Sophos Unified Threat Management Software — known CVE vulnerabilities

Every CVE whose affected-product data names Sophos Unified Threat Management Software, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (9)

• CVE-2013-5932 — CVSS 10.0 (critical): Unspecified vulnerability in WebAdmin in Sophos UTM (aka Astaro Security Gateway) before 9.105 has unknown impact and attack vectors.
• CVE-2015-7547 — CVSS 8.1 (high): Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc…
• CVE-2016-0778 — CVSS 8.1 (high): The (1) roaming_read and (2) roaming_write functions in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2, when…
• CVE-2014-2537 — CVSS 7.8 (high): Memory leak in the TCP stack in the kernel in Sophos UTM before 9.109 allows remote attackers to cause a denial of service (memory…
• CVE-2016-0777 — CVSS 6.5 (medium): The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain…
• CVE-2016-2046 — CVSS 6.1 (medium): Cross-site scripting (XSS) vulnerability in the UserPortal page in SOPHOS UTM before 9.353 allows remote attackers to inject arbitrary web…
• CVE-2016-7442 — CVSS 4.4 (medium): The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information…
• CVE-2016-7397 — CVSS 4.4 (medium): The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information…
• CVE-2012-3238 — CVSS 4.3 (medium): Cross-site scripting (XSS) vulnerability in the Backup/Restore component in WebAdmin in Astaro Security Gateway before 8.305 allows remote…