CVE-2023-33336
Published Jun 30, 2023Reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inputted via the double quotes.
Vendor/product archive
sophos / web_appliance CVEs
Beta · best-effort18 CVEs tagged to sophos / web_appliance — 4 Critical, 8 High, 6 Medium, 0 Low, 0 Unrated.
CVE-2023-1671
Published Apr 4, 2023A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.
- evidence mentions
- 7
- Buzz score
- 58.8
CVE-2022-4934
Published Apr 4, 2023A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrators to execute arbitrary code.
- evidence mentions
- 2
- Buzz score
- 17.5
CVE-2020-36692
Published Apr 4, 2023A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScript code in the victim browser via a mal…
- evidence mentions
- 2
- Buzz score
- 17.5
CVE-2017-9523
Published Jun 9, 2017The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342.
CVE-2017-6412
Published Mar 30, 2017In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixation could occur, aka NSWA-1310.
CVE-2017-6184
Published Mar 30, 2017In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injection via the token para…
CVE-2017-6183
Published Mar 30, 2017In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's configuration utilities for adding (and detecting) Active Directory servers was vulnerable to remote comma…
CVE-2017-6182
Published Mar 30, 2017In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injection via functions, aka…
CVE-2016-9554
Published Jan 28, 2017The Sophos Web Appliance Remote / Secure Web Gateway server (version 4.2.1.3) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. These…
CVE-2016-9553
Published Jan 28, 2017The Sophos Web Appliance (version 4.2.1.3) is vulnerable to two Remote Command Injection vulnerabilities affecting its web administrative interface. These vulnerabilities occur in…
CVE-2014-2850
Published Apr 11, 2014The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in…
CVE-2014-2849
Published Apr 11, 2014The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users to change the admin user password via a crafted request.
CVE-2013-2643
Published Mar 18, 2014Multiple cross-site scripting (XSS) vulnerabilities in Sophos Web Appliance before 3.7.8.2 allow remote attackers to inject arbitrary web script or HTML via the (1) xss parameter…
- evidence mentions
- 3
- Buzz score
- 20.4
CVE-2013-2642
Published Mar 18, 2014Sophos Web Appliance before 3.7.8.2 allows (1) remote attackers to execute arbitrary commands via shell metacharacters in the client-ip parameter to the Block page, when using the…
CVE-2013-2641
Published Mar 18, 2014Directory traversal vulnerability in patience.cgi in Sophos Web Appliance before 3.7.8.2 allows remote attackers to read arbitrary files via the id parameter.
CVE-2013-4984
Published Sep 10, 2013The close_connections function in /opt/cma/bin/clear_keys.pl in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows local users to gain privileges via shell metachar…
CVE-2013-4983
Published Sep 10, 2013The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows remote attackers to execute arbitrary commands via shell m…
Showing 1-18 of 18 CVEsPage 1 of 1