CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-10947
https://notcve.org/view.php?id=CVE-2020-10947
Mac Endpoint for Sophos Central before 9.9.6 and Mac Endpoint for Sophos Home before 2.2.6 allow Privilege Escalation. Mac Endpoint para Sophos Central versiones anteriores a 9.9.6 y Mac Endpoint para Sophos Home versiones anteriores a 2.2.6, permiten una Escalada de Privilegios. • https://community.sophos.com/b/security-blog/posts/advisory-cve-2020-10947---sophos-anti-virus-for-macos-privilege-escalation https://www.sophos.com/en-us.aspx • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2014-2385
https://notcve.org/view.php?id=CVE-2014-2385
Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow local users to inject arbitrary web script or HTML via the (1) newListList:ExcludeFileOnExpression, (2) newListList:ExcludeFilesystems, or (3) newListList:ExcludeMountPaths parameter to exclusion/configure or (4) text:EmailServer or (5) newListList:Email parameter to notification/configure. Múltiples vulnerabilidades de XSS en la interfaz de usuario web en Sophos Anti-Virus para Linux anterior a 9.6.1 permiten a usuarios locales inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro (1) newListList:ExcludeFileOnExpression, (2) newListList:ExcludeFilesystems o (3) newListList:ExcludeMountPaths en exclusion/configure o el parámetro (4) text:EmailServer o (5) newListList:Email en notification/configure. • http://packetstormsecurity.com/files/127228/Sophos-Antivirus-9.5.1-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2014/Jun/126 http://www.securityfocus.com/archive/1/532558/100/0/threaded http://www.securitytracker.com/id/1030467 http://www.sophos.com/en-us/support/knowledgebase/121135.aspx https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2385 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.6EPSS: 0%CPEs: 2EXPL: 0CVE-2014-1213
https://notcve.org/view.php?id=CVE-2014-1213
Sophos Anti-Virus engine (SAVi) before 3.50.1, as used in VDL 4.97G 9.7.x before 9.7.9, 10.0.x before 10.0.11, and 10.3.x before 10.3.1 does not set an ACL for certain global and session objects, which allows local users to bypass anti-virus protection, cause a denial of service (resource consumption, CPU consumption, and eventual crash) or spoof "ready for update" messages by performing certain operations on mutexes or events including (1) DataUpdateRequest, (2) MmfMutexSAV-****, (3) MmfMutexSAV-Info, (4) ReadyForUpdateSAV-****, (5) ReadyForUpdateSAV-Info, (6) SAV-****, (7) SAV-Info, (8) StateChange, (9) SuspendedSAV-****, (10) SuspendedSAV-Info, (11) UpdateComplete, (12) UpdateMutex, (13) UpdateRequest, or (14) SophosALMonSessionInstance, as demonstrated by triggering a ReadyForUpdateSAV event and modifying the UpdateComplete, UpdateMutex, and UpdateRequest objects. El motor de Sophos Anti-Virus (SAVi) anterior a 3.50.1, utilizado en VDL 4.97G 9.7.x anterior a 9.7.9, 10.0.x anterior a 10.0.11 y 10.3.x anterior a 10.3.1 no establece una ACL para cietos objetos globales y de sesión, lo que permite a usuarios locales evadir la protección Anti-Virus, causa una denegación de servicio (consumo de recursos, consumo de CPU y finalmente una caída) o falsifica mensajes de "preparado para actualización" mediante ciertas operaciones realizadas en mutexes o eventos incluyendo (1) DataUpdateRequest, (2) MmfMutexSAV-****, (3) MmfMutexSAV-Info, (4) ReadyForUpdateSAV-****, (5) ReadyForUpdateSAV-Info, (6) SAV-****, (7) SAV-Info, (8) StateChange, (9) SuspendedSAV-****, (10) SuspendedSAV-Info, (11) UpdateComplete, (12) UpdateMutex, (13) UpdateRequest o (14) SophosALMonSessionInstance, demostrado mediante la provocación de un evento ReadyForUpdateSAV