Watchguard
Page 2 of 2 — Watchguard CVEs from a corpus of 163, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-26238 | Medium | 5.5 | 2023-10-05 | An issue was discovered in WatchGuard EPDR 8.0.21.0002. It is possible to enable or disable defensive capabilities by sending a crafted message to a named pipe. |
CVE-2023-26237 | Medium | 6.7 | 2023-10-05 | An issue was discovered in WatchGuard EPDR 8.0.21.0002. It is possible to bypass the defensive capabilities by adding a registry key as SYSTEM. |
CVE-2023-26236 | High | 7.8 | 2023-10-05 | An issue was discovered in WatchGuard EPDR 8.0.21.0002. Due to a weak implementation of message handling between WatchGuard EPDR processes, it is possible to p… |
CVE-2023-37849 | Medium | 6.5 | 2023-07-13 | A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8 allows attackers to execute arbitrary code via placing a crafted DLL… |
CVE-2022-31792 | Medium | 5.4 | 2022-09-06 | A stored cross-site scripting (XSS) vulnerability exists in the management web interface of WatchGuard Firebox and XTM appliances. A remote attacker can potent… |
CVE-2022-31791 | High | 7.8 | 2022-09-06 | WatchGuard Firebox and XTM appliances allow a local attacker (that has already obtained shell access) to elevate their privileges and execute code with root pe… |
CVE-2022-31789 | Critical | 9.8 | 2022-09-06 | An integer overflow in WatchGuard Firebox and XTM appliances allows an unauthenticated remote attacker to trigger a buffer overflow and potentially execute arb… |
CVE-2022-31790 | High | 7.5 | 2022-09-06 | WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication server settings by sending a malicious requ… |
CVE-2022-25361 | Critical | 9.1 | 2022-06-07 | WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to delete arbitrary files from a limited set of directories on the system. This… |
CVE-2022-26318 | Critical | 9.8 | 2022-03-04 | On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7… |
CVE-2022-25363 | Medium | 6.5 | 2022-02-24 | WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to modify privileged management user credentials. Th… |
CVE-2022-25360 | High | 8.8 | 2022-02-24 | WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to upload files to arbitrary locations. This vulnera… |
CVE-2022-25293 | High | 8.8 | 2022-02-24 | A systemd stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by… |
CVE-2022-25292 | High | 8.8 | 2022-02-24 | A wgagent stack-based buffer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to potentially execute arbitrary code by… |
CVE-2022-25291 | High | 8.8 | 2022-02-24 | An integer overflow in WatchGuard Firebox and XTM appliances allows an authenticated remote attacker to trigger a heap-based buffer overflow and potentially ex… |
CVE-2022-25290 | Medium | 6.5 | 2022-02-24 | WatchGuard Firebox and XTM appliances allow an authenticated remote attacker with unprivileged credentials to retrieve certificate private keys. This vulnerabi… |
CVE-2022-23176 | High | 8.8 | 2022-02-24 | WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged credentials to access the system with a privileged management session via expos… |
CVE-2021-34998 | High | 7.8 | 2022-01-13 | This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Free Antivirus 20.2.0.0. An attacker must first ob… |
CVE-2020-10532 | High | 7.5 | 2020-03-12 | The AD Helper component in WatchGuard Fireware before 5.8.5.10317 allows remote attackers to discover cleartext passwords via the /domains/list URI. |
CVE-2014-6413 | Medium | 6.1 | 2020-02-07 | A Cross-site Scripting (XSS) vulnerability exists in WatchGuard XTM 11.8.3 via the poll_name parameter in the firewall/policy script. |
CVE-2019-18652 | Medium | 6.1 | 2020-01-07 | A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to execute JavaScript in the victim's bro… |
CVE-2016-6154 | Medium | 6.1 | 2019-08-23 | The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect). |
CVE-2018-10578 | Critical | 9.8 | 2018-05-02 | An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10. Incorrect… |
CVE-2018-10577 | High | 8.8 | 2018-05-02 | An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices with firmware before 2.0.0.10. File uplo… |
CVE-2018-10576 | High | 7.8 | 2018-04-30 | An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Improper authentication handling by the native Access Poin… |
CVE-2018-10575 | Critical | 9.8 | 2018-04-30 | An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Hardcoded credentials exist for an unprivileged SSH accoun… |
CVE-2015-2878 | High | 8.8 | 2017-10-23 | Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication of administrators… |
CVE-2017-14616 | High | 7.5 | 2017-09-20 | An FBX-5312 issue was discovered in WatchGuard Fireware before 12.0. If a login attempt is made in the XML-RPC interface with an XML message containing an empt… |
CVE-2017-14615 | Medium | 6.1 | 2017-09-20 | An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. When a failed login attempt is made to the login endpoint of the XML-RPC interface, if Jav… |
CVE-2017-8060 | Medium | 5.9 | 2017-05-05 | Acceptance of invalid/self-signed TLS certificates in "Panda Mobile Security" 1.1 for iOS allows a man-in-the-middle and/or physically proximate attacker to si… |
CVE-2017-8339 | Medium | 5.5 | 2017-04-30 | PSKMAD.sys in Panda Free Antivirus 18.0 allows local users to cause a denial of service (BSoD) via a crafted DeviceIoControl request to \\.\PSMEMDriver. |
CVE-2017-8056 | Medium | 5.3 | 2017-04-22 | WatchGuard Fireware v11.12.1 and earlier mishandles requests referring to an XML External Entity (XXE), in the XML-RPC agent. This causes the Firebox wgagent p… |
