Overview 77 matches · 1 in Waratek scope · 1 protected · 12 exploited · 3 CISA KEV · 15 public PoC · 7 EPSS ≥ 0.5
77matches
1in Waratek scope1.3%
1protected1.3%
12exploited15.6%
3CISA KEV3.9%
15public PoC19.5%
7EPSS ≥ 0.59.1%
Protected by Waratek
1
1.3%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
7
9.1%
Not applicable
69
89.6%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
1.3%
partly blocked
0
0.0%
not blocked
76
98.7%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 12 / year
20012
Not applicable2
Medium2
not blocked2
No public exploit2
20022
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
20031
Not applicable1
Medium1
not blocked1
No public exploit1
20040
20051
Not applicable1
Medium1
not blocked1
Working exploit published1
20060
20070
20082
Outside Waratek scope1
Not applicable1
Medium2
not blocked2
Working exploit published2
20091
Not applicable1
Medium1
not blocked1
No public exploit1
20100
20110
20123
Not applicable3
Medium3
not blocked3
Exploited1
Working exploit published2
20130
20146
Not applicable6
Medium6
not blocked6
Working exploit published2
No public exploit4
20153
Not applicable3
Medium3
not blocked3
Working exploit published1
No public exploit2
20160
20170
20184
Outside Waratek scope1
Not applicable3
Medium4
not blocked4
Exploited1
No public exploit3
20194
Outside Waratek scope1
Not applicable3
Medium4
not blocked4
Forecast only1
No public exploit3
20207
Not applicable7
Medium7
not blocked7
No public exploit7
20217
Protected by Waratek1
Outside Waratek scope2
Not applicable4
Medium7
blocked by ARMR today1
not blocked6
Exploited3
Working exploit published2
Proof of concept only1
No public exploit1
20224
Not applicable4
Medium4
not blocked4
Exploited1
No public exploit3
202312
Outside Waratek scope1
Not applicable11
Medium12
not blocked12
Exploited5
No public exploit7
20245
Not applicable5
Medium5
not blocked5
No public exploit5
20254
Not applicable4
Medium4
not blocked4
Exploited1
Proof of concept only1
No public exploit2
20269
Outside Waratek scope1
Not applicable8
Medium9
not blocked9
No public exploit9
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-0206 | Medium | 2026-04-29 | Not applicable | No public exploit | A post-authentication Stack-based Buffer Overflow vulnerabilities in SonicOS allows a remote attacker to crash a firewall. |
| CVE-2026-0205 | Medium | 2026-04-29 | Not applicable | No public exploit | A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with usually restricted services. |
| CVE-2026-4114 | Medium | 2026-04-09 | Not applicable | No public exploit | Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP authentication. |
| CVE-2026-3468 | Medium | 2026-03-31 | Outside Waratek scope | No public exploit | A stored Cross-Site Scripting (XSS) vulnerability has been identified in the SonicWall Email Security appliance due to improper neutralization of user-supplied input during web page generation, allowing a remote authenticated attacker as admin user to potentially execute arbitrary JavaScript code. |
| CVE-2026-3439 | Medium | 2026-03-04 | Not applicable | No public exploit | A post-authentication Stack-based Buffer Overflow vulnerability in SonicOS certificate handling allows a remote attacker to crash a firewall. |
| CVE-2026-0402 | Medium | 2026-02-24 | Not applicable | No public exploit | A post-authentication Out-of-bounds Read vulnerability in SonicOS allows a remote attacker to crash a firewall. |
| CVE-2026-0401 | Medium | 2026-02-24 | Not applicable | No public exploit | A post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall. |
| CVE-2026-0400 | Medium | 2026-02-24 | Not applicable | No public exploit | A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall. |
| CVE-2026-0399 | Medium | 2026-02-24 | Not applicable | No public exploit | Multiple post-authentication stack-based buffer overflow vulnerabilities in the SonicOS management interface due to improper bounds checking in a API endpoint. |
| CVE-2025-40602 | Medium | 2025-12-18 | Not applicable | Exploited | A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC). |
| CVE-2025-40605 | Medium | 2025-11-20 | Not applicable | No public exploit | A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by injecting crafted directory-traversal sequences (such as ../) and may access files and directories outside the intended restricted path. |
| CVE-2025-40603 | Medium | 2025-10-31 | Not applicable | No public exploit | A potential exposure of sensitive information in log files in SonicWall SMA100 Series appliances may allow a remote, authenticated administrator, under certain conditions to view partial users credential data. |
