CVSS: 9.8EPSS: 38%CPEs: 1EXPL: 0CVE-2022-3980
https://notcve.org/view.php?id=CVE-2022-3980
An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4. Una vulnerabilidad de XML External Entity (XEE) permite la falsificación de solicitudes del lado del servidor (SSRF) y la posible ejecución de código en Sophos Mobile administrado localmente entre las versiones 5.0.0 y 9.7.4. • https://www.sophos.com/en-us/security-advisories/sophos-sa-20221116-smc-xee • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2020-9363
https://notcve.org/view.php?id=CVE-2020-9363
The Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive. This affects Endpoint Protection, Cloud Optix, Mobile, Intercept X Endpoint, Intercept X for Server, and Secure Web Gateway. NOTE: the vendor feels that this does not apply to endpoint-protection products because the virus would be detected upon extraction. El motor de análisis Sophos AV versiones anteriores a 14-01-2020 permite una omisión de la detección de virus por medio de un archivo ZIP diseñado. Esto afecta a Endpoint Protection, Cloud Optix, Mobile, Intercept X Endpoint, Intercept X for Server y Secure Web Gateway. • https://blog.zoller.lu/p/release-mode-coordinated-disclosure-ref.html https://community.sophos.com/b/security-blog/posts/sophos-comments-to-cve-2020-9363 • CWE-436: Interpretation Conflict •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2016-6597 – Sophos Mobile Control 3.5.0.3 Open Reverse Proxy
https://notcve.org/view.php?id=CVE-2016-6597
Sophos EAS Proxy before 6.2.0 for Sophos Mobile Control, when Lotus Traveler is enabled, allows remote attackers to access arbitrary web-resources from the backend mail system via a request for the resource, aka an Open Reverse Proxy vulnerability. Sophos EAS Proxy en versiones anteriores a 6.2.0 para Sophos Mobile Control, cuando Lotus Traveler está habilitada, permite a atacantes remotos acceder a recursos web arbitrarios desde el sistema de correo del backend a través de una petición del recurso, también conocida como una vulnerabilidad Open Reverse Proxy. Sophos EAS Proxy is part of the Enterprise Mobility Management (EMM) platform Sophos Mobile Control, which allows control of mail access for managed mobile devices. Anonymous attackers can access any web-resources of the backend mail system like Microsoft Exchange or IBM Domino, if Lotus Traveler option is enabled. Brute force attacks against users in the backend mail system are also possible. • http://packetstormsecurity.com/files/138210/Sophos-Mobile-Control-3.5.0.3-Open-Reverse-Proxy.html http://www.securityfocus.com/archive/1/539126/100/0/threaded http://www.securityfocus.com/bid/92351 https://www.pallas.com/advisories/sophos_eas_open_reverse_proxy_vulnerability • CWE-254: 7PK - Security Features •