Symantec LiveUpdate Administrator 2.3 Insecure File Permissions

SUMMARY Symantec LiveUpdate Administrator 2.3 and prior install some files with insecure file permissions during a default installation. These files allow full control permission to everyone which could result in arbitrary command execution with elevated privileges on the system. AFFECTED PRODUCT...

Symantec LiveUpdate Administrator Insecure Permissions Local Privilege Escalation (credentialed check)

The version of Symantec LiveUpdate Administrator LUA installed on the remote host has a privilege escalation vulnerability. The installation directory allows write access to the Everyone group. This directory contains batch files that are periodically executed as SYSTEM. A local, unprivileged...

Symantec LiveUpdate Administrator Installed (credentialed check)

Symantec LiveUpdate Administrator LUA was detected on the remote host. LUA provides centralized management for multiple internal LiveUpdate servers. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid59192; scriptversion"1.8";...

Symantec LiveUpdate Administrator控制请求伪造漏洞

CVE ID: CVE-2011-0545 Symantecs LiveUpdate Administrator可对内容提供基础架构支持。 Symantec LiveUpdate Administrator在实现上存在控制请求伪造漏洞，远程攻击者可利用此漏洞以管理员身份执行HTML或脚本代码。 此漏洞源于登录界面未能正确过滤或验证外部输入中的变量。在向受影响系统的事件日志提交了恶意条目后，授权管理员必须登录到管理界面GUI并访问事件登录页面触发漏洞。 Symantec LiveUpdate Administrator 2.2.2.9 厂商补丁： Symantec --------...

Symantec LiveUpdate Administrator Web Detection

Symantec LiveUpdate Administrator LUA was detected on the remote host. LUA provides centralized management for multiple internal LiveUpdate servers. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid53208; scriptversion"1.7"; scriptcvsdate"Date: 2019/11/22";...

Symantec LiveUpdate Administrator < 2.3 CSRF (SYM11-005)

The version of LiveUpdate Administrator running on the remote host is earlier than 2.3. Such versions have a cross-site request forgery CSRF vulnerability. Failed login attempts are logged and viewable from the web console. Usernames from these failed attempts are not sanitized before they are...

Cross site scripting

Cross-site scripting XSS vulnerability in the management login GUI page in Symantec LiveUpdate Administrator LUA before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event log, a different...

CVE-2011-1524

Cross-site scripting XSS vulnerability in the management login GUI page in Symantec LiveUpdate Administrator LUA before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event log, a different...

CVE-2011-1524

CVE-2011-1524 is an XSS vulnerability in the Symantec LiveUpdate Administrator (LUA) management login GUI prior to version 2.3. The issue allows remote attackers to inject arbitrary script via the username field, demonstrated by inserting an IFRAME into the event log. Affected component is the LU...

CVE-2011-1524

Cross-site scripting XSS vulnerability in the management login GUI page in Symantec LiveUpdate Administrator LUA before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event log, a different...

CVE-2011-0545

Cross-site request forgery CSRF vulnerability in adduser.do in Symantec LiveUpdate Administrator LUA before 2.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts, and possibly have unspecified other impact, via the userRole...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in adduser.do in Symantec LiveUpdate Administrator LUA before 2.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts, and possibly have unspecified other impact, via the userRole...

CVE-2011-0545

Cross-site request forgery CSRF vulnerability in adduser.do in Symantec LiveUpdate Administrator LUA before 2.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts, and possibly have unspecified other impact, via the userRole...

CVE-2011-0545

CVE-2011-0545 describes a cross-site request forgery in Symantec LiveUpdate Administrator (LUA) prior to version 2.3. The vulnerability occurs in the adduser.do endpoint via the userRole parameter, allowing a remote attacker to hijack administrator authentication to create new administrative acco...

CVE-2011-1524: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the management login GUI page in Symantec LiveUpdate Administrator LUA before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event log, a different...

CVE-2011-0545: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in adduser.do in Symantec LiveUpdate Administrator LUA before 2.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts, and possibly have unspecified other impact, via the userRole...

PT-2011-3190

Name of the Vulnerable Software and Affected Versions Symantec LiveUpdate Administrator LUA versions prior to 2.3 Description A cross-site scripting XSS issue exists in the management login GUI page, allowing remote attackers to inject arbitrary web script or HTML via the username field. This can...

PT-2011-2433

Name of the Vulnerable Software and Affected Versions Symantec LiveUpdate Administrator versions prior to 2.3 Description A cross-site request forgery issue affects the adduser.do endpoint, allowing remote attackers to hijack administrator authentication for creating new administrative accounts,...

Symantec LiveUpdate Administrator Management GUI HTML Injection

Exploit for windows platform in category web applications Symantec LiveUpdate Administrator is prone to an HTML-injection vulnerability. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected application, potentially allowing the attacker to...

Symantec LiveUpdate Administrator HTML injection vulnerability-vulnerability warning-the black bar safety net

Symantec LiveUpdate is the Symantec for automatically updating Symantec virus definitions and products of technology. LiveUpdate client with each Symantec product and installed automatically. LiveUpdate periodically connect to the LiveUpdate server to check the application on the computer to...