Medium

DATE	CVE	VULNERABILITY TITLE	RISK
2014-03-18	CVE-2013-2643	Cross-Site Scripting vulnerability in Sophos web Appliance and web Appliance Firmware Multiple cross-site scripting (XSS) vulnerabilities in Sophos Web Appliance before 3.7.8.2 allow remote attackers to inject arbitrary web script or HTML via the (1) xss parameter in an allow action to rss.php, (2) msg parameter to end-user/errdoc.php, (3) h parameter to end-user/ftp_redirect.php, or (4) threat parameter to the Blocked component. network sophos CWE-79	4.3
2014-03-18	CVE-2013-2641	Path Traversal vulnerability in Sophos web Appliance and web Appliance Firmware Directory traversal vulnerability in patience.cgi in Sophos Web Appliance before 3.7.8.2 allows remote attackers to read arbitrary files via the id parameter. network low complexity sophos CWE-22	5.0