Code injection

Symantec Endpoint Protection Manager SEPM 12.1 before 12.1-RU6-MP3 allows remote attackers to execute arbitrary Java code by connecting to the console Java port...

CVE-2015-6555

Affected software: Symantec Endpoint Protection Manager (SEPM) 12.1 prior to 12.1-RU6-MP3. Vulnerability: remote attackers can execute arbitrary Java code by connecting to the SEPM console Java port (CVE-2015-6555). Root cause / impact: improper handling of external data on the management console...

CVE-2015-6554

The CVE-2015-6554 issue affects Symantec Endpoint Protection Manager (SEPM) 12.1 prior to 12.1-RU6-MP3, allowing remote execution of arbitrary OS commands via crafted data sent to SEPM. Affected vector is remote, with evidence across multiple sources describing an RCE through untrusted data handl...

CVE-2015-6554

Symantec Endpoint Protection Manager SEPM 12.1 before 12.1-RU6-MP3 allows remote attackers to execute arbitrary OS commands via crafted data...

CVE-2015-8113

Untrusted search path vulnerability in the client in Symantec Endpoint Protection SEP 12.1 before 12.1-RU6-MP3 allows local users to gain privileges via a Trojan horse DLL in a client install package. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1492...

CVE-2015-8113

Summary (CVE-2015-8113): SEP 12.1 before 12.1-RU6-MP3 is vulnerable to local privilege escalation via an untrusted search path (Trojan horse DLL) in a client install package. This stems from an incomplete fix for CVE-2015-1492 and affects SEP clients; the issue can be exploited locally to gain pr...

CVE-2015-6555

Symantec Endpoint Protection Manager SEPM 12.1 before 12.1-RU6-MP3 allows remote attackers to execute arbitrary Java code by connecting to the console Java port...

Symantec Endpoint Protection Elevation of Privilege Issues

SUMMARY The management console for Symantec Endpoint Protection Manager SEPM is susceptible to OS command execution, Java code execution elevation of privilege. SEP clients are susceptible to a binary planting vulnerability that could result in arbitrary code running with system privileges on a...

Symantec Releases Security Update

Symantec has released an update to address vulnerabilities in Symantec Endpoint Protection version 12.1. Exploitation of one of these vulnerabilities may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the Security Advisory from...

Windows Antivirus Exclusions Enumeration

This module will enumerate the file, directory, process and extension-based exclusions from supported AV products, which currently includes Microsoft Defender, Microsoft Security Essentials/Antimalware, and Symantec Endpoint Protection. This module requires Metasploit:...

Symantec pcAnywhere 12.5.0 (Windows x86) - Remote Code Execution

!/usr/bin/python Exploit Title: Symantec pcAnywhere v12.5.0 Windows x86 RCE Date: 2015-10-31 Exploit Author: Tomislav Paskalev Vendor Homepage: https://www.symantec.com/ Software Link: http://esdownload.symantec.com/akdlm/CD/MTV/pcAnywhere125MarketingTrialware.exe Version: Symantec pcAnywhere...

Symantec pcAnywhere 12.5.0 (Windows x86) - Remote Code Execution

Symantec pcAnywhere 12.5.0 Windows x86 - Remote Code Execution...

Threat Outbreak Alert RuleID19076: Email Messages Distributing Malicious Software on October 30, 2015

Medium Alert ID: 41812 First Published: 2015 October 30 14:46 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID19076 may contain the following files: Name |...

Misissued certificates

Security Misissued certificates Share October 29th, 2015 Recently, Google found a google.com pre-certificate in a CT log, without having ordered one. This lead to a series of incidents, also involving Opera and its security team. The backstory Google promptly contacted Symantec who had issued the...

Threat Outbreak Alert RuleID18588: Email Messages Distributing Malicious Software on October 9, 2015

Medium Alert ID: 41460 First Published: 2015 October 9 14:06 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID18588 may contain the following files: Name |...

Symantec Endpoint Protection Multiple Vulnerabilities (Oct 2015)

Symantec Endpoint Protection is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2015-6549

Cross-site scripting XSS vulnerability in an application console in the server in Symantec NetBackup OpsCenter before 7.7.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in an application console in the server in Symantec NetBackup OpsCenter before 7.7.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Symantec Endpoint Protection ConsoleServlet ResetPassword Policy Bypass (CVE-2015-1486)

An authentication bypass vulnerability exists in Symantec Endpoint Protection. This vulnerability is due to a design flaw that lets unauthenticated users to retrieve a valid session token. A remote, unauthenticated attacker may exploit this vulnerability to create an admin account and access the...

Zemra Botnet (C2 Web Panel) - Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Zemra Botnet CnC Web Panel Remote Code Execution', 'Description' = %q This module exploits the CnC web panel of Zemra Botnet which...