Overview 25 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 7 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
4.0%
Not applicable
24
96.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
25
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
25
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 4 / year
20011
Not applicable1
High1
not blocked1
Working exploit published1
20021
Not applicable1
Medium1
not blocked1
Working exploit published1
20030
20040
20051
Not applicable1
Medium1
not blocked1
Working exploit published1
20060
20073
Not applicable3
High3
not blocked3
Working exploit published3
20082
Outside Waratek scope1
Not applicable1
Medium2
not blocked2
Working exploit published2
20090
20100
20110
20124
Not applicable4
High2
Medium2
not blocked4
Working exploit published4
20132
Not applicable2
High1
Low1
not blocked2
Working exploit published2
20143
Not applicable3
High1
Medium2
not blocked3
Working exploit published3
20151
Not applicable1
Medium1
not blocked1
Working exploit published1
20160
20170
20180
20190
20202
Not applicable2
Critical2
not blocked2
Working exploit published2
20213
Not applicable3
Critical1
Medium2
not blocked3
Working exploit published3
20220
20232
Not applicable2
High2
not blocked2
Working exploit published2
200120032005200720092011201320152017201920212023
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2023-34127 | High | 2023-07-13 | Not applicable | Working exploit published | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analytics enables an authenticated attacker to execute arbitrary code with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions. |
| CVE-2023-0126 | High | 2023-01-19 | Not applicable | Working exploit published | Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and directories stored outside the web root directory. |
| CVE-2021-20031 | Medium | 2021-10-12 | Not applicable | Working exploit published | A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary web domains. |
| CVE-2021-20034 | Critical | 2021-09-27 | Not applicable | Working exploit published | An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings. |
| CVE-2020-5147 | Medium | 2021-01-09 | Not applicable | Working exploit published | SonicWall NetExtender Windows client vulnerable to unquoted service path vulnerability, this allows a local attacker to gain elevated privileges in the host operating system. This vulnerability impact SonicWall NetExtender Windows client version 10.2.300 and earlier. |
| CVE-2013-1360 | Critical | 2020-02-11 | Not applicable | Working exploit published | An Authentication Bypass vulnerability exists in DELL SonicWALL Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0, Analyzer 7.0, Universal Management Appliance (UMA) 5.1, 6.0, and 7.0 and ViewPoint 4.1, 5.0, and 6.0 via a crafted request to the SGMS interface, which could let a remote malicious user obtain administrative access. |
| CVE-2013-1359 | Critical | 2020-02-11 | Not applicable | Working exploit published | An Authentication Bypass Vulnerability exists in DELL SonicWALL Analyzer 7.0, Global Management System (GMS) 4.1, 5.0, 5.1, 6.0, and 7.0; Universal Management Appliance (UMA) 5.1, 6.0, and 7.0 and ViewPoint 4.1, 5.0, 5.1, and 6.0 via the skipSessionCheck parameter to the UMA interface (/appliance/), which could let a remote malicious user obtain access to the root account. |
| CVE-2015-2248 | Medium | 2015-05-01 | Not applicable | Working exploit published | Cross-site request forgery (CSRF) vulnerability in the user portal in Dell SonicWALL Secure Remote Access (SRA) products with firmware before 7.5.1.0-38sv and 8.x before 8.0.0.1-16sv allows remote attackers to hijack the authentication of users for requests that create bookmarks via a crafted request to cgi-bin/editBookmark. |
| CVE-2014-8420 | High | 2014-11-25 | Not applicable | Working exploit published | The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before 7.2 SP2, and SonicWALL UMA before 7.2 SP2 allows remote authenticated users to execute arbitrary code via unspecified vectors. |
| CVE-2014-4977 | Medium | 2014-07-16 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the (2) user_id parameter in the changeUnit function, (3) methodDetail parameter in the methodDetail function, or (4) xcNetworkDetail parameter in the xcNetworkDetail function in d4d/exporters.php. |
