SonicWall Scrutinizer vulnerabilities

7 CVEs affecting SonicWall Scrutinizer, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-4977, published 2014-07-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-4977, published 2014-07-16. Medium severity, CVSS 6.5. EPSS: 74.9% chance of exploitation in the next 30 days. Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) selectedUserGroup parameter in a create new…
CVE-2012-2962, published 2012-07-30. Medium severity, CVSS 6.5. EPSS: 66.8% chance of exploitation in the next 30 days. SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q…
CVE-2012-3951, published 2012-07-31. High severity, CVSS 7.5. EPSS: 52% chance of exploitation in the next 30 days. The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password of admin for the (1) scrutinizer and (2) scrutremote accounts, which allows…
CVE-2012-2626, published 2012-07-31. Medium severity, CVSS 5.0. EPSS: 44.5% chance of exploitation in the next 30 days. cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not require token authentication, which allows remote attackers to add administrative…
CVE-2012-2627, published 2012-07-31. High severity, CVSS 9.4. EPSS: 5.7% chance of exploitation in the next 30 days. d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote attackers to create or overwrite arbitrary files in…
CVE-2014-4976, published 2014-07-16. Medium severity, CVSS 5.5. EPSS: 2.7% chance of exploitation in the next 30 days. Dell SonicWall Scrutinizer 11.0.1 allows remote authenticated users to change user passwords via the user ID in the savePrefs parameter in a change password request to cgi-bin/admin.cgi.
CVE-2012-3848, published 2012-07-31. Medium severity, CVSS 4.3. EPSS: 2.5% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allow remote attackers to inject arbitrary web script or…