y modificación de objetos UpdateComplete, UpdateMutex y UpdateRequest. • http://osvdb.org/102762 http://packetstormsecurity.com/files/125024/Sophos-Anti-Virus-Denial-Of-Service.html http://seclists.org/fulldisclosure/2014/Feb/1 http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1213 http://www.securityfocus.com/archive/1/530915/100/0/threaded http://www.securityfocus.com/bid/65286 http://www.securitytracker.com/id/1029713 http://www.sophos.com/en-us/support/knowledgebase/2300/7200/1031/120401.aspx • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 97%CPEs: 14EXPL: 0CVE-2012-1453
https://notcve.org/view.php?id=CVE-2012-1453
The CAB file parser in Dr.Web 5.0.2.03300, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Sophos Anti-Virus 4.61.0, Trend Micro AntiVirus 9.120.0.1004, McAfee Gateway (formerly Webwasher) 2010.1C, Emsisoft Anti-Malware 5.1.0.1, CA eTrust Vet Antivirus 36.1.8511, Antiy Labs AVL SDK 2.0.3.7, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, Rising Antivirus 22.83.00.03, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via a CAB file with a modified coffFiles field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CAB parser implementations. El analizador de archivos CAB en Dr.Web v5.0.2.03300, Trend Micro HouseCall v9.120.0.1004, Kaspersky Anti-Virus v7.0.0.125, Sophos Anti-Virus v4.61.0, Trend Micro AntiVirus v9.120.0.1004, McAfee Gateway (anteriormente Webwasher) v2010.1C , a-squared Anti-Malware v5.1.0.1, CA eTrust Antivirus Vet v36.1.8511, Laboratorios Antiy AVL SDK v2.0.3.7, Antimalware Engine v1.1.6402.0 en el Microsoft Security Essentials v2.0, Rising Antivirus 22.83.00.03, Ikarus Virus Utilities T3 Command Line Scanner v1.1.97.0, Fortinet Antivirus 4.2.254.0, y Panda Antivirus 10.0.2.7 permite a atacantes remotos evitar la detección de malware a través de un archivo CAB con un campo coffFiles modificado. NOTA: esto más adelante se puede dividir en varios CVEs si la información adicional que se publica muestra que el error se produjo de forma independiente en diferentes implementaciones del analizador CAB. • http://osvdb.org/80482 http://osvdb.org/80483 http://osvdb.org/80484 http://osvdb.org/80485 http://osvdb.org/80486 http://osvdb.org/80487 http://osvdb.org/80488 http://osvdb.org/80489 http://www.ieee-security.org/TC/SP2012/program.html http://www.securityfocus.com/archive/1/522005 http://www.securityfocus.com/bid/52621 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 74%CPEs: 2EXPL: 0CVE-2012-1458
https://notcve.org/view.php?id=CVE-2012-1458
The Microsoft CHM file parser in ClamAV 0.96.4 and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via a crafted reset interval in the LZXC header of a CHM file. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CHM parser implementations. El analizador de archivos CHM de Microsoft en ClamAV v0.96.4 y Sophos Anti-Virus v4.61.0 permite a atacantes remotos evitar la detección de malware a través de un intervalo de restablecimiento manipulado en la cabecera LZXC de un archivo CHM. NOTA: esto más adelante se puede dividir en varios CVEs si la información adicional que se publica muestra que el error se produjo de forma independiente en diferentes implementaciones del analizador de CHM. • http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00002.html http://osvdb.org/80473 http://osvdb.org/80474 http://www.ieee-security.org/TC/SP2012/program.html http://www.mandriva.com/security/advisories?name=MDVSA-2012:094 http://www.securityfocus.com/archive/1/522005 http://www.securityfocus.com/bid/52611 https://exchange.xforce.ibmcloud.com/vulnerabilities/74301 • CWE-264: Permissions, Privileges, and Access Controls •