Vulnerabilities > Sophos > Low

DATE CVE VULNERABILITY TITLE RISK
2022-12-01 CVE-2022-3710 SQL Injection vulnerability in Sophos XG Firewall Firmware 17.0/17.5/18.0
A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API controller of Sophos Firewall releases older than version 19.5 GA.
network
low complexity
sophos CWE-89
2.7
2022-04-27 CVE-2021-25266 Insecure Storage of Sensitive Information vulnerability in Sophos Authenticator and Intercept X
An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobile (Android) before version 9.7.3495.
local
low complexity
sophos CWE-922
2.1
2022-03-08 CVE-2021-36809 Unspecified vulnerability in Sophos SSL VPN Client
A local attacker can overwrite arbitrary files on the system with VPN client logs using administrator privileges, potentially resulting in a denial of service and data loss, in all versions of Sophos SSL VPN client.
local
low complexity
sophos
3.6
2021-11-26 CVE-2021-25269 Unquoted Search Path or Element vulnerability in Sophos products
A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability in the HMPA component of Sophos Intercept X Advanced and Sophos Intercept X Advanced for Server before version 2.0.23, as well as Sophos Exploit Prevention before version 3.8.3.
local
low complexity
sophos CWE-428
2.1
2021-10-08 CVE-2021-25271 Unspecified vulnerability in Sophos Hitmanpro 3.7/3.7.20
A local attacker could read or write arbitrary files with administrator privileges in HitmanPro before version Build 318.
local
low complexity
sophos
3.6
2021-07-29 CVE-2021-25273 Cross-site Scripting vulnerability in Sophos Unified Threat Management
Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.
network
sophos CWE-79
3.5
2018-04-05 CVE-2018-4863 7PK - Security Features vulnerability in Sophos Endpoint Protection 10.7
Sophos Endpoint Protection 10.7 allows local users to bypass an intended tamper protection mechanism by deleting the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Sophos Endpoint Defense\ registry key.
local
low complexity
sophos CWE-254
2.1
2018-04-05 CVE-2018-9233 Use of Password Hash With Insufficient Computational Effort vulnerability in Sophos Endpoint Protection 10.7
Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it easier for attackers to determine a cleartext password, and subsequently choose unsafe malware settings, via rainbow tables or other approaches.
local
low complexity
sophos CWE-916
2.1
2016-10-03 CVE-2016-7397 Information Exposure vulnerability in Sophos Unified Threat Management Software
The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "value" field of the SMTP user settings in the notifications configuration tab.
local
low complexity
sophos CWE-200
2.1
2016-10-03 CVE-2016-7442 Information Exposure vulnerability in Sophos Unified Threat Management Software
The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information by reading the "value" field of the proxy user settings in "system settings / scan settings / anti spam" configuration tab.
local
low complexity
sophos CWE-200
2.1