CVE-2018-12465

An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway SMG allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server. This can be exploited in conjunction with CVE-2018-12464 to achieve...

CVE-2018-12465

CVE-2018-12465 describes an OS command injection in the web administration component of Micro Focus Secure Messaging Gateway (SMG). A remote attacker authenticated as a privileged user can run arbitrary OS commands on the SMG server. The CVE notes this can be leveraged with CVE-2018-12464 (SQL in...

CVE-2016-3644

The AntiVirus Decomposer engine in Symantec Advanced Threat Protection ATP; Symantec Data Center Security:Server SDCS:S 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection SEP before 12.1 RU6 MP5; Symantec Endpoint Protection SEP for Mac; Symantec Endpoint Protection SEP for...

CVE-2016-2209

Buffer overflow in Dec2SS.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection ATP; Symantec Data Center Security:Server SDCS:S 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection SEP before 12.1 RU6 MP5; Symantec Endpoint Protection SEP for Mac;...

Buffer overflow

Buffer overflow in Dec2SS.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection ATP; Symantec Data Center Security:Server SDCS:S 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection SEP before 12.1 RU6 MP5; Symantec Endpoint Protection SEP for Mac;...

Memory corruption

The AntiVirus Decomposer engine in Symantec Advanced Threat Protection ATP; Symantec Data Center Security:Server SDCS:S 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection SEP before 12.1 RU6 MP5; Symantec Endpoint Protection SEP for Mac; Symantec Endpoint Protection SEP for...

CVE-2016-2211

MODE C: The connected Nessus/OpenVAS entries describe CVE-2016-2211 as part of a set of vulnerabilities in Symantec products (notably the Decomposer/UNPACK engine and related parsers) affecting multiple versions of Symantec Protection for SharePoint Servers, Protection Engine, Web Gateway, and re...

CVE-2016-2204

The management console on Symantec Messaging Gateway SMG Appliance devices before 10.6.1 allows local users to obtain root-shell access via crafted terminal-window input...

CVE-2016-2203

The management console on Symantec Messaging Gateway SMG Appliance devices before 10.6.1 allows local users to discover an encrypted AD password by leveraging certain read privileges...

CVE-2016-2203

CVE-2016-2203 affects Symantec Messaging Gateway (SMG) Appliance prior to 10.6.1. The management console stores or exposes an encrypted AD password in a way that allows a local attacker with read privileges to recover the LDAP credentials. Impact: local disclosure of AD password with high confide...

CVE-2016-2204

Consolidated details for CVE-2016-2204 (and related CVE-2016-2203) in Symantec Messaging Gateway (SMG) Appliance: The SMG 10.x management console before 10.6.1 is affected by local privilege escalation. Specifically, CVE-2016-2204 allows a local attacker to gain a root shell in the console by man...

CVE-2012-4347

Symantec Messaging Gateway (SMG) 9.5.x exposes multiple directory traversal vulnerabilities in its management console. The issues allow remote authenticated users to read arbitrary files by manipulating the logFile parameter (logs action to brightmail/export) or the localBackupFileSelection param...

CVE-2012-4883

Multiple untrusted search path vulnerabilities in 3DVIA Composer V6R2012 HF1 Build 6.8.1.1652 allow local users to gain privileges via a Trojan horse 1 dwmapi.dll or 2 ibfs32.dll file in the current working directory, as demonstrated by a directory that contains a .smg file. NOTE: the provenance ...

CVE-2012-3581

Symantec Messaging Gateway (SMG) before 10.0 suffers an Information Disclosure vulnerability (CVE-2012-3581) that allows remote attackers to obtain potentially sensitive information about component versions via unspecified vectors. Exploitation status is not detailed in the provided documents. Re...

CVE-2012-0307

CVE-2012-0307 affects Symantec Messaging Gateway (SMG) prior to version 10.0. The vulnerability class is multiple cross-site scripting (XSS) issues, allowing remote attackers to inject arbitrary web script or HTML via (1) web content or (2) e-mail content. The public references describe XSS in th...

CVE-2012-0308

Summary (CVE-2012-0308): Symantec Messaging Gateway (SMG) prior to version 10.0 is vulnerable to a Cross-Site Request Forgery (CSRF) that can hijack the authentication of administrators. The issue stems from insufficient input validation, enabling a remote attacker to entice a logged-in admin to ...

CVE-2012-3580

Symantec Messaging Gateway (SMG) prior to version 10.0 is affected by CVE-2012-3580, where remote authenticated users who have access to the management interface can modify the web application. The root cause is described as a web application modification issue that can be exploited by an authent...

CVE-2012-3579

Symantec Messaging Gateway (SMG) versions before 10.0 are vulnerable to CVE-2012-3579 due to a hardcoded default SSH password on the support account, enabling remote login and privileged access via SSH. The issue is documented across multiple sources (SAINT advisories and OpenVAS/Nessus reference...