CVE-2012-0307

CVE-2012-0307 affects Symantec Messaging Gateway (SMG) prior to version 10.0. The vulnerability class is multiple cross-site scripting (XSS) issues, allowing remote attackers to inject arbitrary web script or HTML via (1) web content or (2) e-mail content. The public references describe XSS in th...

CVE-2012-3581

Symantec Messaging Gateway (SMG) before 10.0 suffers an Information Disclosure vulnerability (CVE-2012-3581) that allows remote attackers to obtain potentially sensitive information about component versions via unspecified vectors. Exploitation status is not detailed in the provided documents. Re...

CVE-2012-3580

Symantec Messaging Gateway (SMG) prior to version 10.0 is affected by CVE-2012-3580, where remote authenticated users who have access to the management interface can modify the web application. The root cause is described as a web application modification issue that can be exploited by an authent...

CVE-2012-3579

Symantec Messaging Gateway SMG before 10.0 has a default password for an unspecified account, which makes it easier for remote attackers to obtain privileged access via an SSH session...

Symantec Messaging Gateway 9.5/9.5.1 SSH Default Password Security Bypass Vulnerability

Exploit for windows platform in category remote exploits This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework...

PT-2012-2484

Name of the Vulnerable Software and Affected Versions Symantec Messaging Gateway versions prior to 10.0 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators. Recommendations For versions prior to 10.0, update to version 10.0 or late...

PT-2012-4827

Name of the Vulnerable Software and Affected Versions Symantec Messaging Gateway versions prior to 10.0 Description The issue allows remote attackers to obtain potentially sensitive information about component versions. Recommendations For versions prior to 10.0, update to version 10.0 or later t...

PT-2012-4825

Name of the Vulnerable Software and Affected Versions Symantec Messaging Gateway versions prior to 10.0 Description The issue allows remote attackers to gain privileged access via an SSH session due to a default password for an unspecified account. Recommendations For versions prior to 10.0, chan...

PT-2012-2483

Name of the Vulnerable Software and Affected Versions Symantec Messaging Gateway versions prior to 10.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via two main vectors: 1 web...

CVE-2012-0308: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Symantec Messaging Gateway SMG before 10.0 allows remote attackers to hijack the authentication of administrators...

PT-2012-4826

Name of the Vulnerable Software and Affected Versions Symantec Messaging Gateway versions prior to 10.0 Description The issue allows remote authenticated users to modify the web application by leveraging access to the management interface. Recommendations For versions prior to 10.0, update to...

CVE-2012-0307: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Symantec Messaging Gateway SMG before 10.0 allow remote attackers to inject arbitrary web script or HTML via 1 web content or 2 e-mail content...

CVE-2012-3579: Undefined Security Weakness

Symantec Messaging Gateway SMG before 10.0 has a default password for an unspecified account, which makes it easier for remote attackers to obtain privileged access via an SSH session...

CVE-2012-3581: Exposure of Sensitive Information to an Unauthorized Actor

Symantec Messaging Gateway SMG before 10.0 allows remote attackers to obtain potentially sensitive information about component versions via unspecified vectors...

CVE-2012-3580: Undefined Security Weakness

Symantec Messaging Gateway SMG before 10.0 allows remote authenticated users to modify the web application by leveraging access to the management interface...

Symantec Messaging Gateway Security Issues

SUMMARY Symantec's Messaging Gateway management console is susceptible to several security issues including cross-site scripting/cross-site request forgery, an SSH account with a default password, file downloads and potential web application modifications. Successful exploitation could result in...

Symantec Messaging Gateway 9.5 Default SSH Password Vulnerability

This module exploits a default misconfiguration flaw on Symantec Messaging Gateway. The 'support' user has a known default password, which can be used to login to the SSH service, and gain privileged access from remote. Module Options msf use exploit/linux/ssh/symantec/smgssh msf undefinedsmgssh...

[SECURITY] Fedora 16 Update: libotr-3.2.1-1.fc16

Off-the-Record Messaging Library and Toolkit This is a library and toolkit which implements Off-the-Record OTR Messagi ng. OTR allows you to have private conversations over IM by providing Encryptio n, Authentication, Deniability and Perfect forward secrecy...

[SECURITY] Fedora 17 Update: libotr-3.2.1-1.fc17

Off-the-Record Messaging Library and Toolkit This is a library and toolkit which implements Off-the-Record OTR Messagi ng. OTR allows you to have private conversations over IM by providing Encryptio n, Authentication, Deniability and Perfect forward secrecy...

[USN-1541-1] libotr vulnerability

========================================================================== Ubuntu Security Notice USN-1541-1 August 16, 2012 libotr vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...