Newly Uncovered 'SowBug' Cyber-Espionage Group Stealing Diplomatic Secrets Since 2015

A previously unknown hacking and cyber-espionage group that has been in operation since at least 2015 have conducted a series of highly targeted attacks against a host of government organizations in South America and Southeast Asia to steal their sensitive data. Codenamed Sowbug, the hacking grou...

Norton Remove and Reinstall Detection (Windows SMB Login)

SMB login-based detection of Norton Remove and Reinstall. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Symantec Endpoint Protection Tamper Protection Bypass Vulnerability

Symantec Endpoint Protection SEP is a suite of antivirus software from Symantec, USA. The software provides security across physical and virtual systems. A security vulnerability exists in versions prior to SEP 14 RU1 and version 12.1.X. The vulnerability can be exploited by an attacker to bypass...

Symantec Endpoint Protection Elevation of Privilege Vulnerability

Symantec Endpoint Protection is an enterprise version of virus protection software. An elevation of privilege vulnerability exists in Symantec Endpoint Protection before SEP 12.1 RU6 MP9. A user can exploit the vulnerability to gain unauthorized access to resources...

Norton Remove & Reinstall DLL Preloading Code Execution Vulnerability

Norton Remove & Reinstall is prone to dll preloading code execution vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Symantec Endpoint Protection Arbitrary File Deletion Vulnerability

Symantec Endpoint Protection SEP is a suite of antivirus software from Symantec, USA. The software provides security across physical and virtual systems. A security vulnerability exists in Windows endpoint in versions prior to SEP 12.1 RU6 MP9 and versions prior to SEP 14 RU1. An attacker could...

CVE-2017-13681

Symantec Endpoint Protection prior to SEP 12.1 RU6 MP9 could be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to gain elevated access to resources that are normally protected at lower access levels. In the circumstances of this issue, the...

Privilege escalation

Symantec Endpoint Protection prior to SEP 12.1 RU6 MP9 could be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to gain elevated access to resources that are normally protected at lower access levels. In the circumstances of this issue, the...

Design/Logic Flaw

Prior to SEP 14 RU1 Symantec Endpoint Protection product can encounter an issue of Tamper-Protection Bypass, which is a type of attack that bypasses the real time protection for the application that is run on servers and clients...

CVE-2017-6331

Prior to SEP 14 RU1 Symantec Endpoint Protection product can encounter an issue of Tamper-Protection Bypass, which is a type of attack that bypasses the real time protection for the application that is run on servers and clients...

Design/Logic Flaw

Prior to SEP 12.1 RU6 MP9 & SEP 14 RU1 Symantec Endpoint Protection Windows endpoint can encounter a situation whereby an attacker could use the product's UI to perform unauthorized file deletes on the resident file system...

CVE-2017-13680

Prior to SEP 12.1 RU6 MP9 & SEP 14 RU1 Symantec Endpoint Protection Windows endpoint can encounter a situation whereby an attacker could use the product's UI to perform unauthorized file deletes on the resident file system...

CVE-2017-13681

Symantec Endpoint Protection prior to SEP 12.1 RU6 MP9 could be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to gain elevated access to resources that are normally protected at lower access levels. In the circumstances of this issue, the...

CVE-2017-6331

Prior to SEP 14 RU1 Symantec Endpoint Protection product can encounter an issue of Tamper-Protection Bypass, which is a type of attack that bypasses the real time protection for the application that is run on servers and clients...

CVE-2017-6331

Prior to SEP 14 RU1 Symantec Endpoint Protection product can encounter an issue of Tamper-Protection Bypass, which is a type of attack that bypasses the real time protection for the application that is run on servers and clients...

CVE-2017-13680

Prior to SEP 12.1 RU6 MP9 & SEP 14 RU1 Symantec Endpoint Protection Windows endpoint can encounter a situation whereby an attacker could use the product's UI to perform unauthorized file deletes on the resident file system...

CVE-2017-13681

Symantec Endpoint Protection (SEP) is affected by CVE-2017-13681, a privilege-escalation flaw in SEP prior to 12.1 RU6 MP9. The issue requires multiple file and directory writes to the local filesystem, limiting exploit feasibility to non-drive-by scenarios. Impact is described as elevated access...

CVE-2017-13680

Summary: CVE-2017-13680 affects Symantec Endpoint Protection (SEP) Windows endpoints. The vulnerability allows an attacker to perform unauthorized file deletions via the product UI. Affected versions are SEP 12.1 RU6 MP9 and SEP 14 RU1. Root cause/impact: UI-driven file deletion on the resident f...

CVE-2017-13681

Symantec Endpoint Protection prior to SEP 12.1 RU6 MP9 could be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to gain elevated access to resources that are normally protected at lower access levels. In the circumstances of this issue, the...

CVE-2017-6331

Symantec Endpoint Protection (SEP) up to 12.1.6 RU6 MP5 / 12.1.x before RU6 MP9 or 14.0 before RU1 is affected by CVE-2017-6331. The issue is a Tamper-Protection Bypass caused by SEP not validating WinAPI message sources (UIPI), allowing spoofed UI messages to potentially disable or bypass real‑t...