DSquare Exploit Pack: D2SEC_SYMWEBGW

Name| d2secsymwebgw ---|--- CVE| CVE-2012-0297 Exploit Pack| D2ExploitPack Description| Symantec Web Gateway 5.0.2 Local File Include Vulnerability Notes|...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to 1 read or 2 delete arbitrary files via unspecified vectors...

Code injection

The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to upload arbitrary code to a designated pathname, and possibly execute this code, via unspecified vectors...

Code injection

The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by 1 injecting crafted data or 2 including crafted data...

CVE-2012-0297

The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by 1 injecting crafted data or 2 including crafted data...

CVE-2012-0299

CVE-2012-0299 affects Symantec Web Gateway 5.0.x (pre-5.0.3) where file-management scripts in the management GUI allow remote upload of arbitrary code to a designated pathname, potentially enabling remote code execution. This is evidenced by multiple sources in the connected data, including NVD d...

CVE-2012-0298

CVE-2012-0298 affects Symantec Web Gateway before 5.0.3. The management GUI file-management scripts allow remote attackers to read or delete arbitrary files via directory traversal vectors (noted for the relfile parameter). Affected product/version: Symantec Web Gateway 5.0.x up to 5.0.2.x. Impac...

CVE-2012-0297

Symantec Web Gateway 5.0.x (pre-5.0.3) exposes a remote command injection/remote code execution vulnerability in the HTTP service (spywall/ipchange.php and related endpoints). The core issue is improper input handling and insecure usage of server-side scripts that allows an attacker to inject or ...

CVE-2012-0296

Affected product/versions: Symantec Web Gateway 5.0.x (before 5.0.3). Vulnerability type: multiple cross-site scripting (XSS) in the management GUI. Root cause/factors: unsanitized/insufficient input validation in the web interface (e.g., timer.php l parameter). Impact: remote attacker could inje...

CVE-2012-0299

The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to upload arbitrary code to a designated pathname, and possibly execute this code, via unspecified vectors...

CVE-2012-0298

The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to 1 read or 2 delete arbitrary files via unspecified vectors...

CVE-2012-0296

Multiple cross-site scripting XSS vulnerabilities in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Symantec Web Gateway ipchange.php Shell Command Injection (SYM12-006) (intrusive check)

The remote web server is hosting a version of Symantec Web Gateway that is affected by a shell command injection vulnerability. The ipchange.php script calls the exec function with user-controlled input that is not properly sanitized. A remote, unauthenticated attacker could exploit this to execu...

Symantec Web Gateway upload_file() Remote Code Execution (SYM12-006) (intrusive check)

The remote web server is hosting a version of Symantec Web Gateway with a code execution vulnerability. The uploadfile function of utilfunctions.php allows PHP files to be uploaded to a directory where the web server can execute them. This function is used by multiple PHP scripts that can be...

Symantec Web Gateway upload_file Remote Code Execution Vulnerability

The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to upload arbitrary code to a designated pathname, and possibly execute this code, via unspecified vectors. Recent assessments: wchen-r7 at September 12, 2019 6:07pm UTC reported:...

CVE-2012-0297 Symantec Web Gateway Vulnerability

The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by 1 injecting crafted data or 2 including crafted data. Recent assessments: wchen-r7 at September 12, 2019 6:07pm UTC...

Symantec Web Gateway < 5.0.3 Multiple Vulnerabilities (SYM12-006) (version check)

According to its self-reported version number, the remote web server is hosting Symantec Web Gateway before version 5.0.3, which has the following vulnerabilities : -There are multiple cross-site scripting vulnerabilities. CVE-2012-0296 - Multiple shell command injection and local file inclusion...

Symantec Web Gateway 'relfile' Parameter Directory Traversal Vulnerability

Symantec Web Gateway is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Symantec Web Gateway Multiple Security Issues

SUMMARY Symantecs Web Gateway management GUI is susceptible to file include command injection/execution, file upload/execution and file download/deletion security issues. The management GUI is also susceptible to cross-site scripting XSS. Successful exploitation could result in execution of...