CVE-2017-15532

Prior to 10.6.4, Symantec Messaging Gateway may be susceptible to a path traversal attack also known as directory traversal. These types of attacks aim to access files and directories that are stored outside the web root folder. By manipulating variables, it may be possible to access arbitrary...

Symantec Messaging Gateway Directory Traversal

SUMMARY Symantec has released an update to address one issue in the Symantec Messaging Gateway product. AFFECTED PRODUCTS Symantec Messaging Gateway SMG --- CVE | Affected Versions | Remediation CVE-2017-15532 | Prior to 10.6.4 | Upgrade to 10.6.4 ISSUES CVE-2017-15532 --- Severity/CVSSv3: | Medi...

Symantec Messaging Gateway Export Servlet snmpFileName Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Symantec Messaging Gateway. Authentication is required to exploit this vulnerability. The specific flaw exists within the export servlet. When parsing the snmpFileName parameter, the proces...

Symantec Norton Family Android App Information Disclosure Vulnerability

Symantec Norton Family Android App is an Android-based parental control Internet application from Symantec USA. An information disclosure vulnerability exists in Symantec Norton Family Android App versions prior to 4.4.1.10. An attacker could exploit the vulnerability to obtain information...

Symantec Encryption Desktop And Endpoint Encryption Local Privilege Escalation

Vulnerabilities in Symantec Encryption Desktop and Endpoint Encryption allow an attacker to attain arbitrary hard disk read and write access at sector level, and subsequently infect the target and gain low level persistence MBR/VBR. They also allow the attacker to execute code in the context of t...

Symantec Management Console File Name Handling Path Traversal Remote Access (SYM17-013)

The version of Symantec Manager Console running on the remote host is earlier than ITM 8.1 RU4 and is therefore affected by a directory traversal vulnerability in the Management Console that allows unauthorized access to the file system. C Tenable Network Security, Inc. include"compat.inc"; if...

SA157: OpenSSL Vulnerabilities 28-Aug-2017 and 2-Nov-2017

SUMMARY Symantec Network Protection products using affected versions of OpenSSL are susceptible to several vulnerabilities. A remote attacker can send a crafted X.509 certificate to cause unspecified impact. They can exploit, under certain circumstances, a computational flaw in the Montgomery...

Fake Symantec Blog Caught Spreading Proton macOS Malware

By Waqas In February this year, HackRead published a detailed report on Proton malware This is a post from HackRead.com Read the original post: Fake Symantec Blog Caught Spreading Proton macOS Malware...

Symantec Management Console Directory Traversal Vulnerability

Symantec Management Console is a set of management console programs from Symantec Corporation USA. The program is used to manage the web-based user interface for Symantec Management Platform and other Symantec solutions. A directory traversal vulnerability exists in Symantec Management Console IT...

Symantec Releases Security Update

Symantec has released an update to address a vulnerability in the Symantec Management Console. A remote attacker could exploit this vulnerability to take control of an affected system. US-CERT encourages users and administrators to review the Symantec Security Advisory and apply the necessary...

Install Norton Security for Mac does not verify SSL certificates

Overview Install Norton Security for Mac, prior to version 7.6, does not validate SSL certificates. Description CWE-295: Improper Certificate Validation - CVE-2017-15528The Install Norton Security for Mac installer, versions prior to 7.6, fails to properly validate SSL certificates provided by...

Directory traversal

Prior to ITMS 8.1 RU4, the Symantec Management Console can be susceptible to a directory traversal exploit, which is a type of attack that can occur when there is insufficient security validation / sanitization of user-supplied input file names, such that characters representing "traverse to pare...

CVE-2017-15527

Prior to ITMS 8.1 RU4, the Symantec Management Console can be susceptible to a directory traversal exploit, which is a type of attack that can occur when there is insufficient security validation / sanitization of user-supplied input file names, such that characters representing "traverse to pare...

CVE-2017-15527

Prior to ITMS 8.1 RU4, the Symantec Management Console can be susceptible to a directory traversal exploit, which is a type of attack that can occur when there is insufficient security validation / sanitization of user-supplied input file names, such that characters representing "traverse to pare...

CVE-2017-15527

The CVE-2017-15527 entry concerns the Symantec Management Console. Affected product: Symantec Management Console (ITMS) prior to 8.1 RU4. Vulnerable component/behavior: directory traversal due to insufficient input validation/sanitization of user-supplied file names, allowing traversal sequences ...

CVE-2017-15527

Prior to ITMS 8.1 RU4, the Symantec Management Console can be susceptible to a directory traversal exploit, which is a type of attack that can occur when there is insufficient security validation / sanitization of user-supplied input file names, such that characters representing "traverse to pare...

OSX.Proton spreading through fake Symantec blog

Sunday night, a series of tweets from security researcher @noarfromspace revealed a new variant of the OSX.Proton malware, spreading in a concerning new method—spoofing security company Symantec's blog. Method of infection The malware is being promoted via a fake Symantec blog site at...

Symantec Management Console Directory Traversal

SUMMARY Symantec has released an update to address an issue in the Symantec Management Console product. AFFECTED PRODUCTS Symantec Management Console --- CVE | Affected Versions | Remediation CVE-2017-15527 | Prior to ITMS 8.1 RU4, ITMS 8.0 POST HF6 & ITMS 7.6 POST HF7 | Upgrade to ITMS 8.1 RU4,...

Symantec Endpoint Encryption < 11.1.3 MP1 (SYM17-012)

The version of the Symantec Endpoint Encryption SEE Drive Encryption Client installed on the remote Windows host is prior to 11.1.3 MP1. It is, therefore, affected by a denial of service and NULL pointer vulnerability. C Tenable Network Security, Inc. include"compat.inc"; if description...

Symantec Endpoint Encryption Denial of Service Vulnerability (CNVD-2017-36540)

Symantec Endpoint Encryption SEE is a suite of software from Symantec Corporation that provides advanced encryption and management capabilities for desktops, laptops, and removable storage devices. A security vulnerability exists in Symantec Endpoint Encryption in versions prior to SEE 11.1.3MP1...