Nginx Vulnerabilities Jul 2017 - Oct 2019

Summary Symantec SWG products using affected versions of Nginx may be susceptible to multiple Nginx vulnerabilities. A remote attacker can use crafted requests to obtain sensitive information or cause denial of service. An attacker can also obtain sensitive information or cause denial of service ...

Akamai Enhances Enterprise Threat Protector to Add Secure Web Gateway Capabilities

Today, Akamai announced that it has added secure web gateway SWG capabilities to its Enterprise Threat Protector ETP service to help enterprises further accelerate their transformation to a Zero Trust security architecture. So what are the SWG enhancements and what benefits will these deliver for...

Security Bulletin: A vulnerability in IBM Java Runtime affect Financial Transaction Manager for Corporate Services (CVE-2019-4732)

Summary There is vulnerability in IBM® Runtime Environment Java™ Version 8 used by Financial Transaction Manager for Corporate Services. Financial Transaction Manager for Corporate Services FTM CPS has addressed the applicable CVE.brIf you run your own Java code using the IBM Java Runtime deliver...

Inspecting TLS Web Traffic - Part 1

In this series of blogs I'm going to talk about how the continued move towards all web traffic being encrypted has impacted enterprise security. In this blog I'm going to focus on the basics - what is encrypted web traffic and how can you proactively control this. TLS encryption is the de-facto...

Step 7. Discover shadow IT and take control of your cloud apps: top 10 actions to secure your environment

The “Top 10 actions to secure your environment” series outlines fundamental steps you can take with your investment in Microsoft 365 security solutions. In “Step 7. Discover shadow IT and take control of cloud apps,” you’ll learn how to set up Microsoft Cloud App Security MCAS to identify, access...

CVE-2017-18001

Trustwave Secure Web Gateway (SWG)

Trustwave SWG Unauthorized Access Vulnerability

Exploit for multiple platform in category web applications Vulnerability Summary The following advisory describes an unauthorized access vulnerability that allows an unauthenticated user to add their own SSH key to a remote Trustwave SWG version 11.8.0.27. Trustwave Secure Web Gateway SWG “provid...

Trustwave SWG Unauthorized Access

Vulnerability Summary The following advisory describes an unauthorized access vulnerability that allows an unauthenticated user to add their own SSH key to a remote Trustwave SWG version 11.8.0.27. Trustwave Secure Web Gateway SWG “provides distributed enterprises effective real-time protection...

Trustwave SWG 11.8.0.27 - SSH Unauthorized Access

Vulnerability Summary The following advisory describes an unauthorized access vulnerability that allows an unauthenticated user to add their own SSH key to a remote Trustwave SWG version 11.8.0.27. Trustwave Secure Web Gateway SWG “provides distributed enterprises effective real-time protection...

Trustwave SWG 11.8.0.27 - SSH Unauthorized Access

Trustwave SWG 11.8.0.27 - SSH Unauthorized Access Vulnerability Summary The following advisory describes an unauthorized access vulnerability that allows an unauthenticated user to add their own SSH key to a remote Trustwave SWG version 11.8.0.27. Trustwave Secure Web Gateway SWG “provides...

CVE-2016-5313

Symantec Web Gateway (SWG) is affected by CVE-2016-5313: before version 5.2.5, the management console contains a flaw in the web interface (notably the /spywall/new_whitelist.php script) that allows remote authenticated users to execute arbitrary OS commands due to improper whitelist validation. ...

swg-gun.de XSS vulnerability

Open Bug Bounty ID: OBB-220199 Description| Value ---|--- Affected Website:| swg-gun.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2015-6547

Symantec Web Gateway SWG appliances with software before 5.2.2 DB 5.0.0.1277 are affected by CVE-2015-6547, a Command Injection at Boot Time Elevation of Privilege flaw in the management console. An authenticated remote attacker can inject commands via the hostname configuration, executing them w...

CVE-2015-5693

Symantec Web Gateway (SWG) appliances running before 5.2.2 with database 5.0.0.1277 are affected by CVE-2015-5693 (Traffic Capture EoP). The vulnerability is tied to the hostname/configuration processing path that allows an authenticated, remote attacker to inject commands executed with root priv...

CVE-2015-5690

Symantec Web Gateway (SWG) management console prior to SWG 5.2.2 / DB 5.0.0.1277 is affected by CVE-2015-5690: a redirect bypass allows an authenticated remote user to bypass access controls and execute arbitrary commands. ZDI confirms a path-processing flaw enabling potential root-level command ...

Symantec Web Gateway OS Authenticated Command Injection

SUMMARY Symantec's Web Gateway SWG Appliance management console is susceptible to operating system command injection by an authenticated but less-privileged user. AFFECTED PRODUCTS Product | Version | Solution ---|---|--- Symantec Web Gateway Appliance | 5.2.1 and prior | Symantec Web Gateway 5.2...

CVE-2014-1652

Symantec Web Gateway (SWG) management console prior to 5.2 is affected by CVE-2014-1652: multiple cross-site scripting vulnerabilities allow remote authenticated users to inject script via unspecified report parameters (e.g., entSummary.php, custom_report.php, host_spy_report.php, repairedclients...

CVE-2014-1650

CVE-2014-1650 : Symantec Web Gateway (SWG) management console contains a SQL injection in the file user.php prior to version 5.2.1. The vulnerability allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. The issue is addressed in SWG 5.2.1, which should be d...

CVE-2013-1616

CVE-2013-1616 affects the Symantec Web Gateway (SWG) before 5.1.1. Multiple vulnerabilities exist, including an OS command injection that can be executed via authenticated inputs in scripts such as nameConfig.php and networkConfig.php, enabling commands with the Apache user privileges. Additional...

CVE-2013-4673

The CVE-2013-4673 issue affects Symantec Web Gateway (SWG) prior to version 5.1.1 where the management console’s RADIUS authentication is not properly implemented, allowing remote attackers with access to the login prompt to execute arbitrary code. Connected advisories confirm the root cause as a...