CVE-2016-9097

The Symantec Advanced Secure Gateway ASG 6.6 prior to 6.6.5.8, ProxySG 6.5 prior 6.5.10.6, ProxySG 6.6 prior to 6.6.5.8, and ProxySG 6.7 prior to 6.7.1.2 management consoles do not, under certain circumstances, correctly authorize administrator users. A malicious administrator with read-only acce...

Cross site request forgery (csrf)

The Symantec Content Analysis CA 1.3, 2.x prior to 2.2.1.1, and Mail Threat Defense MTD 1.1 management consoles are susceptible to a cross-site request forging CSRF vulnerability. A remote attacker can use phishing or other social engineering techniques to access the management console with the...

Design/Logic Flaw

The Symantec Advanced Secure Gateway ASG 6.6 prior to 6.6.5.8, ProxySG 6.5 prior 6.5.10.6, ProxySG 6.6 prior to 6.6.5.8, and ProxySG 6.7 prior to 6.7.1.2 management consoles do not, under certain circumstances, correctly authorize administrator users. A malicious administrator with read-only acce...

Information disclosure

Symantec Advanced Secure Gateway ASG 6.6 prior to 6.6.5.13, ASG 6.7 prior to 6.7.3.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6 prior to 6.6.5.13, and ProxySG 6.7 prior to 6.7.3.1 are susceptible to an information disclosure vulnerability. An attacker with local access to the client host of an...

Open redirect

Symantec Advanced Secure Gateway ASG 6.6, ASG 6.7 prior to 6.7.2.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6, and ProxySG 6.7 prior to 6.7.2.1 are susceptible to an open redirection vulnerability. A remote attacker can use a crafted management console URL in a phishing attack to redirect the...

CVE-2016-9100

Symantec Advanced Secure Gateway ASG 6.6 prior to 6.6.5.13, ASG 6.7 prior to 6.7.3.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6 prior to 6.6.5.13, and ProxySG 6.7 prior to 6.7.3.1 are susceptible to an information disclosure vulnerability. An attacker with local access to the client host of an...

CVE-2016-9092

The CVE concerns CSRF in Symantec Content Analysis (CA) management consoles (1.3, 2.x prior to 2.2.1.1) and Mail Threat Defense (MTD) 1.1. The issue allows a remote attacker, via phishing/social engineering, to perform actions as an authenticated administrator. Exploitation details are not presen...

CVE-2016-9100

The CVE-2016-9100 entry affects Symantec ASG/ProxySG: ASG 6.6 before 6.6.5.13, ASG 6.7 before 6.7.3.1, ProxySG 6.5 before 6.5.10.6, ProxySG 6.6 before 6.6.5.13, and ProxySG 6.7 before 6.7.3.1 are vulnerable to information disclosure. An attacker with local access to the client host of an authenti...

CVE-2016-9097

The Symantec Advanced Secure Gateway ASG 6.6 prior to 6.6.5.8, ProxySG 6.5 prior 6.5.10.6, ProxySG 6.6 prior to 6.6.5.8, and ProxySG 6.7 prior to 6.7.1.2 management consoles do not, under certain circumstances, correctly authorize administrator users. A malicious administrator with read-only acce...

CVE-2016-9099

Symantec Advanced Secure Gateway ASG 6.6, ASG 6.7 prior to 6.7.2.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6, and ProxySG 6.7 prior to 6.7.2.1 are susceptible to an open redirection vulnerability. A remote attacker can use a crafted management console URL in a phishing attack to redirect the...

CVE-2016-9097

The CVE-2016-9097 issue affects Symantec ProxySG and Advanced Secure Gateway (ASG) management consoles. Root cause: improper user authorization allowing a read-only administrator to access read-write functionality. Affected versions and fixes are documented: ASG 6.6 prior to 6.6.5.8 requires upgr...

CVE-2016-9099

CVE-2016-9099 is an open redirect vulnerability affecting Symantec ASG/ProxySG: ASG 6.6, ASG 6.7 before 6.7.2.1, ProxySG 6.5 before 6.5.10.6, ProxySG 6.6, and ProxySG 6.7 before 6.7.2.1. An attacker can use a crafted management console URL in a phishing scenario to redirect users to a malicious s...

CVE-2016-9092

The Symantec Content Analysis CA 1.3, 2.x prior to 2.2.1.1, and Mail Threat Defense MTD 1.1 management consoles are susceptible to a cross-site request forging CSRF vulnerability. A remote attacker can use phishing or other social engineering techniques to access the management console with the...

Unspecified Vulnerability in Symantec Veritas NetBackup and NetBackup Appliance (CNVD-2017-07089)

Symantec Veritas NetBackup NBU and NetBackup NBU Appliance are both products of Symantec USA. The former is a set of enterprise-class backup management software that can run on multiple operating systems, and the latter is an enterprise-class backup management appliance. A security vulnerability...

Veritas/Symantec Backup Exec SSL NDMP Connection Use-After-Free

This module exploits a use-after-free vulnerability in the handling of SSL NDMP connections in Veritas/Symantec Backup Exec's Remote Agent for Windows. When SSL is re-established on a NDMP connection that previously has had SSL established, the BIO struct for the connection's previous SSL session...

SA148: Linux Kernel Vulnerabilities Feb-Apr 2017

SUMMARY Symantec Network Protection products that include a vulnerable version of the Linux kernel are susceptible to multiple vulnerabilities. A remote attacker, with access to the management interface, can exploit these vulnerabilities to execute arbitrary code. The attacker can also cause deni...

Symantec Messaging Gateway Remote Code Execution

This module exploits the command injection vulnerability of Symantec Messaging Gateway product. An authenticated user can execute a terminal command under the context of the web server user which is root. backupNow.do endpoint takes several user inputs and then pass them to the internal service...

Symantec Messaging Gateway < 10.6.2 RAR File Parser DoS Vulnerabilities

Symantec Messaging Gateway is prone to denial of service DoS vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Symantec Endpoint Protection Small Business Edition RAR File Parser DoS Vulnerabilities

Symantec Endpoint Protection Small Business Edition is prone to denial of service vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

knowledge.symantec.com XSS vulnerability

Vulnerable URL: https://knowledge.symantec.com/support/ssl-certificates-support/index.html?ichbox="' /Style=position:fixed;top:0;left:0;font-size:999px; /Onmouseenter=confirmOPENBUGBOUNTY // Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:|...