| CVE-2025-40598 | Medium | 2025-07-23 | Not applicable | Proof of concept only | A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code. |
| CVE-2024-53702 | Medium | 2024-12-05 | Not applicable | No public exploit | Use of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the SonicWall SMA100 SSLVPN backup code generator that, in certain cases, can be predicted by an attacker, potentially exposing the generated secret. |
| CVE-2024-45319 | Medium | 2024-12-05 | Not applicable | No public exploit | A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions allows a remote authenticated attacker can circumvent the certificate requirement during authentication. |
| CVE-2024-29013 | Medium | 2024-06-20 | Not applicable | No public exploit | Heap-based buffer overflow vulnerability in the SonicOS SSL-VPN allows an authenticated remote attacker to cause Denial of Service (DoS) via memcpy function. |
| CVE-2024-22395 | Medium | 2024-02-24 | Not applicable | No public exploit | Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could potentially enable a remote authenticated attacker to associate another user's MFA mobile application. |
| CVE-2023-6340 | Medium | 2024-01-18 | Not applicable | No public exploit | SonicWall Capture Client version 3.7.10, NetExtender client version 10.2.337 and earlier versions are installed with sfpmonitor.sys driver. The driver has been found to be vulnerable to Denial-of-Service (DoS) caused by Stack-based Buffer Overflow vulnerability. |
| CVE-2023-41712 | Medium | 2023-10-17 | Not applicable | No public exploit | SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the SSL VPN plainprefs.exp URL endpoint leads to a firewall crash. |
| CVE-2023-41711 | Medium | 2023-10-17 | Not applicable | No public exploit | SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the sonicwall.exp, prefs.exp URL endpoints lead to a firewall crash. |
| CVE-2023-39280 | Medium | 2023-10-17 | Not applicable | Exploited | SonicOS p ost-authentication Stack-Based Buffer Overflow vulnerability in the ssoStats-s.xml, ssoStats-s.wri URL endpoints leads to a firewall crash. |
| CVE-2023-39279 | Medium | 2023-10-17 | Not applicable | Exploited | SonicOS post-authentication Stack-Based Buffer Overflow vulnerability in the getPacketReplayData.json URL endpoint leads to a firewall crash. |
| CVE-2023-39278 | Medium | 2023-10-17 | Not applicable | Exploited | SonicOS post-authentication user assertion failure leads to Stack-Based Buffer Overflow vulnerability via main.cgi leads to a firewall crash. |
| CVE-2023-39277 | Medium | 2023-10-17 | Not applicable | Exploited | SonicOS post-authentication stack-based buffer overflow vulnerability in the sonicflow.csv and appflowsessions.csv URL endpoints leads to a firewall crash. |
| CVE-2023-39276 | Medium | 2023-10-17 | Not applicable | Exploited | SonicOS post-authentication stack-based buffer overflow vulnerability in the getBookmarkList.json URL endpoint leads to a firewall crash. |
| CVE-2023-34135 | Medium | 2023-07-13 | Not applicable | No public exploit | Path Traversal vulnerability in SonicWall GMS and Analytics allows a remote authenticated attacker to read arbitrary files from the underlying file system via web service. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions. |
| CVE-2023-34134 | Medium | 2023-07-13 | Not applicable | No public exploit | Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics allows authenticated attacker to read administrator password hash via a web service call. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions. |
| CVE-2023-34131 | Medium | 2023-07-13 | Not applicable | No public exploit | Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics enables an unauthenticated attacker to access restricted web pages. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions. |
| CVE-2023-34125 | Medium | 2023-07-13 | Not applicable | No public exploit | Path Traversal vulnerability in GMS and Analytics allows an authenticated attacker to read arbitrary files from the underlying filesystem with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions. |
| CVE-2023-0655 | Medium | 2023-02-14 | Outside Waratek scope | No public exploit | SonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes sensitive information about users email addresses. |
| CVE-2022-1702 | Medium | 2022-05-13 | Not applicable | No public exploit | SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions accept a user-controlled input that specifies a link to an external site and uses that link in a redirect which leads to Open redirection vulnerability. |
