CVE-2015-5691

The CVE-2015-5691 issue affects Symantec Web Gateway (SWG) management console on SWG appliances prior to version 5.2.2 with DB 5.0.0.1277, where PHP-based management-console scripts (notably admin_messages.php) are vulnerable to reflected XSS that can cause arbitrary script execution in a user’s ...

CVE-2015-5692

Symantec Web Gateway (SWG) management console prior to SWG 5.2.2 with DB 5.0.0.1277 is affected by CVE-2015-5692. The issue resides in admin_messages.php, where improper sanitization of uploaded files and a weak sudo configuration allow an authenticated attacker to upload a safe file and leverage...

CVE-2015-6547

The management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands at boot time via unspecified vectors...

CVE-2015-6548

CVE-2015-6548 is part of multiple vulnerabilities affecting Symantec Web Gateway (SWG) management console on appliances running software before 5.2.2 with DB 5.0.0.1277. The connected documents confirm a concrete SQL injection issue in the edit_alert.php script that allows an authenticated, remot...

CVE-2015-5690: Improper Neutralization of Special Elements used in an OS Command

The management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to bypass intended access restrictions and execute arbitrary commands by leveraging a "redirect."...

Symantec Web Gateway Code Injection Vulnerability (CNVD-2015-06069)

Symantec Web Gateway is a suite of web content filtering software. The software provides web content filtering and data leakage protection. A code injection certificate vulnerability exists in Symantec Web Gateway, which allows remote attackers to exploit the vulnerability by submitting a special...

Symantec Web Gateway Security Bypass Vulnerability

Symantec Web Gateway is a suite of web content filtering software. The software provides web content filtering and data leakage protection. A security bypass vulnerability exists in Symantec Web Gateway that could be exploited by an attacker to bypass security restrictions and submit a special...

PT-2015-7039

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 Description The issue allows remote authenticated users to execute arbitrary code by uploading a file with a safe extension and content type, and then leveraging an...

Symantec Web Gateway SQL Injection Vulnerability (CNVD-2015-06066)

Symantec Web Gateway is a suite of web content filtering software. The software provides web content filtering and data leakage protection. A SQL injection vulnerability exists in Symantec Web Gateway, which allows remote attackers to exploit the vulnerability by submitting specially crafted SQL...

PT-2015-7297

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway SWG versions prior to 5.2.2 DB 5.0.0.1277 Description The issue concerns multiple SQL injection vulnerabilities in a PHP script within the management console of Symantec Web Gateway appliances. These vulnerabilities allow...

PT-2015-7296

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway versions prior to 5.2.2 DB 5.0.0.1277 Description The issue allows remote authenticated users to execute arbitrary commands at boot time. Recommendations For versions prior to 5.2.2 DB 5.0.0.1277, update to version 5.2.2 D...

Symantec Web Gateway OS Command Injection Vulnerability (CNVD-2015-06070)

Symantec Web Gateway is a suite of web content filtering software. The software provides web content filtering and data leakage protection. An OS command injection vulnerability exists in Symantec Web Gateway, which allows remote attackers to exploit the vulnerability by submitting a specially...

Symantec Web Gateway Arbitrary File Upload Vulnerability

Symantec Web Gateway is a suite of web content filtering software. The software provides web content filtering and data leakage protection. A security vulnerability exists in Symantec Web Gateway that allows an attacker to submit a special file that can be uploaded and executed bypassing...

CVE-2015-5692: Undefined Security Weakness

adminmessages.php in the management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary code by uploading a file with a safe extension and content type, and then leveraging an improper Sudo configuration to...

CVE-2015-6548: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in a PHP script in the management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

PT-2015-7040

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway versions prior to 5.2.2 DB 5.0.0.1277 Description The issue allows remote authenticated users to execute arbitrary commands on the management console of Symantec Web Gateway appliances. This is related to vectors involving...

CVE-2015-5693: Improper Control of Generation of Code

The management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands via vectors related to "traffic capture."...

Symantec Web Gateway Cross-Site Scripting Vulnerability (CNVD-2015-06067)

Symantec Web Gateway is a suite of web content filtering software. The software provides web content filtering and data leakage protection. A cross-site scripting vulnerability exists in Symantec Web Gateway, which allows remote attackers to exploit the vulnerability to inject malicious script or...

CVE-2015-5691: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in PHP scripts in the management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, as demonstrated an attack against...

CVE-2015-6547: Improper Neutralization of Special Elements used in a Command

The management console on Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands at boot time via unspecified vectors...