Design/Logic Flaw

ghostexp.exe in Ghost Explorer Utility in Symantec Ghost Solutions Suite GSS before 3.0 HF2 12.0.0.8010 and Symantec Deployment Solution DS before 7.6 HF4 12.0.0.7045 performs improper sign-extend operations before array-element accesses, which allows remote attackers to execute arbitrary code,...

Sql injection

Multiple SQL injection vulnerabilities in interface PHP scripts in the Manager component in Symantec Endpoint Protection SEP before 12.1.6 allow remote authenticated users to execute arbitrary SQL commands by leveraging the Limited Administrator role...

Design/Logic Flaw

Multiple untrusted search path vulnerabilities in the Manager component in Symantec Endpoint Protection SEP before 12.1.6 allow local users to gain privileges via a Trojan horse DLL in an unspecified directory...

Design/Logic Flaw

sysplant.sys in the Manager component in Symantec Endpoint Protection SEP before 12.1.6 allows local users to cause a denial of service blocked system shutdown by triggering an unspecified deadlock condition...

Design/Logic Flaw

The management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands via vectors related to "traffic capture."...

CVE-2014-9227

Multiple untrusted search path vulnerabilities in the Manager component in Symantec Endpoint Protection SEP before 12.1.6 allow local users to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2015-6548

CVE-2015-6548 is part of multiple vulnerabilities affecting Symantec Web Gateway (SWG) management console on appliances running software before 5.2.2 with DB 5.0.0.1277. The connected documents confirm a concrete SQL injection issue in the edit_alert.php script that allows an authenticated, remot...

CVE-2015-6548

Multiple SQL injection vulnerabilities in a PHP script in the management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-5690

The management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands by leveraging a "redirect."...

CVE-2015-5691

The CVE-2015-5691 issue affects Symantec Web Gateway (SWG) management console on SWG appliances prior to version 5.2.2 with DB 5.0.0.1277, where PHP-based management-console scripts (notably admin_messages.php) are vulnerable to reflected XSS that can cause arbitrary script execution in a user’s ...

CVE-2015-5692

Symantec Web Gateway (SWG) management console prior to SWG 5.2.2 with DB 5.0.0.1277 is affected by CVE-2015-5692. The issue resides in admin_messages.php, where improper sanitization of uploaded files and a weak sudo configuration allow an authenticated attacker to upload a safe file and leverage...

CVE-2015-5689

CVE-2015-5689 affects Symantec Ghost Solutions Suite and related components (Ghost Explorer Utility; DS) prior to specific HF builds. The issue is improper sign-extension before array-element accesses, enabling remote code execution, application DoS, or potential information disclosure via a craf...

CVE-2014-9227

CVE-2014-9227 affects Symantec Endpoint Protection Manager (SEPM) prior to 12.1 RU6. The vulnerability is a DLL loading/pre-loading weakness that allows a local attacker to gain elevated privileges by placing a malicious DLL in a directory or on a network share and enticing the user to load it. O...

CVE-2014-9229

Symantec Endpoint Protection Manager (SEPM)

CVE-2015-6547

Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 are affected by CVE-2015-6547, a Command Injection at Boot Time Elevation of Privilege flaw in the management console. An authenticated remote attacker can inject commands via the hostname configuration, executing them w...

CVE-2015-5693

The management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands via vectors related to "traffic capture."...

CVE-2014-9229

Multiple SQL injection vulnerabilities in interface PHP scripts in the Manager component in Symantec Endpoint Protection SEP before 12.1.6 allow remote authenticated users to execute arbitrary SQL commands by leveraging the Limited Administrator role...

CVE-2014-9227

Multiple untrusted search path vulnerabilities in the Manager component in Symantec Endpoint Protection SEP before 12.1.6 allow local users to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2014-9228

Summary (CVE-2014-9228) : In Symantec Endpoint Protection Manager, the sysplant.sys component (Manager) before 12.1.6 can trigger a deadlock when handling specific calls, leading to a DoS by blocking system shutdown. This is described in the NVD entry for CVE-2014-9228 and corroborated by related...

CVE-2015-5693

Symantec Web Gateway (SWG) appliances running before 5.2.2 with database 5.0.0.1277 are affected by CVE-2015-5693 (Traffic Capture EoP). The vulnerability is tied to the hostname/configuration processing path that allows an authenticated, remote attacker to inject commands executed with root priv...