CVE-2019-12753

An information disclosure vulnerability in Symantec Reporter web UI 10.3 prior to 10.3.2.5 allows a malicious authenticated administrator user to obtain passwords for external SMTP, FTP, FTPS, LDAP, and Cloud Log Download servers that they might not otherwise be authorized to access. The maliciou...

CVE-2019-12753

Symantec (Blue Coat) Reporter UI information disclosure CVE-2019-12753 affects Reporter UI 10.3 prior to 10.3.2.5. An authenticated administrator can retrieve passwords for external SMTP/FTP/FTPS/LDAP and Cloud Log Download servers, as well as passwords of other Reporter UI users. Root cause is i...

CVE-2019-12754

Symantec My VIP portal, previous version which has already been auto updated, was susceptible to a cross-site scripting XSS exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users or potentially bypass access controls such as...

CVE-2019-12754

Technical details about CVE-2019-12754 are not publicly available in the provided connected documents. Monitor for updates.

Symantec ProxySG 6.5 / 6.6 / 6.7 < 6.7.4.1 OpenSSL Denial of Service Vulnerability (SA1462)

The self-reported SGOS version installed on the remote Symantec ProxySG device is 6.5.x, 6.6.x or 6.7 prior to 6.7.4.1. It is, therefore, affected by OpenSSL denial of service vulnerability. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid128303; scriptversion"1.3";...

Information Disclosure Vulnerability in MC

SUMMARY The Symantec Management Center REST API is susceptible to an information disclosure vulnerability. A malicious authenticated user can obtain passwords for external backup and CPL policy import servers that they might not otherwise be authorized to access. AFFECTED PRODUCTS Management Cent...

Information Disclosure Vulnerability in Reporter

SUMMARY The Symantec Reporter web UI is susceptible to an information disclosure vulnerability. A malicious authenticated Reporter administrator user can obtain passwords for external servers that they might not otherwise be authorized to access. The malicious user can also obtain the passwords o...

XSS and Information Disclosure Vulnerabilities in ASG and ProxySG

SUMMARY The Symantec ASG and ProxySG FTP proxy WebFTP mode is susceptible to XSS and information disclosure vulnerabilities. A remote attacker can inject malicious JavaScript code in the web listing of a remote FTP server and obtain authentication credentials for a remote FTP server. AFFECTED...

August 13, 2019—KB4512486 (Security-only update)

None None...

August 13, 2019—KB4512506 (Monthly Rollup)

None None...

Microsoft Live Accounts ADV190014 Privilege Escalation Vulnerability

Description Microsoft Live Accounts are prone to a privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges. Technologies Affected Microsoft Exchange Online Microsoft Office 365 Microsoft Outlook Web Access Recommendations Block external access at the...

CVE-2019-12750

Symantec Endpoint Protection, prior to 14.2 RU1 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition, prior to 12.1 RU6 MP10c 12.1.7491.7002, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the...

CVE-2019-12750

Symantec Endpoint Protection, prior to 14.2 RU1 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition, prior to 12.1 RU6 MP10c 12.1.7491.7002, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the...

Privilege escalation

Symantec Endpoint Protection, prior to 14.2 RU1 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition, prior to 12.1 RU6 MP10c 12.1.7491.7002, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the...

CVE-2019-12750

Symantec Endpoint Protection, prior to 14.2 RU1 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition, prior to 12.1 RU6 MP10c 12.1.7491.7002, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the...

CVE-2019-12750

CVE-2019-12750 affects Symantec Endpoint Protection (SEP) and SEP Small Business Edition (SBE). Vulnerable components: SEP before 14.2 RU1 and 12.1 RU6 MP10, and SEP SBE before 12.1 RU6 MP10c (12.1.7491.7002). Root cause is a privilege-escalation vulnerability that could allow an attacker to obta...

Symantec Endpoint Protection Privilege Escalation

SUMMARY Symantec has released updates to address issues that were discovered in the Symantec Endpoint Protection SEP and Symantec Endpoint Protection Small Business Edition SEP SBE products. AFFECTED PRODUCTS Symantec Endpoint Protection SEP --- CVE | Affected Versions | Remediation CVE-2019-1275...

Symantec DLP Cross-Site Scripting (CVE-2019-9701)

A cross-site scripting vulnerability exists in Symantec DLP 15.5 MP1. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the effected system...

XStream API CVE-2019-10173 Deserialization Remote Code Execution Vulnerability

Description XStream API is prone to a remote code-execution vulnerability. Successfully exploiting this issue may allow an attacker to execute arbitrary commands in the context of the affected application. Xstream API versions 1.4.10 is vulnerable. Technologies Affected IBM QRadar 7.3.0 IBM QRada...

Symantec Messaging Gateway 10.x < 10.7.1 Privilege Escalation Vulnerability (SYMSA1486)

According to its self-reported version number, the Symantec Messaging Gateway SMG running on the remote host is 10.x prior to 10.7.1. It is, therefore, affected by a privilege escalation vulnerability as described in the vendor advisory. An authenticated attacker can exploit this to gain privileg...