High

DATE	CVE	VULNERABILITY TITLE	RISK
2014-04-11	CVE-2014-2850	OS Command Injection vulnerability in Sophos web Appliance and web Appliance Firmware The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter. network sophos CWE-78	8.5
2014-04-11	CVE-2014-2849	Permissions, Privileges, and Access Controls vulnerability in Sophos web Appliance and web Appliance Firmware The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users to change the admin user password via a crafted request. network low complexity sophos CWE-264	8.5