Symantec LiveUpdate Administrator Insecure Permissions Local Privilege Escalation (credentialed check)

The version of Symantec LiveUpdate Administrator LUA installed on the remote host has a privilege escalation vulnerability. The installation directory allows write access to the Everyone group. This directory contains batch files that are periodically executed as SYSTEM. A local, unprivileged...

Symantec LiveUpdate Administrator < 2.3 CSRF (SYM11-005)

The version of LiveUpdate Administrator running on the remote host is earlier than 2.3. Such versions have a cross-site request forgery CSRF vulnerability. Failed login attempts are logged and viewable from the web console. Usernames from these failed attempts are not sanitized before they are...

Symantec LiveUpdate Administrator Web Detection

Symantec LiveUpdate Administrator LUA was detected on the remote host. LUA provides centralized management for multiple internal LiveUpdate servers. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid53208; scriptversion"1.7"; scriptcvsdate"Date: 2019/11/22";...

Cross site scripting

Cross-site scripting XSS vulnerability in the management login GUI page in Symantec LiveUpdate Administrator LUA before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event log, a different...

CVE-2011-1524

Cross-site scripting XSS vulnerability in the management login GUI page in Symantec LiveUpdate Administrator LUA before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event log, a different...

CVE-2011-1524

CVE-2011-1524 is an XSS vulnerability in the Symantec LiveUpdate Administrator (LUA) management login GUI prior to version 2.3. The issue allows remote attackers to inject arbitrary script via the username field, demonstrated by inserting an IFRAME into the event log. Affected component is the LU...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in adduser.do in Symantec LiveUpdate Administrator LUA before 2.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts, and possibly have unspecified other impact, via the userRole...

CVE-2011-0545

CVE-2011-0545 describes a cross-site request forgery in Symantec LiveUpdate Administrator (LUA) prior to version 2.3. The vulnerability occurs in the adduser.do endpoint via the userRole parameter, allowing a remote attacker to hijack administrator authentication to create new administrative acco...

Symantec LiveUpdate Administrator HTML injection vulnerability-vulnerability warning-the black bar safety net

Symantec LiveUpdate is the Symantec for automatically updating Symantec virus definitions and products of technology. LiveUpdate client with each Symantec product and installed automatically. LiveUpdate periodically connect to the LiveUpdate server to check the application on the computer to...

Symantec LiveUpdate Administrator HTML injection vulnerability-vulnerability warning-the black bar safety net

Symantec LiveUpdate is the Symantec for automatically updating Symantec virus definitions and products of technology. LiveUpdate client with each Symantec product and installed automatically. LiveUpdate periodically connect to the LiveUpdate server to check the application on the computer to...

Symantec LiveUpdate Administrator Cross Site Request Forgery

NSOADV-2011-001: Symantec LiveUpdate Administrator CSRF vulnerability 111101111 11111 00110 00110001111 111111 01 01 1 11111011111111 11111 0 11 01 0 11 1 1 111011001 11111111101 1 11 0110111 1 1111101111 1001 0 1 10 11 0 10 11 1111111 1 111 111001 111111111 0 10 1111 0 11 11 111111111 1 1101 10...

Symantec Client Proxy ActiveX控件缓冲区溢出漏洞

BUGTRAQ ID: 38222 CVE ID: CVE-2010-0108 Symantec Client Security是集成了反病毒和防火墙的个人终端安全产品，Client Proxy是其中的一个组件。 Client Proxy的ActiveX控件实现上存在缓冲溢出漏洞，远程攻击者可能利用此漏洞通过诱使用户访问恶意网页在用户系统上执行任意指令，从而最终控制用户系统。 Symantec Client Security 3.1.x Symantec Client Security 3.0.x Symantec AntiVirus 10.2.x Symantec AntiVirus...

CVE-2006-1836

Untrusted search path vulnerability in unspecified components in Symantec LiveUpdate for Macintosh 3.0.0 through 3.5.0 do not set the execution path, which allows local users to gain privileges via a Trojan horse program...

Symantec LiveUpdate privilege escalation

No description provided...

Secure Network Operations SNOsoft Research Team [SRT2004-12-14-0322] Symantec LiveUpdate Advisory

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Secure Network Operations, Inc. http://www.secnetops.com/research Strategic Reconnaissance Team researchatsecnetops.com Team Lead Contact JxTatsecnetops.com Spam Contact rm -rf /@snosoft.com Who we are: Secure Network Operations provides network...

CVE-2003-0994

The GUI functionality for an interactive session in Symantec LiveUpdate 1.70.x through 1.90.x, as used in Norton Internet Security 2001 through 2004, SystemWorks 2001 through 2004, and AntiVirus and Norton AntiVirus Pro 2001 through 2004, AntiVirus for Handhelds v3.0, allows local users to gain...

Norton "WrapNISUM Class" (WrapUM.dll) ActiveX control allows remote arbitrary command execution

Overview Symantec's Norton Internet Security 2004 Professional is a software package that provides antivirus, antispam, and personal firewall applications. A vulnerability in an Symantec's Norton Internet Security 2004 suite may permit a remote attacker to execute arbitrary commands on the local...

Norton AntiSpam contains boundary error within the "SymSpamHelper Class" (symspam.dll) ActiveX component.

Overview Symantec's Norton AntiSpam is a software package that provides spam filtering. A vulnerability in an ActiveX control that ships with Norton AntiSpam may permit a remote attacker to execute arbitrary code on the local system. Description Symantec Norton AntiSpam for Windows installs the...

CVE-2003-0994

The GUI functionality for an interactive session in Symantec LiveUpdate 1.70.x through 1.90.x, as used in Norton Internet Security 2001 through 2004, SystemWorks 2001 through 2004, and AntiVirus and Norton AntiVirus Pro 2001 through 2004, AntiVirus for Handhelds v3.0, allows local users to gain...

SRT2004-01-9-1022 - Symantec LiveUpdate allows local users to become SYSTEM

Secure Network Operations, Inc. http://www.secnetops.com/research Strategic Reconnaissance Team researchatsecnetops.com Team Lead Contact kfatsecnetops.com Spam Contact rm -rf /@snosoft.com Our Mission: Secure Network Operations offers expertise in Networking, Intrusion Detection Systems IDS,...