CVE-2014-1644

The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator LUA 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account...

CVE-2014-1645

SQL injection vulnerability in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator LUA 2.x before 2.3.2.110 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Default credentials

The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator LUA 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account...

Sql injection

SQL injection vulnerability in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator LUA 2.x before 2.3.2.110 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-1644

The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator LUA 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account...

CVE-2014-1645

SQL injection vulnerability in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator LUA 2.x before 2.3.2.110 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-1644

CVE-2014-1644 affects Symantec LiveUpdate Administrator (LUA) 2.x pre-2.3.2.110. The root cause is a flawed forgotten-password flow in the management GUI (/lua/forcepasswd.do) that allows unauthenticated password resets when the attacker knows the target email address, enabling potential full acc...

PT-2014-4274

Name of the Vulnerable Software and Affected Versions Symantec LiveUpdate Administrator versions prior to 2.3.2.110 Description The issue allows remote attackers to execute arbitrary SQL commands. Recommendations For versions prior to 2.3.2.110, update to version 2.3.2.110 or later to resolve the...

CVE-2014-1644: Undefined Security Weakness

The forgotten-password feature in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator LUA 2.x before 2.3.2.110 allows remote attackers to reset arbitrary passwords by providing the e-mail address associated with a user account...

PT-2014-4273

Name of the Vulnerable Software and Affected Versions Symantec LiveUpdate Administrator versions prior to 2.3.2.110 Description The issue concerns the forgotten-password feature in the management GUI of Symantec LiveUpdate Administrator. It allows remote attackers to reset arbitrary passwords by...

CVE-2014-1645: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in forcepasswd.do in the management GUI in Symantec LiveUpdate Administrator LUA 2.x before 2.3.2.110 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Symantec LiveUpdate Administrator Unauthenticated/Unauthorized Account Access Modification and SQL i

SUMMARY The management GUI for Symantec LiveUpdate Administrator does not properly protect the forgotten password functionality of the web interface. An unauthorized individual with knowledge of the email address for an authorized LUA user can potentially force an arbitrary password reset leading...

Symantec LiveUpdate Administrator < 2.3.2 Privilege Escalation (SYM12-009)

The version of LiveUpdate Administrator running on the remote host is earlier than 2.3.2. Such versions have a privilege escalation vulnerability due to insecure file permissions set by a default installation. The webapps directory allows write access to the Everyone group. A local, unprivileged...

Symantec LiveUpdate Administrator不安全文件权限本地特权提升漏洞

Bugtraq ID: 53903 CVE ID:CVE-2012-0304 Symantec LiveUpdate是Symantec用于自动更新Symantec病毒定义和产品的技术。 Symantec LiveUpdate Administrator不正确设置部分文件权限，本地攻击者可以利用漏洞删除操作和替换应用程序文件，可导致权限提升。 0 Symantec LiveUpdate Administrator 2.3 Symantec LiveUpdate Administrator 2.2.2.9 厂商补丁： Symantec ----------- Symantec...

CVE-2012-0304

Symantec LiveUpdate Administrator before 2.3.1 uses weak permissions Everyone: Full Control for the installation directory, which allows local users to gain privileges via a Trojan horse file...

Information disclosure

Symantec LiveUpdate Administrator before 2.3.1 uses weak permissions Everyone: Full Control for the installation directory, which allows local users to gain privileges via a Trojan horse file...

CVE-2012-0304

Symantec LiveUpdate Administrator before 2.3.1 uses weak permissions Everyone: Full Control for the installation directory, which allows local users to gain privileges via a Trojan horse file...

CVE-2012-0304

The CVE-2012-0304 entry concerns Symantec LiveUpdate Administrator prior to 2.3.1. The installation directory was configured with weak permissions (Everyone: Full Control), enabling a local unprivileged user to replace or modify files that can be executed with SYSTEM privileges via a Trojan horse...

PT-2012-2480

Name of the Vulnerable Software and Affected Versions Symantec LiveUpdate Administrator versions prior to 2.3.1 Description The issue is related to weak permissions set for the installation directory, allowing local users to gain privileges. This can be achieved by creating a Trojan horse file...

CVE-2012-0304: Undefined Security Weakness

Symantec LiveUpdate Administrator before 2.3.1 uses weak permissions Everyone: Full Control for the installation directory, which allows local users to gain privileges via a Trojan horse file...