CVE-2012-4347

Multiple directory traversal vulnerabilities in the management console in Symantec Messaging Gateway SMG 9.5.x allow remote authenticated users to read arbitrary files via a .. dot dot in the 1 logFile parameter in a logs action to brightmail/export or 2 localBackupFileSelection parameter in an...

Directory traversal

Multiple directory traversal vulnerabilities in the management console in Symantec Messaging Gateway SMG 9.5.x allow remote authenticated users to read arbitrary files via a .. dot dot in the 1 logFile parameter in a logs action to brightmail/export or 2 localBackupFileSelection parameter in an...

CVE-2012-4347

Symantec Messaging Gateway (SMG) 9.5.x exposes multiple directory traversal vulnerabilities in its management console. The issues allow remote authenticated users to read arbitrary files by manipulating the logFile parameter (logs action to brightmail/export) or the localBackupFileSelection param...

CVE-2012-4347

Multiple directory traversal vulnerabilities in the management console in Symantec Messaging Gateway SMG 9.5.x allow remote authenticated users to read arbitrary files via a .. dot dot in the 1 logFile parameter in a logs action to brightmail/export or 2 localBackupFileSelection parameter in an...

PT-2012-5346

Name of the Vulnerable Software and Affected Versions Symantec Messaging Gateway versions 9.5.x Description The issue concerns directory traversal vulnerabilities in the management console. These vulnerabilities allow remote authenticated users to read arbitrary files. This can be achieved by...

CVE-2012-4347: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in the management console in Symantec Messaging Gateway SMG 9.5.x allow remote authenticated users to read arbitrary files via a .. dot dot in the 1 logFile parameter in a logs action to brightmail/export or 2 localBackupFileSelection parameter in an...

Symantec Messaging Gateway 9.5.3-3 Arbitrary File Download

Symantec Messaging Gateway version 9.5.3-3 suffers from an authenticated arbitrary file download vulnerability. ======= Summary ======= Name: Symantec Messaging Gateway - Arbitrary file download is possible with a crafted URL authenticated Release Date: 30 November 2012 Reference: NGS00266...

Symantec Messaging Gateway 9.5.3-3 CSRF Vulnerability

Symantec Messaging Gateway version 9.5.3-3 suffers from a cross site request forgery vulnerability. ======= Summary ======= Name: Symantec Messaging Gateway - Easy CSRF to add a backdoor-administrator for example Release Date: 30 November 2012 Reference: NGS00263 Discoverer: Ben Williams Vendor:...

Symantec Messaging Gateway 9.5.3-3 - Arbitrary File Download

Symantec Messaging Gateway 9.5.3-3 - Arbitrary File Download ======= Summary ======= Name: Symantec Messaging Gateway - Arbitrary file download is possible with a crafted URL authenticated Release Date: 30 November 2012 Reference: NGS00266 Discoverer: Ben Williams Vendor: Symantec Vendor Referenc...

Symantec Messaging Gateway 9.5.3-3 - Cross-Site Request Forgery

Symantec Messaging Gateway 9.5.3-3 - Cross-Site Request Forgery ======= Summary ======= Name: Symantec Messaging Gateway - Easy CSRF to add a backdoor-administrator for example Release Date: 30 November 2012 Reference: NGS00263 Discoverer: Ben Williams Vendor: Symantec Vendor Reference: Systems...

Symantec Messaging Gateway 9.5.3-3 - Arbitrary File Download

======= Summary ======= Name: Symantec Messaging Gateway - Arbitrary file download is possible with a crafted URL authenticated Release Date: 30 November 2012 Reference: NGS00266 Discoverer: Ben Williams Vendor: Symantec Vendor Reference: Systems Affected: Symantec Messaging Gateway 9.5.3-3 Risk:...

Symantec Messaging Gateway 9.5.3-3 - Cross-Site Request Forgery

======= Summary ======= Name: Symantec Messaging Gateway - Easy CSRF to add a backdoor-administrator for example Release Date: 30 November 2012 Reference: NGS00263 Discoverer: Ben Williams Vendor: Symantec Vendor Reference: Systems Affected: Symantec Messaging Gateway 9.5.3-3 Risk: High Status:...

Symantec Messaging Gateway Detection (HTTP)

HTTP based detection of Symantec Messaging Gateway. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Symantec Messaging Gateway < 10.0 CSRF Vulnerability

Symantec Messaging Gateway is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

NGS000263 Technical Advisory: Symantec Messaging Gateway Easy CSRF to add a backdoor-administrator

======= Summary ======= Name: Symantec Messaging Gateway - Easy CSRF to add a backdoor-administrator for example Release Date: 30 November 2012 Reference: NGS00263 Discoverer: Ben Williams [email protected] Vendor: Symantec Vendor Reference: Systems Affected: Symantec Messaging Gateway...

NGS000266 Technical Advisory: Symantec Messaging Gateway Arbitrary file download is possible with a crafted URL

======= Summary ======= Name: Symantec Messaging Gateway - Arbitrary file download is possible with a crafted URL authenticated Release Date: 30 November 2012 Reference: NGS00266 Discoverer: Ben Williams [email protected] Vendor: Symantec Vendor Reference: Systems Affected: Symantec...

NGS000267 Technical Advisory: Symantec Messaging Gateway SSH with backdoor user account plus privilege escalation to root due to very old Kernel

======= Summary ======= Name: Symantec Messaging Gateway - SSH with backdoor user account + privilege escalation to root due to very old Kernel Release Date: 30 November 2012 Reference: NGS00267 Discoverer: Ben Williams [email protected] Vendor: Symantec Vendor Reference: Systems Affecte...

NGS000268 Technical Advisory: Symantec Messaging Gateway - Out-of-band stored-XSS delivered by email

======= Summary ======= Name: Symantec Messaging Gateway - Out-of-band stored-XSS delivered by email Release Date: 30 November 2012 Reference: NGS00268 Discoverer: Ben Williams [email protected] Vendor: Symantec Vendor Reference: Systems Affected: Symantec Messaging Gateway 9.5.3-3 Risk:...

Symantec Messaging Gateway multiple security vulnerabilities

Information leakage, crossite scripting, crossite requests forgery...

Symantec Messaging Gateway 9.5.3-3 Cross Site Request Forgery

======= Summary ======= Name: Symantec Messaging Gateway - Easy CSRF to add a backdoor-administrator for example Release Date: 30 November 2012 Reference: NGS00263 Discoverer: Ben Williams Vendor: Symantec Vendor Reference: Systems Affected: Symantec Messaging Gateway 9.5.3-3 Risk: High Status:...