A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM before version 9.710.
oryginał ENCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSophos Unified Threat Management
APPSophos< 9.710
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
SQLi
CWE
Powiązane podatności
CVE-2020-25223CRITICAL9.8⚠ KEVten sam produkt
A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, a...
CVE-2014-2537HIGH7.8ten sam produkt
Memory leak in the TCP stack in the kernel in Sophos UTM before 9.109 allows remote attackers to cause a denia...
CVE-2021-25273MEDIUM4.8ten sam produkt
Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.
CVE-2016-0777MEDIUM6.5ten sam produkt
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows r...
CVE-2012-3238MEDIUM4.3ten sam produkt
Cross-site scripting (XSS) vulnerability in the Backup/Restore component in WebAdmin in Astaro Security Gatewa...