Web appliance

This hub aggregates every CVE we track for Web appliance, a product in the security products space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Web appliance.

• CVE-2009-10005ContentKeeper Web Appliance < 125.10 Arbitrary File Access via mimencodeAug 20, 2025
• CVE-2023-33336Reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inputted via the double quotes.4.8Jun 30, 2023
• CVE-2023-1671A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.KEV9.8Apr 4, 2023
• CVE-2022-4934A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrators to execute arbitrary code.7.2Apr 4, 2023
• CVE-2020-36692A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScript code in the victim browser via a malicious form that m...6.5Apr 4, 2023
• CVE-2017-9523The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page, aka NSWA-1342.6.1Jun 9, 2017
• CVE-2017-6183In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's configuration utilities for adding (and detecting) Active Directory servers was vulnerable to remote command injection, aka ...7.2Mar 30, 2017
• CVE-2017-6412In Sophos Web Appliance (SWA) before 4.3.1.2, Session Fixation could occur, aka NSWA-1310.8.1Mar 30, 2017
• CVE-2017-6184In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injection via the token parameter, aka NSWA-1303.4.7Mar 30, 2017
• CVE-2017-6182In Sophos Web Appliance (SWA) before 4.3.1.2, a section of the machine's interface responsible for generating reports was vulnerable to remote command injection via functions, aka NSWA-1304.9.8Mar 30, 2017
• CVE-2016-9553The Sophos Web Appliance (version 4.2.1.3) is vulnerable to two Remote Command Injection vulnerabilities affecting its web administrative interface. These vulnerabilities occur in the MgrReport.php...7.2Jan 28, 2017
• CVE-2016-9554The Sophos Web Appliance Remote / Secure Web Gateway server (version 4.2.1.3) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. These vulnerabilities oc...7.2Jan 28, 2017
• CVE-2014-2849The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users to change the admin user password via a crafted request.8.5Apr 11, 2014
• CVE-2014-2850The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address param...8.5Apr 11, 2014
• CVE-2013-2642Sophos Web Appliance before 3.7.8.2 allows (1) remote attackers to execute arbitrary commands via shell metacharacters in the client-ip parameter to the Block page, when using the user_workstation ...9.3Mar 18, 2014