CVE-2015-1491: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the management console in Symantec Endpoint Protection Manager SEPM 12.1 before 12.1-RU6-MP1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-1486: Improper Authentication

The management console in Symantec Endpoint Protection Manager SEPM 12.1 before 12.1-RU6-MP1 allows remote attackers to bypass authentication via a crafted password-reset action that triggers a new administrative session...

CVE-2015-1487: Improper Input Validation

The management console in Symantec Endpoint Protection Manager SEPM 12.1 before 12.1-RU6-MP1 allows remote authenticated users to write to arbitrary files, and consequently obtain administrator privileges, via a crafted filename...

PT-2015-5326

Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection Manager SEPM versions 12.1 through 12.1 before 12.1-RU6-MP1 Description The issue allows remote authenticated users to read arbitrary files via a relative pathname in a client installation package. This is due to a...

CVE-2015-1489: Undefined Security Weakness

The management console in Symantec Endpoint Protection Manager SEPM 12.1 before 12.1-RU6-MP1 allows remote authenticated users to gain privileges via unspecified vectors...

Symantec-Endpoint-Protection-Manager

Symantec has an http request handler called ConfigServerHandler that is programmatically restricted to only handle requests that come from localhost. I guess when they wrote this they just assumed that there was never going to be a way to send untrusted input to it since it was always going to be...

Symantec Endpoint Protection Manager Multiple Vulnerabilities (Dec 2014)

Symantec Endpoint Protection Manager is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Symantec Endpoint Protection Manager Cross-Site Scripting (CVE-2014-3438)

A code execution vulnerability has been reported in the Symantec Endpoint Protection Manager. The vulnerability is due to insufficient validation of user input before it is sent back to the user. A remote attacker may exploit this vulnerability to execute arbitrary script code in the context of t...

Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities

No description provided by source. SEC Consult Vulnerability Lab Security Advisory 20141106-0 ======================================================================= title: XXE & XSS & Arbitrary File Write vulnerabilities product: Symantec Endpoint Protection vulnerable version: 12.1.4023.4080...

SEC Consult SA-20141106-0 :: XXE & XSS & Arbitrary File Write vulnerabilities in Symantec Endpoint Protection

SEC Consult Vulnerability Lab Security Advisory 20141106-0 ======================================================================= title: XXE & XSS & Arbitrary File Write vulnerabilities product: Symantec Endpoint Protection vulnerable version: 12.1.4023.4080 fixed version: 12.1.5 RU 5 impact:...

Symantec Endpoint Protection Manager < 12.1 RU5 Multiple Vulnerabilities (SYM14-015)

The version of Symantec Endpoint Protection Manager SEPM installed on the remote host is 12.1 prior to 12.1 RU5. It is, therefore, affected by the following vulnerabilities : - An XML external entity XXE injection vulnerability due to improper validation of XML external entities. A remote attacke...

Xxe

The management console in Symantec Endpoint Protection Manager SEPM 12.1 before RU5 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in console interface scripts in Symantec Endpoint Protection Manager SEPM 12.1 before RU5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Code injection

ConsoleServlet in Symantec Endpoint Protection Manager SEPM 12.1 before RU5 allows remote attackers to write to arbitrary files via unspecified vectors...

CVE-2014-3438

Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 is affected by CVE-2014-3438, a reflected Cross-Site Scripting (XSS) vulnerability in the console interface (notably via the ErrorMsg handling in SSO-Error.jsp and related UI paths). Exploitation could allow an attacker to inject script ...

CVE-2014-3439

Symantec Endpoint Protection Manager (SEPM) 12.1 prior to RU5 is affected by CVE-2014-3439: an Unauthenticated Arbitrary File Write in the ConsoleServlet, caused by improper filtering of user input in the logging component. This can allow remote attackers to write arbitrary files, potentially ena...

PT-2014-5323

Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection Manager versions prior to 12.1 RU5 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the console interface scripts. These vulnerabilities allow remote attackers to inject arbitrary...

CVE-2014-3438: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in console interface scripts in Symantec Endpoint Protection Manager SEPM 12.1 before RU5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3439: Undefined Security Weakness

ConsoleServlet in Symantec Endpoint Protection Manager SEPM 12.1 before RU5 allows remote attackers to write to arbitrary files via unspecified vectors...

CVE-2014-3437: Undefined Security Weakness

The management console in Symantec Endpoint Protection Manager SEPM 12.1 before RU5 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External...