CVE-2015-6554

The CVE-2015-6554 issue affects Symantec Endpoint Protection Manager (SEPM) 12.1 prior to 12.1-RU6-MP3, allowing remote execution of arbitrary OS commands via crafted data sent to SEPM. Affected vector is remote, with evidence across multiple sources describing an RCE through untrusted data handl...

CVE-2015-6555

Affected software: Symantec Endpoint Protection Manager (SEPM) 12.1 prior to 12.1-RU6-MP3. Vulnerability: remote attackers can execute arbitrary Java code by connecting to the SEPM console Java port (CVE-2015-6555). Root cause / impact: improper handling of external data on the management console...

Symantec Endpoint Protection Manager < 12.1 RU6 MP1 Multiple Vulnerabilities (SYM15-007)

The version of Symantec Endpoint Protection Manager SEPM running on the remote host is prior to 12.1 RU6 MP1. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the password reset functionality that allows a remote attacker, using a crafted password reset action, to...

CVE-2015-1490

Directory traversal vulnerability in the management console in Symantec Endpoint Protection Manager SEPM 12.1 before 12.1-RU6-MP1 allows remote authenticated users to read arbitrary files via a relative pathname in a client installation package...

CVE-2015-1487

The management console in Symantec Endpoint Protection Manager SEPM 12.1 before 12.1-RU6-MP1 allows remote authenticated users to write to arbitrary files, and consequently obtain administrator privileges, via a crafted filename...

Authentication flaw

The management console in Symantec Endpoint Protection Manager SEPM 12.1 before 12.1-RU6-MP1 allows remote attackers to bypass authentication via a crafted password-reset action that triggers a new administrative session...

CVE-2015-1491

Symantec Endpoint Protection Manager (SEPM) 12.1 prior to 12.1-RU6-MP1 is affected by CVE-2015-1491, a SQL injection vulnerability in the SEPM management console that allows an authenticated remote user to execute arbitrary SQL commands. The issue is part of a broader set of vulnerabilities (SYM1...

CVE-2015-1486

CVE-2015-1486 affects Symantec Endpoint Protection Manager (SEPM) 12.1 prior to 12.1-RU6-MP1, enabling remote authentication bypass via a crafted password-reset action that creates a new admin session. Related materials show exploit paths (e.g., Metasploit module, exploit-db entry) indicating pra...

CVE-2015-1490

Symantec Endpoint Protection Manager (SEPM) 12.1 prior to 12.1-RU6-MP1 is affected by CVE-2015-1490, a directory traversal vulnerability in the SEPM management console. An authenticated remote attacker can read arbitrary files via a relative pathname in a client installation package due to improp...

CVE-2015-1490

Directory traversal vulnerability in the management console in Symantec Endpoint Protection Manager SEPM 12.1 before 12.1-RU6-MP1 allows remote authenticated users to read arbitrary files via a relative pathname in a client installation package...

CVE-2015-1489

CVE-2015-1489 affects Symantec Endpoint Protection Manager (SEPM) 12.1 prior to 12.1-RU6-MP1. The SEPM management console vulnerability allows remote authenticated users to gain privileges via unspecified vectors. Related connected sources document an authentication bypass and privilege escalatio...

CVE-2015-1487

The SEPM (Symantec Endpoint Protection Manager) product is affected by CVE-2015-1487: a flaw in the management console prior to 12.1-RU6-MP1 allows remote authenticated users to write arbitrary files via a crafted filename, potentially elevating to administrator privileges. Technical context from...

Symantec Endpoint Protection Multiple Vulnerabilities

Exploit for multiple platform in category remote exploits Code White found several vulnerabilities in Symantec Endpoint Protection SEP, affecting versions 12.1 prior to 12.1 RU6 MP1. SEP Manager SEPM: CVE-2015-1486: Authentication Bypass CVE-2015-1487: Arbitrary File Write CVE-2015-1488: Arbitrar...

CVE-2014-3438

Multiple cross-site scripting XSS vulnerabilities in console interface scripts in Symantec Endpoint Protection Manager SEPM 12.1 before RU5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3438

Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 is affected by CVE-2014-3438, a reflected Cross-Site Scripting (XSS) vulnerability in the console interface (notably via the ErrorMsg handling in SSO-Error.jsp and related UI paths). Exploitation could allow an attacker to inject script ...

CVE-2014-3437

Symantec Endpoint Protection Manager (SEPM) 12.1 prior to RU5 is affected by multiple vulnerabilities (CVE-2014-3437 XXE, CVE-2014-3438 XSS, CVE-2014-3439 arbitrary file write). The XXE flaw allows reading files or sending requests to intranet servers via crafted XML; XSS can exfiltrate sessions;...

CVE-2014-3439

Symantec Endpoint Protection Manager (SEPM) 12.1 prior to RU5 is affected by CVE-2014-3439: an Unauthenticated Arbitrary File Write in the ConsoleServlet, caused by improper filtering of user input in the logging component. This can allow remote attackers to write arbitrary files, potentially ena...

CVE-2014-3437

The management console in Symantec Endpoint Protection Manager SEPM 12.1 before RU5 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External...

Symantec Endpoint Protection Manager 12.1.x - SEH Overflow POC

No description provided by source. Exploit-DB mirror: http://www.exploit-db.com/sploits/33056-sepm-secars-poc-v0.3.tar.gz !/usr/bin/perl -w Exploit Title: Symantec Endpoint Protection Manager 12.1.x - SEH Overflow POC Date: 31 January 2013 Exploit Author: [email protected] a.k.a...

Symantec Endpoint Protection Manager XML External Entity Denial Of Service (CVE-2013-5014)

A XML external entity XXE vulnerability exists in Symantec Endpoint Protection Manager SEPM. This is due to an incorrectly configured XML parser in the management console that readily processes XML external entities. A remote unauthenticated attacker may exploit this vulnerability via specially...