69 matches found
CVE-2016-3647
Symantec Endpoint Protection Manager SEPM 12.1 before RU6 MP5 allows remote authenticated users to conduct server-side request forgery SSRF attacks, and trigger network traffic to arbitrary intranet hosts, via a crafted request...
CVE-2016-3648
CVE-2016-3648. Affects Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5. A flaw in the Authentication Lock protection mechanism lets remote authenticated users bypass the lock, enabling brute-force password guessing against management-console accounts by entering data into the auth...
CVE-2016-3650
Symantec Endpoint Protection Manager (SEPM) 12.1.x before RU6 MP5 is vulnerable to a server credentials disclosure (CVE-2016-3650) via brute-force-style weakness when authenticated to the management console. The issue is one of multiple vulnerabilities affecting SEPM 12.1.x; the root cause is exp...
CVE-2016-3651
Symantec Endpoint Protection Manager SEPM 12.1 before RU6 MP5 allows remote authenticated users to discover the PHP JSESSIONID value via unspecified vectors...
CVE-2016-3651
CVE-2016-3651 affects Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5. The issue is that remote authenticated users can discover the PHP JSESSIONID value on the web server via unspecified vectors. The vulnerability is listed among multiple SEPM issues and is associated with sessio...
CVE-2016-3647
CVE-2016-3647 is a vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1.x before RU6 MP5 where an authenticated remote user can trigger a server-side request forgery (SSRF) via a crafted request to the management console’s authentication interface, potentially enabling access to inte...
CVE-2016-5306
CVE-2016-5306 affects Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5. The vulnerability is an information disclosure caused by failure to enable HTTP Strict Transport Security on port 8445, enabling remote observers to sniff HTTP traffic and obtain sensitive data. Affected produc...
CVE-2016-3647
Symantec Endpoint Protection Manager SEPM 12.1 before RU6 MP5 allows remote authenticated users to conduct server-side request forgery SSRF attacks, and trigger network traffic to arbitrary intranet hosts, via a crafted request...
CVE-2016-3649
Symantec Endpoint Protection Manager (SEPM) 12.1.x before RU6 MP5 is vulnerable to CVE-2016-3649, where remote authenticated administrators can enumerate other administrator accounts by sending modified GET requests to the SEPM interface. The issue is categorized under information-disclosure via ...
CVE-2016-5305
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 contains multiple DOM-based cross-site scripting vulnerabilities in SEPM management scripts. The issue is triggered by unsanitized input in the DOM link manipulation pathway, allowing remote authenticated users to inject arbitrary we...
CVE-2016-5307
Summary: CVE-2016-5307 is a directory traversal vulnerability in the Symantec Endpoint Protection Manager (SEPM) management console, affecting SEPM 12.1 installations prior to 12.1 RU6 MP5. The issue permits remote authenticated users to read arbitrary files within the web-root directory tree via...
Symantec Endpoint Protection 12.1 CSRF / XSS / Open Redirect
Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SYMANTEC-SEPM-MULTIPLE-VULNS.txt + ISR: ApparitionSec Vendor: ================ www.symantec.com Product: =========== SEPM Symantec Endpoint Protection Manager and client v12.1...
Symantec Endpoint Protection Manager 12.1 - Multiple Vulnerabilities
Symantec Endpoint Protection Manager 12.1 - Multiple Vulnerabilities + Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SYMANTEC-SEPM-MULTIPLE-VULNS.txt + ISR: ApparitionSec Vendor: ================ www.symantec.com Product:...
Symantec Endpoint Protection Manager 12.1 - Multiple Vulnerabilities
Exploit for php platform in category web applications + Credits: John Page aka HYP3RLINX + ISR: ApparitionSec Vendor: ================ www.symantec.com Product: =========== SEPM Symantec Endpoint Protection Manager and client v12.1 SEPM provides a centrally managed solution. It handles security...
Symantec Endpoint Protection Multiple Security Issues
SUMMARY Symantec Endpoint Protection SEP was susceptible to a number of security vulnerabilities potentially resulting in a user being able to leverage elevated privilege or access to unauthorized files on the management console. Additionally, a race condition in the device control of a SEP clien...
Symantec Endpoint Protection Multiple Vulnerabilities (Mar 2016)
Symantec Endpoint Protection is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2015-8153
Symantec Endpoint Protection Manager (SEPM) 12.1 prior to RU6-MP4 is affected by CVE-2015-8153 (SQL injection). Interfaces with the SEPM backend allow a remote authenticated attacker to execute arbitrary SQL via unspecified vectors, potentially impacting data confidentiality, integrity, and avail...
CVE-2015-8152
CVE-2015-8152 affects Symantec Endpoint Protection Manager (SEPM) 12.1 up to RU6-MP4. The issue is a cross-site request forgery (CSRF) vulnerability in logging scripts that enables a remote authenticated attacker to hijack administrator authentication and execute arbitrary code through crafted lo...