CVE-2013-4673

The management console on the Symantec Web Gateway SWG appliance before 5.1.1 does not properly implement RADIUS authentication, which allows remote attackers to execute arbitrary code by leveraging access to the login prompt...

Sql injection

Multiple SQL injection vulnerabilities in the management console on the Symantec Web Gateway SWG appliance before 5.1.1 allow remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the management console on the Symantec Web Gateway SWG appliance before 5.1.1 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...

Command injection

The management console on the Symantec Web Gateway SWG appliance before 5.1.1 has an incorrect sudoers file, which allows local users to bypass intended access restrictions via a command...

Authentication flaw

The management console on the Symantec Web Gateway SWG appliance before 5.1.1 does not properly implement RADIUS authentication, which allows remote attackers to execute arbitrary code by leveraging access to the login prompt...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the management console on the Symantec Web Gateway SWG appliance before 5.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Command injection

The management console on the Symantec Web Gateway SWG appliance before 5.1.1 allows remote attackers to execute arbitrary commands by injecting a command into an application script...

Symantec Encryption Desktop Unquoted Search Path

SUMMARY Symantec PGP and Symantec Encryption Desktop client has an unquoted search path in RDDService. This could provide a non-privileged local user the ability to successfully insert arbitrary code in the root path. AFFECTED PRODUCTS Product | Version | Build | Solutions ---|---|---|--- Symante...

Symantec Workspace Virtualization Local Kernel Elevation of Privilege

SUMMARY Symantec's Workspace Virtualization, when activated/enabled on a client, is susceptible to a local access kernel elevation of privilege. The application fails to do sufficient bounds checking when passing user input to the underlying operating system. This issue could potentially allow an...

Symantec Web Gateway < 5.1.1 Multiple Vulnerabilities (SYM13-008)

According to its self-reported version number, the remote web server is hosting Symantec Web Gateway before version 5.1.1, which has the following vulnerabilities : - Multiple cross-site scripting vulnerabilities exist. CVE-2013-4670 - It is possible to inject arbitrary operating system commands...

CVE-2013-4671

Cross-site request forgery CSRF vulnerability in the management console on the Symantec Web Gateway SWG appliance before 5.1.1 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...

CVE-2013-1616

The management console on the Symantec Web Gateway SWG appliance before 5.1.1 allows remote attackers to execute arbitrary commands by injecting a command into an application script...

CVE-2013-1616

CVE-2013-1616 affects the Symantec Web Gateway (SWG) before 5.1.1. Multiple vulnerabilities exist, including an OS command injection that can be executed via authenticated inputs in scripts such as nameConfig.php and networkConfig.php, enabling commands with the Apache user privileges. Additional...

CVE-2013-4673

The CVE-2013-4673 issue affects Symantec Web Gateway (SWG) prior to version 5.1.1 where the management console’s RADIUS authentication is not properly implemented, allowing remote attackers with access to the login prompt to execute arbitrary code. Connected advisories confirm the root cause as a...

CVE-2013-1617

Symantec Web Gateway (SWG) appliance vulnerable to multiple SQL injection flaws in the management console prior to version 5.1.1. These flaws allow an authenticated administrator to issue arbitrary SQL commands via unspecified vectors. ASEC/SEC Consult advisory confirms affected versions up to 5....

CVE-2013-4672

Symantec Web Gateway (SWG)

CVE-2013-1617

Multiple SQL injection vulnerabilities in the management console on the Symantec Web Gateway SWG appliance before 5.1.1 allow remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors...

CVE-2013-4673

The management console on the Symantec Web Gateway SWG appliance before 5.1.1 does not properly implement RADIUS authentication, which allows remote attackers to execute arbitrary code by leveraging access to the login prompt...

CVE-2013-4670

Summary (concrete): CVE-2013-4670 refers to multiple XSS vulnerabilities in the Symantec Web Gateway (SWG) management console prior to version 5.1.1. The issue arises in the SWG admin UI, with attackers able to inject arbitrary script/HTML via unspecified vectors. Exploitation details are discuss...

CVE-2013-4671

Symantec Web Gateway (SWG) is affected by CVE-2013-4671, a CSRF vulnerability in the management console present before version 5.1.1. The issue allows an authenticated remote user to hijack the authentication of unspecified victims via unknown vectors, enabling potential unauthorized actions with...