CVE-2017-8055 | Medium | 5.3 | 2017-04-22 | WatchGuard Fireware allows user enumeration, e.g., in the Firebox XML-RPC login handler. A login request that contains a blank password sent to the XML-RPC age… |
CVE-2016-7089 | High | 7.8 | 2016-08-24 | WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifconfig command, aka ESCALATEPLOWMAN. |
CVE-2016-3943 | High | 7.8 | 2016-04-18 | Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a weak ACL for the Panda Security/WaAgent… |
CVE-2015-7378 | High | 7.8 | 2016-04-18 | Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allows local users to g… |
CVE-2015-5453 | | 2015-07-08 | Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the id parameter to… | |
CVE-2015-5452 | | 2015-07-08 | SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitrary SQL commands via the sid cookie, as… | |
CVE-2014-0338 | | 2014-03-16 | Multiple cross-site scripting (XSS) vulnerabilities in the firewall policy management pages in WatchGuard Fireware XTM before 11.8.3 allow remote attackers to… | |
CVE-2013-6021 | | 2013-10-19 | Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code via a long sessionid value in a cookie. | |
CVE-2013-5702 | | 2013-10-19 | Multiple cross-site scripting (XSS) vulnerabilities in WebCenter in WatchGuard WSM and Fireware before 11.8 allow remote attackers to inject arbitrary web scri… | |
CVE-2013-5701 | | 2013-10-03 | Multiple untrusted search path vulnerabilities in (1) Watchguard Log Collector (wlcollector.exe) and (2) Watchguard WebBlocker Server (wbserver.exe) in WatchGu… | |
CVE-2011-2165 | | 2011-05-23 | The STARTTLS implementation in WatchGuard XCS 9.0 and 9.1 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands… | |
CVE-2008-1618 | | 2008-04-07 | The PPTP VPN service in Watchguard Firebox before 10, when performing the MS-CHAPv2 authentication handshake, generates different error codes depending on whet… | |
CVE-2003-0642 | | 2003-08-27 | WatchGuard ServerLock for Windows 2000 before SL 2.0.4 allows local users to access kernel memory via a symlink attack on \Device\PhysicalMemory. | |
CVE-2003-0641 | | 2003-08-27 | WatchGuard ServerLock for Windows 2000 before SL 2.0.3 allows local users to load arbitrary modules via the OpenProcess() function, as demonstrated using (1) a… | |
CVE-2002-1520 | | 2003-04-02 | The CLI interface for WatchGuard Firebox Vclass 3.2 and earlier, and RSSA Appliance 3.0.2, does not properly close the SSH connection when a -N option is provi… | |
CVE-2002-1519 | | 2003-04-02 | Format string vulnerability in the CLI interface for WatchGuard Firebox Vclass 3.2 and earlier, and RSSA Appliance 3.0.2, allows remote attackers to cause a de… | |
CVE-2002-1979 | | 2002-12-31 | WatchGuard SOHO products running firmware 5.1.6 and earlier, and Vclass/RSSA using 3.2 SP1 and earlier, allows remote attackers to bypass firewall rules by sen… | |
CVE-2002-1047 | | 2002-10-04 | The FTP service in Watchguard Soho Firewall 5.0.35a allows remote attackers to gain privileges with a correct password but an incorrect user name. | |
CVE-2002-1046 | | 2002-10-04 | Dynamic VPN Configuration Protocol service (DVCP) in Watchguard Firebox firmware 5.x.x allows remote attackers to cause a denial of service (crash) via a malfo… | |
CVE-2002-0528 | | 2002-08-12 | Watchguard SOHO firewall 5.0.35 unpredictably disables certain IP restrictions for customized services that were set before the administrator upgrades to 5.0.3… | |
CVE-2002-0527 | | 2002-08-12 | Watchguard SOHO firewall before 5.0.35 allows remote attackers to cause a denial of service (crash and reboot) when SOHO forwards a packet with bad IP options. | |
CVE-2001-0692 | | 2001-09-20 | SMTP proxy in WatchGuard Firebox (2500 and 4500) 4.5 and 4.6 allows a remote attacker to bypass firewall filtering via a base64 MIME encoded email attachment w… | |
CVE-2001-0592 | | 2001-08-02 | Watchguard Firebox II prior to 4.6 allows a remote attacker to create a denial of service in the kernel via a large stream (>10,000) of malformed ICMP or TCP p… | |
CVE-2001-0204 | | 2001-06-02 | Watchguard Firebox II allows remote attackers to cause a denial of service by establishing multiple connections and sending malformed PPTP packets. | |
CVE-2001-0203 | | 2001-03-26 | Watchguard Firebox II firewall allows users with read-only access to gain read-write access, and administrative privileges, by accessing a file that contains h… | |
CVE-2001-0049 | | 2001-02-16 | WatchGuard SOHO FireWall 2.2.1 and earlier allows remote attackers to cause a denial of service via a large number of GET requests. | |
CVE-2000-0896 | | 2001-02-12 | WatchGuard SOHO firewall allows remote attackers to cause a denial of service via a flood of fragmented IP packets, which causes the firewall to drop connectio… | |
CVE-2000-0895 | | 2001-02-12 | Buffer overflow in HTTP server on the WatchGuard SOHO firewall allows remote attackers to cause a denial of service and possibly execute arbitrary code via a l… | |
CVE-2000-0894 | | 2001-02-12 | HTTP server on the WatchGuard SOHO firewall does not properly restrict access to administrative functions such as password resets or rebooting, which allows at… | |
CVE-2000-1182 | | 2001-01-09 | WatchGuard Firebox II allows remote attackers to cause a denial of service by flooding the Firebox with a large number of FTP or SMTP requests, which disables… | |
CVE-2000-0783 | | 2000-10-20 | Watchguard Firebox II allows remote attackers to cause a denial of service by sending a malformed URL to the authentication service on port 4100. |