7 source-linked records in the current knowledge graph.
Sophos XG Firewall contains a buffer overflow vulnerability that allows for remote code execution via the "HTTP/S bookmark" feature. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA KEV ↗ · unattributed attributionCyberoamOS (CROS) contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely. Required action: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
CISA KEV ↗ · unattributed attributionSophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA KEV ↗ · unattributed attributionA code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution. Required action: Apply updates per vendor instructions.
CISA KEV ↗ · unattributed attributionAn authentication bypass vulnerability in User Portal and Webadmin of Sophos Firewall allows for remote code execution. Required action: Apply updates per vendor instructions.
CISA KEV ↗ · unattributed attributionA remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM. Required action: Apply updates per vendor instructions.
CISA KEV ↗ · unattributed attributionSophos Firewall operating system (SFOS) firmware contains a SQL injection vulnerability when configured with either the administration (HTTPS) service or the User Portal is exposed on the WAN zone. Successful exploitation may cause remote code execution to exfiltrate usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords). Required action: Apply updates per vendor instructions.
CISA KEV ↗ · unattributed attribution