| CVE-2014-2879 | Medium | 2014-04-17 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in Dell SonicWALL Email Security 7.4.5 and earlier allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the uploadPatch parameter to the System/Advanced page (settings_advanced.html) or (2) the uploadLicenses parameter in the License management (settings_upload_dlicense.html) page. |
| CVE-2013-7025 | Low | 2013-12-09 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in ematStaticAlertTypes.jsp in the Alert Settings section in Dell SonicWALL Global Management System (GMS), Analyzer, and UMA EM5000 7.1 SP1 before Hotfix 134235 allow remote authenticated users to inject arbitrary web script or HTML via the (1) valfield_1 or (2) value_1 parameter to createNewThreshold.jsp. |
| CVE-2011-5262 | High | 2013-02-12 | Not applicable | Working exploit published | SQL injection vulnerability in prodpage.cfm in SonicWALL Aventail allows remote attackers to execute arbitrary SQL commands via the CategoryID parameter. |
| CVE-2012-3951 | High | 2012-07-31 | Not applicable | Working exploit published | The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password of admin for the (1) scrutinizer and (2) scrutremote accounts, which allows remote attackers to execute arbitrary SQL commands via a TCP session. |
| CVE-2012-3848 | Medium | 2012-07-31 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to d4d/exporters.php, (2) the HTTP Referer header to d4d/exporters.php, or (3) unspecified input to d4d/contextMenu.php. |
| CVE-2012-2627 | High | 2012-07-31 | Not applicable | Working exploit published | d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote attackers to create or overwrite arbitrary files in %PROGRAMFILES%\Scrutinizer\snmp\mibs\ via a multipart/form-data POST request. |
| CVE-2012-2962 | Medium | 2012-07-30 | Not applicable | Working exploit published | SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q parameter. |
| CVE-2008-4918 | Medium | 2008-11-04 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in SonicWALL SonicOS Enhanced before 4.0.1.1, as used in SonicWALL Pro 2040 and TZ 180 and 190, allows remote attackers to inject arbitrary web script or HTML into arbitrary web sites via a URL to a site that is blocked based on content filtering, which is not properly handled in the CFS block page, aka "universal website hijacking." |
| CVE-2008-2162 | Medium | 2008-05-12 | Outside Waratek scope | Working exploit published | Cross-site scripting (XSS) vulnerability in SonicWall Email Security 6.1.1 allows remote attackers to inject arbitrary web script or HTML via the Host header in a request to a non-existent web page, which is not properly sanitized in an error page. |
| CVE-2007-6273 | High | 2007-12-07 | Not applicable | Working exploit published | Multiple format string vulnerabilities in the configuration file in SonicWALL GLobal VPN Client 3.1.556 and 4.0.0.810 allow user-assisted remote attackers to execute arbitrary code via format string specifiers in the (1) Hostname tag or the (2) name attribute in the Connection tag. NOTE: there might not be any realistic circumstances in which this issue crosses privilege boundaries. |
| CVE-2007-5815 | High | 2007-11-05 | Not applicable | Working exploit published | Absolute path traversal vulnerability in the WebCacheCleaner ActiveX control 1.3.0.3 in SonicWall SSL-VPN 200 before 2.1, and SSL-VPN 2000/4000 before 2.5, allows remote attackers to delete arbitrary files via a full pathname in the argument to the FileDelete method. |
| CVE-2007-5603 | High | 2007-11-05 | Not applicable | Working exploit published | Stack-based buffer overflow in the SonicWall SSL-VPN NetExtender NELaunchCtrl ActiveX control before 2.1.0.51, and 2.5.x before 2.5.0.56, allows remote attackers to execute arbitrary code via a long string in the second argument to the AddRouteEntry method. |
| CVE-2005-1006 | Medium | 2005-05-02 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in SonicWALL SOHO 5.1.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the URL or (2) the user login name, which is not filtered when the administrator views the log file. |
| CVE-2002-2341 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in content blocking in SonicWALL SOHO3 6.3.0.0 allows remote attackers to inject arbitrary web script or HTML via a blocked URL. |
| CVE-2001-1104 | High | 2001-07-25 | Not applicable | Working exploit published | SonicWALL SOHO uses easily predictable TCP sequence numbers, which allows remote attackers to spoof or hijack sessions. |