CVE-2017-15532

Prior to 10.6.4, Symantec Messaging Gateway may be susceptible to a path traversal attack also known as directory traversal. These types of attacks aim to access files and directories that are stored outside the web root folder. By manipulating variables, it may be possible to access arbitrary...

CVE-2017-15532

Prior to 10.6.4, Symantec Messaging Gateway may be susceptible to a path traversal attack also known as directory traversal. These types of attacks aim to access files and directories that are stored outside the web root folder. By manipulating variables, it may be possible to access arbitrary...

CVE-2017-15532

CVE-2017-15532 affects Symantec Messaging Gateway prior to version 10.6.4, exposing a directory traversal flaw in the product’s handling of input that allows access to files outside the web root. The root cause is an improper validation/manipulation of variables used in file operations within the...

Symantec Messaging Gateway Directory Traversal

SUMMARY Symantec has released an update to address one issue in the Symantec Messaging Gateway product. AFFECTED PRODUCTS Symantec Messaging Gateway SMG --- CVE | Affected Versions | Remediation CVE-2017-15532 | Prior to 10.6.4 | Upgrade to 10.6.4 ISSUES CVE-2017-15532 --- Severity/CVSSv3: | Medi...

Symantec Messaging Gateway Export Servlet snmpFileName Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Symantec Messaging Gateway. Authentication is required to exploit this vulnerability. The specific flaw exists within the export servlet. When parsing the snmpFileName parameter, the proces...

Artemis: Deserialization of untrusted input vulnerability

It was found that use of a JMS ObjectMessage does not safely handle user supplied data when deserializing objects. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

Artemis: Deserialization of untrusted input vulnerability

It was found that use of a JMS ObjectMessage does not safely handle user supplied data when deserializing objects. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

Google to Block Third-Party Software from Injecting Code into Chrome Browser

To improve performance and reduce crashes caused by third-party software on Windows, Google Chrome, by mid-2018, will no longer allow outside applications to run code within its web browser. If you are unaware, many third-party applications, like accessibility or antivirus software, inject code...

Apple iPhone X Face ID Fooled by a Mask

Apple’s Face ID technology, the centerpiece biometric authentication mechanism for the iPhone X, has been cracked a little more than a week after it was introduced to the public. Researchers from Vietnamese security company Bkav demonstrated that they could fool the technology to unlock the phone...

Trend Micro InterScan Messaging Security modTMCSS Command Injection (CVE-2017-11391; CVE-2017-11394)

A command injection vulnerability exists in Trend Micro InterScan Messaging Security virtual appliance. The vulnerability is due to improper validation of request parameters within the modTMCSS Proxy functionality. A remote, authenticated attacker could exploit the vulnerability by sending a...

Cisco Spark Messaging Software HTML Injection Vulnerability

Cisco Spark Messaging Software is a collaboration service solution from Cisco. The program by providing a virtual space, so that teams in any location can work together, call and video, and can discuss issues, storage team files and documents. A cross-site scripting vulnerability exists in the We...

CVE-2017-12269

A vulnerability in the web UI of Cisco Spark Messaging Software could allow an authenticated, remote attacker to perform a stored cross-site scripting XSS attack. The vulnerability is due to insufficient input validation by the web UI of the affected software. An attacker could exploit this...

Cross site scripting

A vulnerability in the web UI of Cisco Spark Messaging Software could allow an authenticated, remote attacker to perform a stored cross-site scripting XSS attack. The vulnerability is due to insufficient input validation by the web UI of the affected software. An attacker could exploit this...

CVE-2017-12269

CVE-2017-12269 affects the web UI of Cisco Spark Messaging Software. The issue is stored XSS caused by insufficient input validation in the web UI, allowing an authenticated, remote attacker to inject XSS content. A successful exploit could force a user to execute attacker-specified code or leak ...

CVE-2017-12269

A vulnerability in the web UI of Cisco Spark Messaging Software could allow an authenticated, remote attacker to perform a stored cross-site scripting XSS attack. The vulnerability is due to insufficient input validation by the web UI of the affected software. An attacker could exploit this...

Cisco Spark Messaging Stored Cross-Site Scripting Vulnerability

A vulnerability in the web UI of Cisco Spark Messaging Software could allow an authenticated, remote attacker to perform a stored cross-site scripting XSS attack. The vulnerability is due to insufficient input validation by the web UI of the affected software. An attacker could exploit this...

The vulnerability of the Android operating system’s messaging mechanism, which allows a hacker to trigger a service failure

The vulnerability of the Android operating system’s messaging mechanism is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of the messaging system between components of ArchestrA Wonderware ArchestrA Logger is caused by buffer overflows in the stack, allowing an attacker to execute arbitrary code.

The vulnerability of the messaging system between components in ArchestrA Wonderware ArchestrA Logger arises due to buffer overflow on the stack. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of a high-priority account...

Symantec Messaging Gateway < 10.6.3-267 - Cross-Site Request Forgery Vulnerability

Exploit for multiple platform in category web applications Exploit Title: CSRF Date: August 9, 2017 Software Link: https://www.symantec.com/products/messaging-gateway Exploit Author: Dhiraj Mishra Contact: http://twitter.com/mishradhiraj Website: http://datarift.blogspot.in/ CVE: CVE-2017-6328...

Symantec Messaging Gateway performRestore Command Injection (CVE-2017-6327)

A command injection vulnerability exists in Symantec Messaging Gateway. The cause of the vulnerability due to combination of an authentication bypass in LoginAction and a lack of sanitization on user input...