Sophos Utm vulnerabilities

CVE-2022-0386 [HIGH] CWE-89 CVE-2022-0386: A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated atta A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM before version 9.710.

CVE-2022-0652 [HIGH] CWE-532 CVE-2022-0652: Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure ac Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt off-line brute-force attacks against these password hashes in Sophos UTM before version 9.710.

CVE-2021-25273 [MEDIUM] CWE-79 CVE-2021-25273: Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before versio Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.