| CVE-2022-22277 | Medium | 2022-04-27 | Not applicable | No public exploit | A vulnerability in SonicOS SNMP service resulting exposure of Wireless Access Point sensitive information in cleartext. |
| CVE-2022-22276 | Medium | 2022-04-27 | Not applicable | No public exploit | A vulnerability in SonicOS SNMP service resulting exposure of sensitive information to an unauthorized user. |
| CVE-2022-22279 | Medium | 2022-04-13 | Not applicable | Exploited | A post-authentication arbitrary file read vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile Access (SMA) 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier versions and Secure Mobile Access (SMA) 100 series products running older firmware 9.0.0.9-26sv and earlier versions |
| CVE-2021-45105 | Medium | 2021-12-18 | Protected by Waratek | Exploited | Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1. |
| CVE-2021-20031 | Medium | 2021-10-12 | Not applicable | Working exploit published | A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary web domains. |
| CVE-2021-20035 | Medium | 2021-09-27 | Not applicable | Exploited | Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user which potentially leads to DoS. |
| CVE-2021-20023 | Medium | 2021-04-20 | Outside Waratek scope | Exploited | SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host. |
| CVE-2021-3449 | Medium | 2021-03-25 | Outside Waratek scope | Proof of concept only | An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j). |
| CVE-2021-20018 | Medium | 2021-03-13 | Not applicable | No public exploit | A post-authenticated vulnerability in SonicWall SMA100 allows an attacker to export the configuration file to the specified email address. This vulnerability impacts SMA100 version 10.2.0.5 and earlier. |
| CVE-2020-5147 | Medium | 2021-01-09 | Not applicable | Working exploit published | SonicWall NetExtender Windows client vulnerable to unquoted service path vulnerability, this allows a local attacker to gain elevated privileges in the host operating system. This vulnerability impact SonicWall NetExtender Windows client version 10.2.300 and earlier. |
| CVE-2020-5143 | Medium | 2020-10-12 | Not applicable | No public exploit | SonicOS SSLVPN login page allows a remote unauthenticated attacker to perform firewall management administrator username enumeration based on the server responses. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0. |
| CVE-2020-5142 | Medium | 2020-10-12 | Not applicable | No public exploit | A stored cross-site scripting (XSS) vulnerability exists in the SonicOS SSLVPN web interface. A remote unauthenticated attacker is able to store and potentially execute arbitrary JavaScript code in the firewall SSLVPN portal. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0. |
| CVE-2020-5141 | Medium | 2020-10-12 | Not applicable | No public exploit | A vulnerability in SonicOS allows a remote unauthenticated attacker to brute force Virtual Assist ticket ID in the firewall SSLVPN service. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version SonicOS 7.0.0.0. |
| CVE-2020-5136 | Medium | 2020-10-12 | Not applicable | No public exploit | A buffer overflow vulnerability in SonicOS allows an authenticated attacker to cause Denial of Service (DoS) in the SSL-VPN and virtual assist portal, which leads to a firewall crash. This vulnerability affected SonicOS Gen 5 version 5.9.1.7, 5.9.1.13, Gen 6 version 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0. |
| CVE-2020-5134 | Medium | 2020-10-12 | Not applicable | No public exploit | A vulnerability in SonicOS allows an authenticated attacker to cause out-of-bound invalid file reference leads to a firewall crash. This vulnerability affected SonicOS Gen 6 version 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0. |
| CVE-2020-5132 | Medium | 2020-09-30 | Not applicable | No public exploit | SonicWall SSL-VPN products and SonicWall firewall SSL-VPN feature misconfiguration leads to possible DNS flaw known as domain name collision vulnerability. When the users publicly display their organization’s internal domain names in the SSL-VPN authentication page, an attacker with knowledge of internal domain names can potentially take advantage of this vulnerability. |
| CVE-2020-5130 | Medium | 2020-07-17 | Not applicable | No public exploit | SonicOS SSLVPN LDAP login request allows remote attackers to cause external service interaction (DNS) due to improper validation of the request. This vulnerability impact SonicOS version 6.5.4.4-44n and earlier. |
