CVE-2013-4671

Symantec Web Gateway (SWG) is affected by CVE-2013-4671, a CSRF vulnerability in the management console present before version 5.1.1. The issue allows an authenticated remote user to hijack the authentication of unspecified victims via unknown vectors, enabling potential unauthorized actions with...

CVE-2013-4673

The CVE-2013-4673 issue affects Symantec Web Gateway (SWG) prior to version 5.1.1 where the management console’s RADIUS authentication is not properly implemented, allowing remote attackers with access to the login prompt to execute arbitrary code. Connected advisories confirm the root cause as a...

CVE-2013-4672

Symantec Web Gateway (SWG)

CVE-2013-1616

CVE-2013-1616 affects the Symantec Web Gateway (SWG) before 5.1.1. Multiple vulnerabilities exist, including an OS command injection that can be executed via authenticated inputs in scripts such as nameConfig.php and networkConfig.php, enabling commands with the Apache user privileges. Additional...

CVE-2013-1617

Symantec Web Gateway (SWG) appliance vulnerable to multiple SQL injection flaws in the management console prior to version 5.1.1. These flaws allow an authenticated administrator to issue arbitrary SQL commands via unspecified vectors. ASEC/SEC Consult advisory confirms affected versions up to 5....

CVE-2013-4673

The management console on the Symantec Web Gateway SWG appliance before 5.1.1 does not properly implement RADIUS authentication, which allows remote attackers to execute arbitrary code by leveraging access to the login prompt...

CVE-2013-4670

Summary (concrete): CVE-2013-4670 refers to multiple XSS vulnerabilities in the Symantec Web Gateway (SWG) management console prior to version 5.1.1. The issue arises in the SWG admin UI, with attackers able to inject arbitrary script/HTML via unspecified vectors. Exploitation details are discuss...

CVE-2013-1617

Multiple SQL injection vulnerabilities in the management console on the Symantec Web Gateway SWG appliance before 5.1.1 allow remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors...

PT-2013-5121

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway versions prior to 5.1.1 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the management console of the Symantec Web Gateway appliance. These vulnerabilities allow remote attackers to inje...

PT-2013-3280

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway SWG versions prior to 5.1.1 Description The issue concerns SQL injection vulnerabilities in the management console of the Symantec Web Gateway appliance. These vulnerabilities allow remote authenticated administrators to...

PT-2013-5123

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway versions prior to 5.1.1 Description The management console on the Symantec Web Gateway appliance has an issue with its sudoers file, allowing local users to bypass intended access restrictions by executing a specific...

PT-2013-5122

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway versions prior to 5.1.1 Description A cross-site request forgery CSRF issue exists in the management console of the Symantec Web Gateway appliance. This allows remote authenticated users to hijack the authentication of oth...

PT-2013-3279

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway versions prior to 5.1.1 Description The management console on the Symantec Web Gateway appliance has an issue that allows remote attackers to execute arbitrary commands by injecting a command into an application script...

CVE-2013-1617: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the management console on the Symantec Web Gateway SWG appliance before 5.1.1 allow remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors...

CVE-2013-4673: Improper Input Validation

The management console on the Symantec Web Gateway SWG appliance before 5.1.1 does not properly implement RADIUS authentication, which allows remote attackers to execute arbitrary code by leveraging access to the login prompt...

CVE-2013-4672: Undefined Security Weakness

The management console on the Symantec Web Gateway SWG appliance before 5.1.1 has an incorrect sudoers file, which allows local users to bypass intended access restrictions via a command...

PT-2013-5124

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway versions prior to 5.1.1 Description The management console on the Symantec Web Gateway appliance does not properly implement RADIUS authentication. This issue allows remote attackers to execute arbitrary code by leveraging...

CVE-2013-4671: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the management console on the Symantec Web Gateway SWG appliance before 5.1.1 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...

CVE-2013-4670: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the management console on the Symantec Web Gateway SWG appliance before 5.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-1616: Improper Neutralization of Special Elements used in an OS Command

The management console on the Symantec Web Gateway SWG appliance before 5.1.1 allows remote attackers to execute arbitrary commands by injecting a command into an application script...