WA
Product
Web Appliance
On CISA KEVExploited in the wild
17
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 5Medium 4Low 0
Watch
Add Web Appliance to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-1671 In wildKEV | 9.8 | Apr 4 | Sophos Web Appliance Command Injection Vulnerability Affected: before 4.3.10.4 |
| CVE-2017-6182 | 9.8 | Mar 30 | In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injection via functions, aka… Affected: through 4.3.1.1 |
| CVE-2017-6412 | 8.1 | Mar 30 | In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixation could occur, aka NSWA-1310 Affected: through 4.3.1.1 |
| CVE-2022-4934 | 7.2 | Apr 4 | A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrators to execute arbitrary code Affected: before 4.3.10.4 |
| CVE-2017-6183 | 7.2 | Mar 30 | In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's configuration utilities for adding (and detecting) Active Directory servers was vulnerable to remote… Affected: through 4.3.1.1 |
| CVE-2016-9554 | 7.2 | Jan 28 | The Sophos Web Appliance Remote / Secure Web Gateway server (version 4.2.1.3) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface Affected: 4.2.1.3 |
| CVE-2016-9553 | 7.2 | Jan 28 | The Sophos Web Appliance (version 4.2.1.3) is vulnerable to two Remote Command Injection vulnerabilities affecting its web administrative interface Affected: 4.2.1.3 |
| CVE-2017-9523 | 6.1 | Jun 9 | The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342 Affected: through 4.3.1.4 |
| CVE-2020-36692 | 5.4 | Apr 4 | A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScript code in the victim browser via a… Affected: before 4.3.10.4 |
| CVE-2023-33336 | 4.8 | Jun 30 | Reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inputted via the double quotes Affected: 4.3.9.1 |
| CVE-2017-6184 | 4.7 | Mar 30 | In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injection via the token… Affected: through 4.3.1.1 |
| CVE-2014-2850 | – | Apr 11 | The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in… Affected: All versions, or not specified |
| CVE-2014-2849 | – | Apr 11 | The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users to change the admin user password via a crafted request Affected: All versions, or not specified |
| CVE-2013-2643 | – | Mar 18 | Multiple cross-site scripting (XSS) vulnerabilities in Sophos Web Appliance before 3.7.8.2 allow remote attackers to inject arbitrary web script or HTML via the (1) xss parameter… Affected: All versions, or not specified |
| CVE-2013-2642 | – | Mar 18 | Sophos Web Appliance before 3.7.8.2 allows (1) remote attackers to execute arbitrary commands via shell metacharacters in the client-ip parameter to the Block page, when using the… Affected: All versions, or not specified |
| CVE-2013-2641 | – | Mar 18 | Directory traversal vulnerability in patience.cgi in Sophos Web Appliance before 3.7.8.2 allows remote attackers to read arbitrary files via the id parameter Affected: All versions, or not specified |
| CVE-2013-4984 | – | Sep 10 | The close_connections function in /opt/cma/bin/clear_keys.pl in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows local users to gain privileges via shell… Affected: through 3.7.9; 3.0.0; 3.0.1; 3.0.1.1; 3.0.2; 3.0.3; +34 more |
Showing 17