Sophos Unified Threat Management vulnerabilities
6 vulnerabilities
Known vulnerabilities in Sophos Unified Threat Management, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-25273sophossophos utm+1
EPSS score0.83%
Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.CVE-2020-25223sophosunified_threat_managementKEVEPSS score96.75%
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511 MR11CVE-2014-2537sophosunified_threat_management+1EPSS score3.07%
Memory leak in the TCP stack in the kernel in Sophos UTM before 9.109 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.CVE-2022-0652sophossophos utm+1EPSS score0.19%
Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt off-line brute-force attacks against these password hashes in Sophos UTM before version 9.710.CVE-2022-0386sophossophos utm+1EPSS score1.23%
A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM before version 9.710.CVE-2012-3238astarosecurity_gateway_software+2EPSS score3.48%
Cross-site scripting (XSS) vulnerability in the Backup/Restore component in WebAdmin in Astaro Security Gateway before 8.305 allows remote attackers to inject arbitrary web script or HTML via the "Comment (optional)" field.