| CVE-2019-7484 | Medium | 2019-12-19 | Not applicable | No public exploit | Authenticated SQL Injection in SonicWall SMA100 allow user to gain read-only access to unauthorized resources using viewcacert CGI script. This vulnerability impacted SMA100 version 9.0.0.3 and earlier. |
| CVE-2019-12265 | Medium | 2019-08-09 | Outside Waratek scope | Forecast only | Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IPNET security vulnerability: IGMP Information leak via IGMPv3 specific membership report. |
| CVE-2019-7474 | Medium | 2019-04-02 | Not applicable | No public exploit | A vulnerability in SonicWall SonicOS and SonicOSv, allow authenticated read-only admin to leave the firewall in an unstable state by downloading certificate with specific extension. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V). |
| CVE-2018-9867 | Medium | 2019-02-19 | Not applicable | No public exploit | In SonicWall SonicOS, administrators without full permissions can download imported certificates. Occurs when administrators who are not in the SonicWall Administrators user group attempt to download imported certificates. This vulnerability affected SonicOS Gen 5 version 5.9.1.10 and earlier, Gen 6 version 6.2.7.3, 6.5.1.3, 6.5.2.2, 6.5.3.1, 6.2.7.8, 6.4.0.0, 6.5.1.8, 6.0.5.3-86o and SonicOSv 6.5.0.2-8v_RC363 (VMWARE), 6.5.0.2.8v_RC367 (AZURE), SonicOSv 6.5.0.2.8v_RC368 (AWS), SonicOSv 6.5.0.2.8v_RC366 (HYPER_V). |
| CVE-2018-3639 | Medium | 2018-05-22 | Outside Waratek scope | Exploited | Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4. |
| CVE-2018-5691 | Medium | 2018-01-14 | Not applicable | No public exploit | SonicWall Global Management System (GMS) 8.1 has XSS via the `newName` and `Name` values of the `/sgms/TreeControl` module. |
| CVE-2018-5281 | Medium | 2018-01-08 | Not applicable | No public exploit | SonicWall SonicOS on Network Security Appliance (NSA) 2017 Q4 devices has XSS via the CFS Custom Category and Cloud AV DB Exclusion Settings screens. |
| CVE-2018-5280 | Medium | 2018-01-08 | Not applicable | No public exploit | SonicWall SonicOS on Network Security Appliance (NSA) 2016 Q4 devices has XSS via the Configure SSO screens. |
| CVE-2015-4173 | Medium | 2015-08-26 | Not applicable | No public exploit | Unquoted Windows search path vulnerability in the autorun value in Dell SonicWall NetExtender before 7.5.227 and 8.0.x before 8.0.238, as used in the SRA firmware before 7.5.1.2-40sv and 8.x before 8.0.0.3-23sv, allows local users to gain privileges via a Trojan horse program in the %SYSTEMDRIVE% folder. |
| CVE-2015-2248 | Medium | 2015-05-01 | Not applicable | Working exploit published | Cross-site request forgery (CSRF) vulnerability in the user portal in Dell SonicWALL Secure Remote Access (SRA) products with firmware before 7.5.1.0-38sv and 8.x before 8.0.0.1-16sv allows remote attackers to hijack the authentication of users for requests that create bookmarks via a crafted request to cgi-bin/editBookmark. |
| CVE-2015-3447 | Medium | 2015-04-29 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in macIpSpoofView.html in Dell SonicWall SonicOS 7.5.0.12 and 6.x allow remote attackers to inject arbitrary web script or HTML via the (1) searchSpoof or (2) searchSpoofIpDet parameter. |
| CVE-2014-5024 | Medium | 2014-07-24 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in sgms/panelManager in Dell SonicWALL GMS, Analyzer, and UMA before 7.2 SP1 allows remote attackers to inject arbitrary web script or HTML via the node_id parameter. |
| CVE-2014-4977 | Medium | 2014-07-16 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) selectedUserGroup parameter in a create new user request to cgi-bin/admin.cgi or the (2) user_id parameter in the changeUnit function, (3) methodDetail parameter in the methodDetail function, or (4) xcNetworkDetail parameter in the xcNetworkDetail function in d4d/exporters.php. |
| CVE-2014-4976 | Medium | 2014-07-16 | Not applicable | No public exploit | Dell SonicWall Scrutinizer 11.0.1 allows remote authenticated users to change user passwords via the user ID in the savePrefs parameter in a change password request to cgi-bin/admin.cgi. |
| CVE-2014-2879 | Medium | 2014-04-17 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in Dell SonicWALL Email Security 7.4.5 and earlier allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the uploadPatch parameter to the System/Advanced page (settings_advanced.html) or (2) the uploadLicenses parameter in the License management (settings_upload_dlicense.html) page. |
