CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-12729
https://notcve.org/view.php?id=CVE-2024-12729
19 Dec 2024 — A post-auth SQLi vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1 (21.0.1). A post-auth code injection vulnerability in the User Portal allows authenticated users to execute code remotely in Sophos Firewall older than version 21.0 MR1 (21.0.1). • https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-12728
https://notcve.org/view.php?id=CVE-2024-12728
19 Dec 2024 — A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than version 20.0 MR3 (20.0.3). • https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce • CWE-1391: Use of Weak Credentials •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-12727
https://notcve.org/view.php?id=CVE-2024-12727
19 Dec 2024 — A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting database and can lead to remote code execution if a specific configuration of Secure PDF eXchange (SPX) is enabled in combination with the firewall running in High Availability (HA) mode. • https://www.sophos.com/en-us/security-advisories/sophos-sa-20241219-sfos-rce • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-5552
https://notcve.org/view.php?id=CVE-2023-5552
17 Oct 2023 — A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) and older, if the password type is set to “Specified by sender”. Una vulnerabilidad de divulgación de contraseña en la función Secure PDF eXchange (SPX) permite a atacantes con acceso completo al correo electrónico descifrar archivos PDF en Sophos Firewall versión 19.5 MR3 (19.5.3) y anteriores, si el tipo de contraseña está configu... • https://www.sophos.com/en-us/security-advisories/sophos-sa-20231017-spx-password • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-522: Insufficiently Protected Credentials •
CVSS: 8.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-3696
https://notcve.org/view.php?id=CVE-2022-3696
01 Dec 2022 — A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA. Una vulnerabilidad de inyección de código posterior a la autenticación permite a los administradores ejecutar código en Webadmin de versiones de Sophos Firewall anteriores a la versión 19.5 GA. • https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.4EPSS: 0%CPEs: 2EXPL: 0CVE-2022-3709
https://notcve.org/view.php?id=CVE-2022-3709
01 Dec 2022 — A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version 19.5 GA. Una vulnerabilidad XSS almacenada permite escalar privilegios de administrador a superadministrador en el asistente de importación de grupos Webadmin de versiones de Sophos Firewall anteriores a la versión 19.5 GA. • https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-3710
https://notcve.org/view.php?id=CVE-2022-3710
01 Dec 2022 — A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API controller of Sophos Firewall releases older than version 19.5 GA. Una vulnerabilidad de inyección SQL de solo lectura posterior a la autenticación permite a los clientes API leer contenidos de bases de datos de configuración no confidenciales en el controlador API de versiones de Sophos Firewall anteriores a la versión 19.5 GA. • https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-3711
https://notcve.org/view.php?id=CVE-2022-3711
01 Dec 2022 — A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of Sophos Firewall releases older than version 19.5 GA. Una vulnerabilidad de inyección SQL de solo lectura posterior a la autenticación permite a los usuarios leer contenidos de bases de datos de configuración no confidenciales en el Portal de usuario de versiones de Sophos Firewall anteriores a la versión 19.5 GA. • https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-3713
https://notcve.org/view.php?id=CVE-2022-3713
01 Dec 2022 — A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA. Una vulnerabilidad de inyección de código permite a atacantes adyacentes ejecutar código en el controlador Wifi de versiones de Sophos Firewall anteriores a la versión 19.5 GA. • https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-3226
https://notcve.org/view.php?id=CVE-2022-3226
01 Dec 2022 — An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA. Una vulnerabilidad de inyección de comandos del Sistema Operativo permite a los administradores ejecutar código a través de cargas de configuración de VPN SSL en versiones de Sophos Firewall anteriores a la versión 19.5 GA. • https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •