Vulnerabilities > Sonicwall
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2012-07-31 | CVE-2012-2627 | Unspecified vulnerability in Sonicwall Scrutinizer 8.6.2/9.0.0/9.0.1 d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote attackers to create or overwrite arbitrary files in %PROGRAMFILES%\Scrutinizer\snmp\mibs\ via a multipart/form-data POST request. | 9.4 |
| 2012-07-31 | CVE-2012-2626 | Improper Authentication vulnerability in Sonicwall Scrutinizer 8.6.2/9.0.0/9.0.1 cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not require token authentication, which allows remote attackers to add administrative accounts via a userprefs action. | 5.0 |
| 2012-07-30 | CVE-2012-2962 | SQL Injection vulnerability in Sonicwall Scrutinizer SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q parameter. | 6.5 |
| 2010-11-03 | CVE-2010-2583 | Buffer Errors vulnerability in Sonicwall Ssl-Vpn End-Point Interrogator/Installer Activex Control 10.0.5 Stack-based buffer overflow in SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX control (Aventail.EPInstaller) before 10.5.2 and 10.0.5 hotfix 3 allows remote attackers to execute arbitrary code via long (1) CabURL and (2) Location arguments to the Install3rdPartyComponent method. | 9.3 |
| 2009-12-04 | CVE-2009-2631 | Permissions, Privileges, and Access Controls vulnerability in multiple products Multiple clientless SSL VPN products that run in web browsers, including Stonesoft StoneGate; Cisco ASA; SonicWALL E-Class SSL VPN and SonicWALL SSL VPN; SafeNet SecureWire Access Gateway; Juniper Networks Secure Access; Nortel CallPilot; Citrix Access Gateway; and other products, when running in configurations that do not restrict access to the same domain as the VPN, retrieve the content of remote URLs from one domain and rewrite them so they originate from the VPN's domain, which violates the same origin policy and allows remote attackers to conduct cross-site scripting attacks, read cookies that originated from other domains, access the Web VPN session to gain access to internal resources, perform key logging, and conduct other attacks. | 6.8 |
| 2008-11-04 | CVE-2008-4918 | Cross-site Scripting vulnerability in Sonicwall Sonicos Enhanced Cross-site scripting (XSS) vulnerability in SonicWALL SonicOS Enhanced before 4.0.1.1, as used in SonicWALL Pro 2040 and TZ 180 and 190, allows remote attackers to inject arbitrary web script or HTML into arbitrary web sites via a URL to a site that is blocked based on content filtering, which is not properly handled in the CFS block page, aka "universal website hijacking." | 4.3 |
| 2008-05-12 | CVE-2008-2162 | Cross-Site Scripting vulnerability in Sonicwall E-Mail Security 6.1.1 Cross-site scripting (XSS) vulnerability in SonicWall Email Security 6.1.1 allows remote attackers to inject arbitrary web script or HTML via the Host header in a request to a non-existent web page, which is not properly sanitized in an error page. | 4.3 |
| 2007-12-07 | CVE-2007-6273 | USE of Externally-Controlled Format String vulnerability in Sonicwall Global VPN Client 3.1.556/4.0.0.810 Multiple format string vulnerabilities in the configuration file in SonicWALL GLobal VPN Client 3.1.556 and 4.0.0.810 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in the (1) Hostname tag or the (2) name attribute in the Connection tag. | 9.3 |
| 2007-11-05 | CVE-2007-5815 | Path Traversal vulnerability in Sonicwall SSL Vpn2000/4000 and SSL VPN 200 Absolute path traversal vulnerability in the WebCacheCleaner ActiveX control 1.3.0.3 in SonicWall SSL-VPN 200 before 2.1, and SSL-VPN 2000/4000 before 2.5, allows remote attackers to delete arbitrary files via a full pathname in the argument to the FileDelete method. | 10.0 |
| 2007-11-05 | CVE-2007-5814 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Sonicwall SSL VPN Multiple buffer overflows in the SonicWall SSL-VPN NetExtender NELaunchCtrl ActiveX control before 2.1.0.51, and 2.5.x before 2.5.0.56, allow remote attackers to execute arbitrary code via a long (1) serverAddress, (2) sessionId, (3) clientIPLower, (4) clientIPHigher, (5) userName, (6) domainName, or (7) dnsSuffix Unicode property value. | 9.3 |