CVE-2018-5241

Symantec Advanced Secure Gateway ASG 6.6 and 6.7, and ProxySG 6.5, 6.6, and 6.7 are susceptible to a SAML authentication bypass vulnerability. The products can be configured with a SAML authentication realm to authenticate network users in intercepted proxy traffic. When parsing SAML responses, A...

CVE-2018-5241

CVE-2018-5241 affects Symantec Advanced Secure Gateway (ASG) and ProxySG. The vulnerability arises when parsing SAML responses: XML nodes with comments are mishandled, allowing a remote attacker to modify a valid SAML response without invalidating its cryptographic signature and bypass authentica...

SA165: NTP Vulnerabilities February 2018

SUMMARY Symantec Network Protection products using affected versions of the NTP reference implementation from ntp.org are susceptible to multiple vulnerabilities. A remote attacker can exploit these vulnerabilities to execute arbitrary code, modify the target's system time, prevent the target fro...

Symantec Advanced Secure Gateway and ProxySG Cross-Site Scripting Vulnerability

Symantec Advanced Secure Gateway ASG and ProxySG are both security gateway appliances from Symantec USA. A cross-site scripting vulnerability exists in Symantec ASG and ProxySG. A remote attacker could exploit this vulnerability to inject arbitrary JavaScript code into the management console web...

Symantec Advanced Secure Gateway and ProxySG Arbitrary File Upload Vulnerability

Symantec Advanced Secure Gateway ASG and ProxySG are both security gateway appliances from Symantec USA. An arbitrary file upload vulnerability exists in Symantec ASG and ProxySG management consoles. An attacker could exploit this vulnerability to upload arbitrary malicious files to the managemen...

CVE-2016-10258

Unrestricted file upload vulnerability in the Symantec Advanced Secure Gateway ASG and ProxySG management consoles. A malicious appliance administrator can upload arbitrary malicious files to the management console and trick another administrator user into downloading and executing malicious code...

CVE-2017-13677

Denial-of-service DoS vulnerability in the Symantec Advanced Secure Gateway ASG and ProxySG management consoles. A remote attacker can use crafted HTTP/HTTPS requests to cause denial-of-service through management console application crashes...

CVE-2017-13677

Denial-of-service DoS vulnerability in the Symantec Advanced Secure Gateway ASG and ProxySG management consoles. A remote attacker can use crafted HTTP/HTTPS requests to cause denial-of-service through management console application crashes...

CVE-2017-9963

A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 for multiple state-changing requests. This type of attack require...

CVE-2017-9963

Summary: A cross-site request forgery vulnerability exists in the Secure Gateway component of Schneider Electric’s PowerSCADA Anywhere 1.0 (bundled with PowerSCADA Expert 8.1/8.2) and Citect Anywhere 1.0. The flaw enables multiple state-changing requests and requires some social engineering to lu...

SA163: OpenSSH Vulnerability October 2017

SUMMARY Symantec Network Protection products using affected versions of OpenSSH are susceptible to a security vulnerability. A remote attacker with read-only access to an SFTP server can create a large number of zero-length files and deplete the target's hard disk space. AFFECTED PRODUCTS The...

Symantec ASG and ProxySG Cross-Site Scripting Vulnerabilities

Symantec Advanced Secure Gateway ASG and ProxySG are both security gateway appliances from Symantec, Inc. management console is one of the management consoles. A cross-site scripting vulnerability exists in the management console in Symantec ASG and ProxySG. A remote attacker could exploit this...

Symantec ProxySG and Advanced Secure Gateway Information Disclosure Vulnerability

Symantec ProxySG and Advanced Secure Gateway ASG are both security gateway appliances from Symantec USA. An information disclosure vulnerability exists in Symantec ProxySG and ASG. A remote attacker could exploit the vulnerability to obtain sensitive information...

CVE-2016-10257

The Symantec Advanced Secure Gateway ASG 6.6, ASG 6.7 prior to 6.7.2.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6, and ProxySG 6.7 prior to 6.7.2.1 management console is susceptible to a reflected XSS vulnerability. A remote attacker can use a crafted management console URL in a phishing attack ...

SA161: Local Information Disclosure Due to Meltdown and Spectre Attacks

SUMMARY Symantec Network Protection products, which run on an affected CPU chipset and execute arbitrary code from external sources, are susceptible to several information disclosure vulnerabilities aka Meltdown and Spectre attacks. A remote attacker, with the ability to execute arbitrary code...

CVE-2017-18001

Trustwave Secure Web Gateway SWG through 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and consequently obtain remote root access, via the publicKey parameter to the /sendKey URI...

SA157: OpenSSL Vulnerabilities 28-Aug-2017 and 2-Nov-2017

SUMMARY Symantec Network Protection products using affected versions of OpenSSL are susceptible to several vulnerabilities. A remote attacker can send a crafted X.509 certificate to cause unspecified impact. They can exploit, under certain circumstances, a computational flaw in the Montgomery...

Symantec ProxySG and Advanced Secure Gateway Remote Authorization Bypass Vulnerability

Symantec ProxySG and Advanced Secure Gateway ASG are both security gateway appliances from Symantec USA. A security vulnerability exists in Symantec ProxySG and ASG. A remote attacker could exploit the vulnerability to access the management console functionality...

CVE-2017-7970

A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 that allows the ability to specify Arbitrary Server Target Nodes in connection requests to the Secure Gateway and Server...

CVE-2017-7969

A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 for multiple state-changing requests. This type of attack require...