| CVE-2014-2589 | Medium | 2014-03-24 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Dashboard Backend service (stats/dashboard.jsp) in SonicWall Network Security Appliance (NSA) 2400 allows remote attackers to inject arbitrary web script or HTML via the sn parameter. |
| CVE-2014-0332 | Medium | 2014-02-14 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in mainPage in Dell SonicWALL GMS before 7.1 SP2, SonicWALL Analyzer before 7.1 SP2, and SonicWALL UMA E5000 before 7.1 SP2 might allow remote attackers to inject arbitrary web script or HTML via the node_id parameter in a ScreenDisplayManager genNetwork action. |
| CVE-2012-3848 | Medium | 2012-07-31 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to d4d/exporters.php, (2) the HTTP Referer header to d4d/exporters.php, or (3) unspecified input to d4d/contextMenu.php. |
| CVE-2012-2626 | Medium | 2012-07-31 | Not applicable | Exploited | cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not require token authentication, which allows remote attackers to add administrative accounts via a userprefs action. |
| CVE-2012-2962 | Medium | 2012-07-30 | Not applicable | Working exploit published | SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q parameter. |
| CVE-2009-2631 | Medium | 2009-12-04 | Not applicable | No public exploit | Multiple clientless SSL VPN products that run in web browsers, including Stonesoft StoneGate; Cisco ASA; SonicWALL E-Class SSL VPN and SonicWALL SSL VPN; SafeNet SecureWire Access Gateway; Juniper Networks Secure Access; Nortel CallPilot; Citrix Access Gateway; and other products, when running in configurations that do not restrict access to the same domain as the VPN, retrieve the content of remote URLs from one domain and rewrite them so they originate from the VPN's domain, which violates the same origin policy and allows remote attackers to conduct cross-site scripting attacks, read cookies that originated from other domains, access the Web VPN session to gain access to internal resources, perform key logging, and conduct other attacks. NOTE: it could be argued that this is a fundamental design problem in any clientless VPN solution, as opposed to a commonly-introduced error that can be fixed in separate implementations. Therefore a single CVE has been assigned for all products that have this design |
| CVE-2008-4918 | Medium | 2008-11-04 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in SonicWALL SonicOS Enhanced before 4.0.1.1, as used in SonicWALL Pro 2040 and TZ 180 and 190, allows remote attackers to inject arbitrary web script or HTML into arbitrary web sites via a URL to a site that is blocked based on content filtering, which is not properly handled in the CFS block page, aka "universal website hijacking." |
| CVE-2008-2162 | Medium | 2008-05-12 | Outside Waratek scope | Working exploit published | Cross-site scripting (XSS) vulnerability in SonicWall Email Security 6.1.1 allows remote attackers to inject arbitrary web script or HTML via the Host header in a request to a non-existent web page, which is not properly sanitized in an error page. |
| CVE-2005-1006 | Medium | 2005-05-02 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in SonicWALL SOHO 5.1.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the URL or (2) the user login name, which is not filtered when the administrator views the log file. |
| CVE-2003-1320 | Medium | 2003-12-31 | Not applicable | No public exploit | SonicWALL firmware before 6.4.0.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted Internet Key Exchange (IKE) response packets, possibly including (1) a large Security Parameter Index (SPI) field, (2) a large number of payloads, or (3) a long payload. |
| CVE-2002-2341 | Medium | 2002-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in content blocking in SonicWALL SOHO3 6.3.0.0 allows remote attackers to inject arbitrary web script or HTML via a blocked URL. |
| CVE-2002-2181 | Medium | 2002-12-31 | Not applicable | No public exploit | SonicWall Content Filtering allows local users to access prohibited web sites via requests to the web site's IP address instead of the domain name. |
| CVE-2000-1098 | Medium | 2001-01-09 | Not applicable | No public exploit | The web server for the SonicWALL SOHO firewall allows remote attackers to cause a denial of service via an empty GET or POST request. |
| CVE-2000-1097 | Medium | 2001-01-09 | Not applicable | No public exploit | The web server for the SonicWALL SOHO firewall allows remote attackers to cause a denial of service via a long username in the authentication page. |