CVE-2014-3433

CVE-2014-3433 affects the Symantec Data Insight management console (3.x and 4.x up to 4.5). The vulnerability is a cross-site scripting (XSS) flaw caused by insufficient sanitization of user-supplied input in the management GUI, allowing an attacker to inject arbitrary script or HTML via an unspe...

CVE-2014-3432

Cross-site scripting XSS vulnerability in the management console in Symantec Data Insight 3.x and 4.x before 4.5 allows remote attackers to inject arbitrary web script or HTML via an unspecified form field...

CVE-2014-3432

Symantec Data Insight

CVE-2014-3433

Cross-site scripting XSS vulnerability in the management console in Symantec Data Insight 3.x and 4.x before 4.5 allows remote attackers to inject arbitrary web script or HTML via an unspecified form field, related to an "HTML script injection" issue...

Symantec Data Insight Management Console HTML Injection and Cross-Site Scripting

SUMMARY The management console for Symantec Data Insight does not sufficiently validate/sanitize arbitrary input in two separate fields within the management GUI. This could potentially allow unauthorized command execution or potential malicious redirection. AFFECTED PRODUCTS Product | Version |...

CVE-2014-3431

Symantec PGP Desktop 10.x, and Encryption Desktop Professional 10.3.x before 10.3.2 MP2, on OS X uses world-writable permissions for temporary files, which allows local users to bypass intended restrictions on file reading, modification, creation, and permission changes via unspecified vectors...

Design/Logic Flaw

Symantec PGP Desktop 10.x, and Encryption Desktop Professional 10.3.x before 10.3.2 MP2, on OS X uses world-writable permissions for temporary files, which allows local users to bypass intended restrictions on file reading, modification, creation, and permission changes via unspecified vectors...

CVE-2014-3431

CVE-2014-3431 affects Symantec PGP Desktop for OS X and Symantec Encryption Desktop/Professional (OS X). The issue arises from world-writable temporary files created during installation, enabling a multi-user attacker to read, modify, or create files with another user’s permissions when the affec...

CVE-2014-3431

Symantec PGP Desktop 10.x, and Encryption Desktop Professional 10.3.x before 10.3.2 MP2, on OS X uses world-writable permissions for temporary files, which allows local users to bypass intended restrictions on file reading, modification, creation, and permission changes via unspecified vectors...

Symantec Encryption Desktop for OS X World-Writable Files Insecure File Handling

SUMMARY Symantecs Encryption Desktop for OS X installs some temporary files with world-writable attributes during installation. In a multi-user environment, a malicious user could manipulate these world-writable files to read and write files or create files with another users permissions. AFFECTE...

Symantec Web Gateway < 5.2.1 Multiple Vulnerabilities (SYM14-010)

According to its self-reported version number, the remote web server is hosting a version of Symantec Web Gateway prior to version 5.2.1. It is, therefore, affected by the following vulnerabilities : - A remote command execution flaw exists with the 'SNMPConfig.php' where user input is not proper...

CVE-2013-5017

SNMPConfig.php in the management console in Symantec Web Gateway SWG before 5.2.1 allows remote attackers to execute arbitrary commands via unspecified vectors...

CVE-2014-1650

SQL injection vulnerability in user.php in the management console in Symantec Web Gateway SWG before 5.2.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-1651

SQL injection vulnerability in clientreport.php in the management console in Symantec Web Gateway SWG before 5.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-1652

Multiple cross-site scripting XSS vulnerabilities in the management console in Symantec Web Gateway SWG before 5.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified report parameters...

Sql injection

SQL injection vulnerability in clientreport.php in the management console in Symantec Web Gateway SWG before 5.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in user.php in the management console in Symantec Web Gateway SWG before 5.2.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

Command injection

SNMPConfig.php in the management console in Symantec Web Gateway SWG before 5.2.1 allows remote attackers to execute arbitrary commands via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the management console in Symantec Web Gateway SWG before 5.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified report parameters...

CVE-2014-1650

CVE-2014-1650 : Symantec Web Gateway (SWG) management console contains a SQL injection in the file user.php prior to version 5.2.1. The vulnerability allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. The issue is addressed in SWG 5.2.1, which should be d...