CVE-2016-10256

The CVE-2016-10256 entry concerns Symantec ProxySG management consoles: versions 6.5 (before 6.5.10.6), 6.6, and 6.7 (before 6.7.2.1) are vulnerable to a reflected XSS via a crafted management console URL. An attacker could lure a user (phishing) to execute arbitrary JavaScript in the console cli...

CVE-2016-10257

Symantec ProxySG/ASG products are affected by CVE-2016-10257: a reflected XSS in the management console. Affected: ASG 6.6 and ASG 6.7 (before 6.7.2.1); ProxySG 6.5 (before 6.5.10.6), 6.6, and 6.7 (before 6.7.2.1). The flaw allows an attacker to inject arbitrary JavaScript into the management con...

SA155: Multiple ASG and ProxySG Vulnerabilities

SUMMARY The Symantec ASG and ProxySG management consoles are susceptible to multiple vulnerabilities. A remote attacker can, under certain circumstances, obtain sensitive authentication credential information, redirect target users to malicious sites, and inject arbitrary JavaScript code into the...

SA161: Local Information Disclosure Due to Meltdown and Spectre Attacks

SUMMARY Symantec Network Protection products, which run on an affected CPU chipset and execute arbitrary code from external sources, are susceptible to several information disclosure vulnerabilities aka Meltdown and Spectre attacks. A remote attacker, with the ability to execute arbitrary code...

SA157: OpenSSL Vulnerabilities 28-Aug-2017 and 2-Nov-2017

SUMMARY Symantec Network Protection products using affected versions of OpenSSL are susceptible to several vulnerabilities. A remote attacker can send a crafted X.509 certificate to cause unspecified impact. They can exploit, under certain circumstances, a computational flaw in the Montgomery...

Symantec ProxySG and Advanced Secure Gateway Remote Authorization Bypass Vulnerability

Symantec ProxySG and Advanced Secure Gateway ASG are both security gateway appliances from Symantec USA. A security vulnerability exists in Symantec ProxySG and ASG. A remote attacker could exploit the vulnerability to access the management console functionality...

Symantec (Blue Coat) ProxySG 6.5.x < 6.5.10.6 / 6.6.x < 6.6.5.8 / 6.7.x < 6.7.1.2 Impromper User Authorization Vulnerability

The self-reported version of the remote Symantec Blue Coat ProxySG device is 6.5.x prior to 6.5.10.6, 6.6.x prior to 6.6.5.8, or 6.7.x prior to 6.7.1.2. It is, therefore, affected by an improper user authorization vulnerability in web-based management console. C Tenable Network Security, Inc...

SA146: Improper User Authorization in ProxySG and ASG

SUMMARY The ProxySG and ASG management consoles do not, under certain circumstances, correctly authorize administrator users. A malicious administrator with read-only access can exploit this vulnerability to access management console functionality that requires read-write access privileges...

SA151: ImageMagick RCE Vulnerability (ImageTragick)

SUMMARY Symantec Network Protection products using affected versions of ImageMagick are susceptible to the ImageTragick security vulnerability. A remote attacker can send crafted images and execute arbitrary code on the target. AFFECTED PRODUCTS The following products are vulnerable: Security...

Multiple Blue Coat Product Security Bypass Vulnerabilities

Blue Coat Advanced Secure Gateway, CacheFlow, and ProxySG are all products of Blue Coat Systems, Inc. Blue Coat Advanced Secure Gateway is a secure Web gateway appliance; CacheFlow is a network CacheFlow is a network gas pedal; ProxySG is a switch. A security vulnerability exists in Blue Coat...

CVE-2016-6594

The CVE-2016-6594 entry affects Blue Coat Advanced Secure Gateway 6.6, CacheFlow 3.4, and ProxySG 6.5/6.6. Description details a Security Control Bypass: when server hostname is unavailable, the products perform a reverse DNS (RDNS) lookup on the server IP to resolve a hostname. Depending on poli...

CVE-2016-9100

Symantec Advanced Secure Gateway ASG 6.6 prior to 6.6.5.13, ASG 6.7 prior to 6.7.3.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6 prior to 6.6.5.13, and ProxySG 6.7 prior to 6.7.3.1 are susceptible to an information disclosure vulnerability. An attacker with local access to the client host of an...

CVE-2016-9099

Symantec Advanced Secure Gateway ASG 6.6, ASG 6.7 prior to 6.7.2.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6, and ProxySG 6.7 prior to 6.7.2.1 are susceptible to an open redirection vulnerability. A remote attacker can use a crafted management console URL in a phishing attack to redirect the...

Design/Logic Flaw

The Symantec Advanced Secure Gateway ASG 6.6 prior to 6.6.5.8, ProxySG 6.5 prior 6.5.10.6, ProxySG 6.6 prior to 6.6.5.8, and ProxySG 6.7 prior to 6.7.1.2 management consoles do not, under certain circumstances, correctly authorize administrator users. A malicious administrator with read-only acce...

Information disclosure

Symantec Advanced Secure Gateway ASG 6.6 prior to 6.6.5.13, ASG 6.7 prior to 6.7.3.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6 prior to 6.6.5.13, and ProxySG 6.7 prior to 6.7.3.1 are susceptible to an information disclosure vulnerability. An attacker with local access to the client host of an...

Open redirect

Symantec Advanced Secure Gateway ASG 6.6, ASG 6.7 prior to 6.7.2.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6, and ProxySG 6.7 prior to 6.7.2.1 are susceptible to an open redirection vulnerability. A remote attacker can use a crafted management console URL in a phishing attack to redirect the...

CVE-2016-9100

Symantec Advanced Secure Gateway ASG 6.6 prior to 6.6.5.13, ASG 6.7 prior to 6.7.3.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6 prior to 6.6.5.13, and ProxySG 6.7 prior to 6.7.3.1 are susceptible to an information disclosure vulnerability. An attacker with local access to the client host of an...

CVE-2016-9100

The CVE-2016-9100 entry affects Symantec ASG/ProxySG: ASG 6.6 before 6.6.5.13, ASG 6.7 before 6.7.3.1, ProxySG 6.5 before 6.5.10.6, ProxySG 6.6 before 6.6.5.13, and ProxySG 6.7 before 6.7.3.1 are vulnerable to information disclosure. An attacker with local access to the client host of an authenti...

CVE-2016-9099

Symantec Advanced Secure Gateway ASG 6.6, ASG 6.7 prior to 6.7.2.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6, and ProxySG 6.7 prior to 6.7.2.1 are susceptible to an open redirection vulnerability. A remote attacker can use a crafted management console URL in a phishing attack to redirect the...

CVE-2016-9099

CVE-2016-9099 is an open redirect vulnerability affecting Symantec ASG/ProxySG: ASG 6.6, ASG 6.7 before 6.7.2.1, ProxySG 6.5 before 6.5.10.6, ProxySG 6.6, and ProxySG 6.7 before 6.7.2.1. An attacker can use a crafted management console URL in a phishing scenario to redirect users to a malicious s...