CVSS: 10.0EPSS: 1%CPEs: 8EXPL: 1CVE-2019-17059
https://notcve.org/view.php?id=CVE-2019-17059
11 Oct 2019 — A shell injection vulnerability on the Sophos Cyberoam firewall appliance with CyberoamOS before 10.6.6 MR-6 allows remote attackers to execute arbitrary commands via the Web Admin and SSL VPN consoles. Una vulnerabilidad de inyección de shell en el dispositivo de firewall Sophos Cyberoam con CyberoamOS versiones anteriores a 10.6.6 MR-6, permite a atacantes remotos ejecutar comandos arbitrarios por medio de las consolas de Web Admin y SSL VPN. • https://community.sophos.com/kb/en-us/134732 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-16116
https://notcve.org/view.php?id=CVE-2018-16116
20 Jun 2019 — SQL injection vulnerability in AccountStatus.jsp in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitrary SQL commands via the "username" GET parameter. Vulnerabilidad de inyección de SQL en AccountStatus.jsp en el Portal de administración del firewall Sophos XG 17.0.8 MR-8 permite a atacantes remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro GET del "username". • https://community.sophos.com/kb/en-us/132637 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2018-16117
https://notcve.org/view.php?id=CVE-2018-16117
20 Jun 2019 — A shell escape vulnerability in /webconsole/Controller in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitrary OS commands via shell metacharacters in the "dbName" POST parameter. Una vulnerabilidad de escape de shell en /webconsole/Controller en el Portal de Administración de Sophos XG firewall versión 17.0.8 MR-8, permite a atacantes remotos autenticados ejecutar comandos de sistema operativo arbitrarios por medio de meta caracteres shell en el parámetro... • https://community.sophos.com/kb/en-us/132637 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.3EPSS: 0%CPEs: 6EXPL: 0CVE-2018-16118
https://notcve.org/view.php?id=CVE-2018-16118
20 Jun 2019 — A shell escape vulnerability in /webconsole/APIController in the API Configuration component of Sophos XG firewall 17.0.8 MR-8 allows remote attackers to execute arbitrary OS commands via shell metachracters in the "X-Forwarded-for" HTTP header. Una vulnerabilidad de escape de shell en /webconsole/APIController en el componente Configuration API Sophos XG firewall versión 17.0.8 MR-8, permite a los atacantes remotos ejecutar comandos arbitrarios del sistema operativo por medio de meta caracteres shell en el... • https://community.sophos.com/kb/en-us/132637 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-17023
https://notcve.org/view.php?id=CVE-2017-17023
09 Apr 2019 — The Sophos UTM VPN endpoint interacts with client software provided by NPC Engineering (www.ncp-e.com). The affected client software, "Sophos IPSec Client" 11.04 is a rebranded version of NCP "Secure Entry Client" 10.11 r32792. A vulnerability in the software update feature of the VPN client allows a man-in-the-middle (MITM) or man-on-the-side (MOTS) attacker to execute arbitrary, malicious software on a target user's computer. This is related to SIC_V11.04-64.exe (Sophos), NCP_EntryCl_Windows_x86_1004_3179... • https://www.ncp-e.com/en/resources/download-vpn-client/#c8680 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-3970
https://notcve.org/view.php?id=CVE-2018-3970
25 Oct 2018 — An exploitable memory disclosure vulnerability exists in the 0x222000 IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP request can cause the driver to return uninitialized memory, resulting in kernel memory disclosure. An attacker can send an IRP request to trigger this vulnerability. Existe una vulnerabilidad explotable de divulgación de memoria en la funcionalidad de manejo de llamadas IOCTL 0x222000 de Sophos HitmanPro.Alert 3.7.6.744. Una petición IRP especialment... • http://www.securityfocus.com/bid/105743 • CWE-908: Use of Uninitialized Resource •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 1CVE-2018-3971
https://notcve.org/view.php?id=CVE-2018-3971
25 Oct 2018 — An exploitable arbitrary write vulnerability exists in the 0x2222CC IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP request can cause the driver to write data under controlled by an attacker address, resulting in memory corruption. An attacker can send IRP request to trigger this vulnerability. Existe una vulnerabilidad explotable de escritura arbitraria en la funcionalidad de manejo de llamadas IOCTL 0x2222CC de Sophos HitmanPro.Alert 3.7.6.744. Una petición IRP esp... • http://www.securityfocus.com/bid/105743 • CWE-123: Write-what-where Condition •
CVSS: 7.8EPSS: 0%CPEs: 13EXPL: 1CVE-2018-6852 – Sophos SafeGuard Priivlege Escalation
https://notcve.org/view.php?id=CVE-2018-6852
04 Jul 2018 — Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x80202298. By crafting an input buffer we can control the execution path to the point where the nt!memset function is called to zero out contents of a user-controlled address. We can take advantage of this condition to zero-out the pointer to the security descriptor in the object header of a privileged process or modify the security descriptor... • http://seclists.org/fulldisclosure/2018/Jul/20 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 13EXPL: 1CVE-2018-6857 – Sophos SafeGuard Priivlege Escalation
https://notcve.org/view.php?id=CVE-2018-6857
04 Jul 2018 — Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x802022E0. By crafting an input buffer we can control the execution path to the point where the constant 0x12 will be written to a user-controlled address. We can take advantage of this condition to modify the SEP_TOKEN_PRIVILEGES structure of the Token object belonging to the exploit process and grant SE_DEBUG_NAME privilege. This allows the ... • http://seclists.org/fulldisclosure/2018/Jul/20 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 13EXPL: 1CVE-2018-6855 – Sophos SafeGuard Priivlege Escalation
https://notcve.org/view.php?id=CVE-2018-6855
04 Jul 2018 — Sophos SafeGuard Enterprise before 8.00.5, SafeGuard Easy before 7.00.3, and SafeGuard LAN Crypt before 3.95.2 are vulnerable to Local Privilege Escalation via IOCTL 0x80202014. By crafting an input buffer we can control the execution path to the point where the constant 0xFFFFFFF will be written to a user-controlled address. We can take advantage of this condition to modify the SEP_TOKEN_PRIVILEGES structure of the Token object belonging to the exploit process and grant SE_DEBUG_NAME privilege. This allows... • http://seclists.org/fulldisclosure/2018/Jul/20 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •