CVE-2012-3582

Symantec PGP Universal Server 3.2.x before 3.2.1 MP2 does not properly manage sessions that include key search requests, which might allow remote attackers to read a private key in opportunistic circumstances by making a request near the end of a user's session...

CVE-2012-3582

CVE-2012-3582 affects Symantec PGP Universal Server 3.2.x prior to 3.2.1 MP2. The issue arises from improper clearing/management of authenticated sessions when a key search is performed, potentially exposing a client’s private key near the end of a session. Confirmed impact is exposure of private...

Symantec Messaging Gateway < 10.0 Multiple Vulnerabilities

Symantec Messaging Gateway is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SEC Consult SA-20120829-0 :: Symantec Messaging Gateway - Support Backdoor

SEC Consult Vulnerability Lab Security Advisory 20120829-0 ======================================================================= title: Support Backdoor product: Symantec Messaging Gateway vulnerable version: 9.5.x fixed version: 10.0 CVE number: CVE-2012-3579 impact: Critical homepage:...

Use of Java Zero-Day Flaws Tied to Nitro Attack Crew

Researchers say that one of the attack groups using the two new Java zero-day vulnerabilities is the same group that was behind an earlier targeted attack campaign from 2011. That group was traced back to China and was essentially running a spear-phishing campaign, but now the crew, known as Nitr...

PGP Universal Server Unauthorized Key Exposure

SUMMARY Symantecs PGP Universal Server, under specific circumstances, may inadvertently expose a PGP clients private key. AFFECTED PRODUCTS Product | Version | Solution ---|---|--- PGP Universal Server | 3.2.x | PGP Universal Server 3.2.1 MP2 ISSUES CVSS2 Base Score | Impact | Exploitability |...

Symantec Messaging Gateway 9.5/9.5.1 - SSH Default Password Security Bypass (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' require 'net/ssh' class Metasploit3...

CVE-2012-3581

Symantec Messaging Gateway SMG before 10.0 allows remote attackers to obtain potentially sensitive information about component versions via unspecified vectors...

CVE-2012-3579

Symantec Messaging Gateway SMG before 10.0 has a default password for an unspecified account, which makes it easier for remote attackers to obtain privileged access via an SSH session...

CVE-2012-3580

Symantec Messaging Gateway SMG before 10.0 allows remote authenticated users to modify the web application by leveraging access to the management interface...

CVE-2012-0308

Cross-site request forgery CSRF vulnerability in Symantec Messaging Gateway SMG before 10.0 allows remote attackers to hijack the authentication of administrators...

CVE-2012-0307

Multiple cross-site scripting XSS vulnerabilities in Symantec Messaging Gateway SMG before 10.0 allow remote attackers to inject arbitrary web script or HTML via 1 web content or 2 e-mail content...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Symantec Messaging Gateway SMG before 10.0 allows remote attackers to hijack the authentication of administrators...

Memory corruption

Symantec Messaging Gateway SMG before 10.0 allows remote authenticated users to modify the web application by leveraging access to the management interface...

Default credentials

Symantec Messaging Gateway SMG before 10.0 has a default password for an unspecified account, which makes it easier for remote attackers to obtain privileged access via an SSH session...

Information disclosure

Symantec Messaging Gateway SMG before 10.0 allows remote attackers to obtain potentially sensitive information about component versions via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Symantec Messaging Gateway SMG before 10.0 allow remote attackers to inject arbitrary web script or HTML via 1 web content or 2 e-mail content...

CVE-2012-3579

Symantec Messaging Gateway SMG before 10.0 has a default password for an unspecified account, which makes it easier for remote attackers to obtain privileged access via an SSH session...

CVE-2012-3581

Symantec Messaging Gateway (SMG) before 10.0 suffers an Information Disclosure vulnerability (CVE-2012-3581) that allows remote attackers to obtain potentially sensitive information about component versions via unspecified vectors. Exploitation status is not detailed in the provided documents. Re...

CVE-2012-0307

Multiple cross-site scripting XSS vulnerabilities in Symantec Messaging Gateway SMG before 10.0 allow remote attackers to inject arbitrary web script or HTML via 1 web content or 2 e-mail content...