CVE-2018-18370

The CVE-2018-18370 issue affects ASG/ProxySG FTP proxy WebFTP mode and is a stored XSS vulnerability in the web listing of remote FTP servers. An attacker must be able to upload crafted files to the remote FTP server to inject malicious JavaScript via a ftp:// URL in a browser. Affected versions ...

CVE-2018-18370

The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. A stored cross-site scripting XSS vulnerability in the WebFTP mode allows a remote attacker to inject malicious JavaScript code in ASG/ProxySG's web...

Symantec ProxySG 6.5 / 6.6 / 6.7 < 6.7.4.1 OpenSSL Denial of Service Vulnerability (SA1462)

The self-reported SGOS version installed on the remote Symantec ProxySG device is 6.5.x, 6.6.x or 6.7 prior to 6.7.4.1. It is, therefore, affected by OpenSSL denial of service vulnerability. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid128303; scriptversion"1.3";...

XSS and Information Disclosure Vulnerabilities in ASG and ProxySG

SUMMARY The Symantec ASG and ProxySG FTP proxy WebFTP mode is susceptible to XSS and information disclosure vulnerabilities. A remote attacker can inject malicious JavaScript code in the web listing of a remote FTP server and obtain authentication credentials for a remote FTP server. AFFECTED...

CVE-2018-5241

Symantec Advanced Secure Gateway ASG 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability. The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing SAML responses, A...

Authentication flaw

Symantec Advanced Secure Gateway ASG 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability. The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing SAML responses, A...

CVE-2018-5241

Symantec Advanced Secure Gateway ASG 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability. The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing SAML responses, A...

CVE-2018-5241

Symantec Advanced Secure Gateway ASG 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability. The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing SAML responses, A...

CVE-2018-5241

CVE-2018-5241 affects Symantec Advanced Secure Gateway (ASG) and ProxySG. The vulnerability arises when parsing SAML responses: XML nodes with comments are mishandled, allowing a remote attacker to modify a valid SAML response without invalidating its cryptographic signature and bypass authentica...

SA167: SAML Authentication Bypass

SUMMARY When configured to authenticate network users with a SAML authentication realm, Symantec ASG and ProxySG incorrectly handle SAML responses that have XML nodes with comments. A remote attacker can modify a valid SAML response without invalidating its cryptographic signature to bypass SAML...

Symantec Advanced Secure Gateway and ProxySG Cross-Site Scripting Vulnerability

Symantec Advanced Secure Gateway ASG and ProxySG are both security gateway appliances from Symantec USA. A cross-site scripting vulnerability exists in Symantec ASG and ProxySG. A remote attacker could exploit this vulnerability to inject arbitrary JavaScript code into the management console web...

Symantec Advanced Secure Gateway and ProxySG Denial of Service Vulnerability

Symantec Advanced Secure Gateway ASG and ProxySG are both security gateway appliances from Symantec USA. A denial of service vulnerability exists in Symantec ASG and ProxySG. A remote attacker could exploit this vulnerability to cause a denial of service management console application crash by...

Symantec ProxySG 6.5 < 6.5.10.8 / 6.6 < 6.6.5.14 / 6.7.3 < 6.7.3.7 / 6.7.4 < 6.7.4.1 Multiple Vulnerabilities (SA162)

The self-reported SGOS version installed on the remote Symante ProxySG device is 6.5.x prior to 6.5.10.8, 6.6.x prior to 6.6.5.14, 6.7.3.x prior to 6.7.3.7, or 6.7.4.x prior to 6.7.4.1. It is, therefore, affected by multiple vulnerabilities: - An unrestricted file upload vulnerability exists in t...

Unrestricted file upload

Unrestricted file upload vulnerability in the Symantec Advanced Secure Gateway ASG and ProxySG management consoles. A malicious appliance administrator can upload arbitrary malicious files to the management console and trick another administrator user into downloading and executing malicious code...

CVE-2017-13678

Stored XSS vulnerability in the Symantec Advanced Secure Gateway ASG and ProxySG management consoles. A malicious appliance administrator can inject arbitrary JavaScript code in the management console web client application...

Cross site scripting

Stored XSS vulnerability in the Symantec Advanced Secure Gateway ASG and ProxySG management consoles. A malicious appliance administrator can inject arbitrary JavaScript code in the management console web client application...

CVE-2017-13677

Denial-of-service DoS vulnerability in the Symantec Advanced Secure Gateway ASG and ProxySG management consoles. A remote attacker can use crafted HTTP/HTTPS requests to cause denial-of-service through management console application crashes...

CVE-2016-10258

Unrestricted file upload vulnerability in the Symantec Advanced Secure Gateway ASG and ProxySG management consoles. A malicious appliance administrator can upload arbitrary malicious files to the management console and trick another administrator user into downloading and executing malicious code...

CVE-2017-13677

Denial-of-service DoS vulnerability in the Symantec Advanced Secure Gateway ASG and ProxySG management consoles. A remote attacker can use crafted HTTP/HTTPS requests to cause denial-of-service through management console application crashes...

CVE-2017-13678

Stored XSS vulnerability in the Symantec Advanced Secure Gateway ASG and ProxySG management consoles. A malicious appliance administrator can inject arbitrary JavaScript code in the management console web client application...