Symantec Message Filter Management Interface Default Credentials

Brightmail Control Center BCC is the administrative web interface for Symantec Message Filter. It is possible to log into the remote BCC by providing the default credentials. A remote attacker could exploit this to gain administrative control of the application. %NASLMINLEVEL 70300 C Tenable...

Symantec Message Filter Multiple Vulnerabilities (SYM12-010)

The version of Brightmail Control Center the web management interface for Symantec Message Filter hosted on the remote web server has the following vulnerabilities : - Multiple information disclosure vulnerabilities. CVE-2012-0300 - Session fixation. CVE-2012-0301 - Unspecified cross-site...

Symantec Brightmail AntiSpam Nested Zip Handling Denial of Service

A denial of service vulnerability has been reported in Symantec Brightmail AntiSpam. The vulnerability is due to an error in the way the product handles ZIP archives. A remote attacker may exploit this vulnerability by enticing a target user a deeply nested ZIP archive file. Successful exploitati...

CVE-2011-0548

Buffer overflow in the Lotus Freelance Graphics PRZ file viewer in Autonomy KeyView, as used in Symantec Mail Security SMS 6.x through 8.x, Symantec Brightmail and Messaging Gateway before 9.5.1, and Symantec Data Loss Prevention DLP before 10.5.3 and 11.x before 11.1, allows remote attackers to...

Buffer overflow

Buffer overflow in the Lotus Freelance Graphics PRZ file viewer in Autonomy KeyView, as used in Symantec Mail Security SMS 6.x through 8.x, Symantec Brightmail and Messaging Gateway before 9.5.1, and Symantec Data Loss Prevention DLP before 10.5.3 and 11.x before 11.1, allows remote attackers to...

CVE-2011-0548

Buffer overflow in the Lotus Freelance Graphics PRZ file viewer in Autonomy KeyView, as used in Symantec Mail Security SMS 6.x through 8.x, Symantec Brightmail and Messaging Gateway before 9.5.1, and Symantec Data Loss Prevention DLP before 10.5.3 and 11.x before 11.1, allows remote attackers to...

CVE-2011-0548

CVE-2011-0548 concerns a buffer overflow in the Lotus Freelance Graphics PRZ file viewer component of Autonomy KeyView, used in Symantec Mail Security (SMS) 6.x–8.x, Symantec Brightmail and Messaging Gateway pre-9.5.1, and Symantec DLP pre-10.5.3 and 11.x pre-11.1. The vulnerability allows a remo...

Multi-Vendor Autonomy Verity Keyview PRZ Reader Filter Overflow

SUMMARY Symantec products that ship with the Verity KeyView Filter have updated the module to address a security issue being reported in the content filter processing of specifically crafted document formats. AFFECTED PRODUCTS Product | Version | Build | Solutions ---|---|---|--- Symantec Mail...

Symantec generic PDF detection bypass

No description provided by source. Symantec multiple products - Generic PDF bypass Cheap plug : Speaking of PDF - If you are interested in client-side vulnerabilities visit HACK.LU starting tomorrow 28-30 Oct with : Workshop: Bypassing the Perimeter: Client Side Exploitation - Nitesh Dhanjani,...

Buffer overflow

Buffer overflow in xlssr.dll in the Autonomy KeyView XLS viewer aka File Viewer for Excel, as used in IBM Lotus Notes 5.x through 8.5.x, Symantec Mail Security, Symantec BrightMail Appliance, Symantec Data Loss Prevention DLP, and other products, allows remote attackers to execute arbitrary code...

CVE-2009-3037

CVE-2009-3037 is a buffer overflow in the Autonomy KeyView XLS viewer (xlssr.dll) used by IBM Lotus Notes and multiple Symantec products (Mail Security, BrightMail, DLP, etc.). The overflow occurs while parsing Excel .xls attachments, enabling remote code execution by enticing a user to open a ma...

Symantec Brightmail Gateway控制中心跨站脚本和权限提升漏洞

BUGTRAQ ID: 34641,34639 CVECAN ID: CVE-2009-0063,CVE-2009-0064 Brightmail Gateway是赛门铁克的信息安全管理平台。 Brightmail Gateway设备的WEB管理控制台Brightmail安全中心没有正确地过滤外部客户端输入，远程攻击者可以通过提交恶意请求执行跨站脚本攻击；此外某些控制台函数还可能允许非特权的控制中心用户获得提升的权限。 Symantec Brightmail Gateway 8.0 Symantec Brightmail Gateway 5.0 Symantec --------...

CVE-2009-0064

Multiple unspecified vulnerabilities in the Control Center in Symantec Brightmail Gateway Appliance before 8.0.1 allow remote authenticated users to gain privileges, and possibly obtain sensitive information or hijack sessions of arbitrary users, via vectors involving 1 administrative scripts or ...

Design/Logic Flaw

Multiple unspecified vulnerabilities in the Control Center in Symantec Brightmail Gateway Appliance before 8.0.1 allow remote authenticated users to gain privileges, and possibly obtain sensitive information or hijack sessions of arbitrary users, via vectors involving 1 administrative scripts or ...

CVE-2009-0063

Cross-site scripting XSS vulnerability in the Control Center in Symantec Brightmail Gateway Appliance before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Control Center in Symantec Brightmail Gateway Appliance before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-0064

Symantec Brightmail Gateway and related appliances are affected by CVE-2009-0064, which involves cross-site scripting and elevation of privilege in the Control Center. The issue stems from improper filtering of external input in the web management console, allowing remote authenticated users to p...

CVE-2009-0063

Symantec Brightmail Gateway Appliance prior to 8.0.1 has a cross-site scripting (XSS) vulnerability in the Control Center. The issue arises from insufficient input filtering of external client input in the web management console, enabling remote authenticated users to inject arbitrary web script ...

CVE-2009-0063

Cross-site scripting XSS vulnerability in the Control Center in Symantec Brightmail Gateway Appliance before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-0064

Multiple unspecified vulnerabilities in the Control Center in Symantec Brightmail Gateway Appliance before 8.0.1 allow remote authenticated users to gain privileges, and possibly obtain sensitive information or hijack sessions of arbitrary users, via vectors involving 1 administrative scripts or ...