Code injection

The ajaxswing webui in the management server in Symantec Critical System Protection SCSP 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced SDCS:SA 6.0.x through 6.0 MP1 allows remote authenticated users to obtain sensitive server information via unspecified vectors...

Sql injection

SQL injection vulnerability in the management server in Symantec Critical System Protection SCSP 5.2.9 before MP6 and Symantec Data Center Security: Server Advanced SDCS:SA 6.0.x before 6.0 MP1 allows remote authenticated users to execute arbitrary SQL commands via a crafted HTTP request...

CVE-2014-9225

The CVE-2014-9225 issue affects the ajaxswing webui in the Symantec Critical System Protection (SCSP) management server and the Symantec Data Center Security: Server Advanced (SDCS:SA) server. Affected versions are SCSP 5.2.9 through MP6 and SDCS:SA 6.0.x through 6.0 MP1. The vulnerability enable...

CVE-2014-7289

CVE-2014-7289 is a SQL injection vulnerability in the management server of Symantec Data Center Security: Server Advanced (SDCS:SA) and Symantec Critical System Protection (SCSP). Affected versions include SCSP 5.2.9 before MP6 and SDCS:SA 6.0.x before 6.0 MP1, with exploitation via the /sis-ui/a...

CVE-2014-9224

CVE-2014-9224 is a cross-site scripting vulnerability in the ajaxswing webui of the Symantec Critical System Protection (SCSP) Management Console and Symantec Data Center Security: Server Advanced (SDCS:SA). It allows remote authenticated users to inject arbitrary web script or HTML, via unspecif...

CVE-2014-9224

Cross-site scripting XSS vulnerability in the ajaxswing webui in the Management Console server in the management server in Symantec Critical System Protection SCSP 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced SDCS:SA 6.0.x through 6.0 MP1 allows remote authenticated users ...

CVE-2014-3440

The Agent Control Interface in the management server in Symantec Critical System Protection SCSP 5.2.9 before MP6 and Symantec Data Center Security: Server Advanced SDCS:SA 6.0.x before 6.0 MP1 allows remote authenticated users to execute arbitrary commands by leveraging client-system access to...

CVE-2014-7289

SQL injection vulnerability in the management server in Symantec Critical System Protection SCSP 5.2.9 before MP6 and Symantec Data Center Security: Server Advanced SDCS:SA 6.0.x before 6.0 MP1 allows remote authenticated users to execute arbitrary SQL commands via a crafted HTTP request...

CVE-2014-9226

The management server in Symantec Critical System Protection SCSP 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced SDCS:SA 6.0.x through 6.0 MP1 allows local users to bypass intended Protection Policies via unspecified vectors...

CVE-2014-9226

CVE-2014-9226 affects Symantec Data Center Security: Server Advanced (SDCS:SA) version 6.0 MP1 and Symantec Critical System Protection (SCSP) 5.2.9 MP6. The SEC Consult advisory documents multiple default Protection Policy bypasses in the SDCS:SA Client and related components that allow an unauth...

CVE-2014-3440

CVE-2014-3440 affects Symantec Critical System Protection (SCSP) 5.2.9.x before MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x before 6.0 MP1. The issue is an remote code execution vulnerability due to improper sanitization of user-uploaded log files in the Management Serv...

CVE-2014-9225

The ajaxswing webui in the management server in Symantec Critical System Protection SCSP 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced SDCS:SA 6.0.x through 6.0 MP1 allows remote authenticated users to obtain sensitive server information via unspecified vectors...

Multiple Symantec Product SQL Injection Vulnerabilities

Symantec Critical System Protection is a suite of intrusion detection software that defends against zero-day threats, strengthens systems, and assists in maintaining compliance.Symantec Data Center Security: Server Advanced is a system protection software from Symantec. A SQL injection...

Multiple Symantec Product Information Disclosure Vulnerabilities

Symantec Critical System Protection is a suite of intrusion detection software that defends against zero-day threats, strengthens systems, and assists in maintaining compliance.Symantec Data Center Security: Server Advanced is a system protection software from Symantec. An information disclosure...

Multiple Symantec Product Local Security Bypass Vulnerabilities

Symantec Critical System Protection is a suite of intrusion detection software that defends against zero-day threats, strengthens systems, and assists in maintaining compliance.Symantec Data Center Security: Server Advanced is a system protection software from Symantec. Multiple Symantec products...

Multiple Symantec Products Cross-Site Scripting Vulnerabilities

Symantec Critical System Protection is a suite of intrusion detection software that defends against zero-day threats, strengthens systems, and assists in maintaining compliance.Symantec Data Center Security: Server Advanced is a system protection software from Symantec. A cross-site scripting...

Multiple Symantec Product Remote Code Execution Vulnerabilities

Symantec Critical System Protection is a suite of intrusion detection software that defends against zero-day threats, strengthens systems, and assists in maintaining compliance.Symantec Data Center Security: Server Advanced is a system protection software from Symantec. A remote code execution...

Patch Management: Get Packages from Symantec Altiris

Binary data symantecaltirisgetpackages.nbin...

Symantec Data Center Security: Server Advanced, Multiple Security Issues on Management Server and Pr

SUMMARY The management server for Symantec Critical System Protection SCSP 5.2.9 and Data Center Security: Server Advanced SDCS:SA 6.0.x is susceptible to security issues which could enable privileged access to the management server. Rules in the prevention policies could be bypassed if deployed ...

MS15-004 Microsoft Remote Desktop Services Web Proxy IE Sandbox Escape

This module abuses a process creation policy in Internet Explorer's sandbox; specifically, Microsoft's RemoteApp and Desktop Connections runtime proxy, TSWbPrxy.exe. This vulnerability allows the attacker to escape the Protected Mode and execute code with Medium Integrity. At the moment, this...