Vendor scorecard
Sophos
Sophos security disclosure record — CVE volume, CVSS severity mix and product-category breakdown, sourced from the NIST NVD.
CPE: sophos
Product families
2
Open in latest
18
Inferred — see methodology
Last disclosure
Nov 30, 2023
01
Product categories
2 trackedCVE volume, severity mix and the inferred latest shipping version per category.
| Category | CVEs | Volume | Severity mix | Open | Inferred latest |
|---|---|---|---|---|---|
| Secure Web/Email GatewayNGFW / Network Securityweb_appliance, email_appliance | 18 | 9 | 4.5.3.4LOW | ||
| Firewall / SFOSNGFW / Network Securitysfos, firewall, xg_firewall… | 11 | 9 | 19.5.3MED |
Each count is distinct CVEs within that category. A CVE affecting more than one category is counted in each, so these can sum to more than the Sophos total above.
02
Disclosure trend
12 monthsCumulative CVEs published on or before each month-end over the last 12 months, stacked by CVSS severity. A fixed 12-month window — independent of the date filter above.
- Critical
- High
- Medium
- Low
03
Recent CVEs
12 shownMost recently published, newest first. Each ID links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2021-36806(opens NVD record) | Medium | 4.7 | A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sophos Email Appliance older than version 4.5.3.4. | Nov 30, 2023 |
| CVE-2023-5552(opens NVD record) | High | 7.1 | A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Sophos Firewall version 19.5 MR3 (19.5.3) and older, if the password type is set to “Specified by sender”. | Oct 18, 2023 |
| CVE-2023-33336(opens NVD record) | Medium | 4.8 | Reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inputted via the double quotes. | Jun 30, 2023 |
| CVE-2023-1671(opens NVD record) | Critical | 9.8 | A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code. | Apr 4, 2023 |
| CVE-2022-4934(opens NVD record) | High | 7.2 | A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrators to execute arbitrary code. | Apr 4, 2023 |
| CVE-2020-36692(opens NVD record) | Medium | 6.5 | A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScript code in the victim browser via a malicious form that must be manually submitted by the victim while logged in to SWA. | Apr 4, 2023 |
| CVE-2022-3236(opens NVD record) | Critical | 9.8 | A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older. | Sep 23, 2022 |
| CVE-2022-1807(opens NVD record) | High | 7.2 | Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 18.5 MR4 and version 19.0 MR1. | Sep 7, 2022 |
| CVE-2022-0331(opens NVD record) | Medium | 5.3 | An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial number in Sophos Firewall version v18.5 MR2 and older. | Mar 29, 2022 |
| CVE-2022-1040(opens NVD record) | Critical | 9.8 | An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older. | Mar 25, 2022 |
| CVE-2020-11503(opens NVD record) | Critical | 9.8 | A heap-based buffer overflow in the awarrensmtp component of Sophos XG Firewall v17.5 MR11 and older potentially allows an attacker to run arbitrary code remotely. | Jun 18, 2020 |
| CVE-2020-12271(opens NVD record) | Critical | 9.8 | A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone. A successful attack may have caused remote code execution that exfiltrated usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords) | Apr 27, 2020 |
29 CVEs · 2 product families