Skyhigh Security vulnerabilities
3 vulnerabilities
Known vulnerabilities in Skyhigh Security products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.
Products
2- Skyhigh Secure Web Gateway (Swg)2 vulnerabilities
- Secure Web Gateway (Swg)1 vulnerabilities
CVE-2022-2310skyhigh securityskyhigh secure web gateway (swg)+1
EPSS score1.24%
An authentication bypass vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.12, 9.x prior to 9.2.23, 8.x prior to 8.2.28, and controlled release 11.x prior to 11.2.1 allows a remote attacker to bypass authentication into the administration User Interface. This is possible because of SWG incorrectly whitelisting authentication bypass methods and using a weak crypto password. This can lead to the attacker logging into the SWG admin interface, without valid credentials, as the super user with complete control over the SWG.CVE-2023-0214skyhigh securitysecure web gateway (swg)+1EPSS score1.89%
A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party website, causing arbitrary content to be injected into the response when accessed through SWG.CVE-2023-4400skyhigh securityskyhigh secure web gateway (swg)+1EPSS score0.36%
A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and controlled release 12.x prior to 12.2.1, allows some authentication information stored in configuration files to be extracted through SWG REST API. This was possible due to SWG storing the password in plain text in some configuration files.