Sophos Sophos Mobile / Connect Vulnerabilities & Security Advisories
5 advisories tracked · Sophos ([email protected] CNA) via NVD · 0 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Sophos advisory that VulniPulse classified as Sophos Mobile / Connect, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 1 critical, 1 high, 2 medium, 1 low.
Android app · Google Play
Monitor Sophos CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
Sophos ([email protected] CNA) via NVD
Sophos is its own CVE Numbering Authority. VulniPulse ingests Sophos's CVEs from the NVD CNA feed ([email protected]), each linking to its sophos.com advisory. Covers Sophos Firewall (XG/XGS, SFOS), Intercept X / Sophos Central endpoint, Sophos UTM, Sophos Mobile, Sophos Connect VPN and the Web/Email appliances — its firewalls are a repeated mass-exploitation target (the 'Pacific Rim' campaign), so an MSP-heavy, alert-hungry community.
Latest Sophos Sophos Mobile / Connect advisories
Medium [CVE-2022-48310] Sophos Connect: information disclosure vulnerability
An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versions older than 2.2.90.
Medium [CVE-2022-48309] CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older…
A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90.
Low [CVE-2022-4901] Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI
Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a malicious VPN configuration that must be manually loaded by the victim.
Critical [CVE-2022-3980] Sophos Mobile: XML External Entity (XEE) vulnerability
An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between versions 5.0.0 and 9.7.4.
High [CVE-2021-25265] Sophos Connect: malicious website could execute code remotely in Sophos Connect Client before version 2.1.
A malicious website could execute code remotely in Sophos Connect Client before version 2.1.