/27 http://www.astaro.com/en-uk/blog/up2date/8305 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 74%CPEs: 2EXPL: 0CVE-2012-1458
https://notcve.org/view.php?id=CVE-2012-1458
The Microsoft CHM file parser in ClamAV 0.96.4 and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via a crafted reset interval in the LZXC header of a CHM file. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CHM parser implementations. El analizador de archivos CHM de Microsoft en ClamAV v0.96.4 y Sophos Anti-Virus v4.61.0 permite a atacantes remotos evitar la detección de malware a través de un intervalo de restablecimiento manipulado en la cabecera LZXC de un archivo CHM. NOTA: esto más adelante se puede dividir en varios CVEs si la información adicional que se publica muestra que el error se produjo de forma independiente en diferentes implementaciones del analizador de CHM. • http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00002.html http://osvdb.org/80473 http://osvdb.org/80474 http://www.ieee-security.org/TC/SP2012/program.html http://www.mandriva.com/security/advisories?name=MDVSA-2012:094 http://www.securityfocus.com/archive/1/522005 http://www.securityfocus.com/bid/52611 https://exchange.xforce.ibmcloud.com/vulnerabilities/74301 • CWE-264: Permissions, Privileges, and Access Controls •