CVE-2007-2619

Symantec pcAnywhere 11.5.x and 12.0.x retains unencrypted login credentials for the most recent login within process memory, which allows local administrators to obtain the credentials by reading process memory, a different vulnerability than CVE-2006-3785...

CVE-2007-2619

CVE-2007-2619 affects Symantec pcAnywhere 11.5.x and 12.0.x, where unencrypted login credentials can reside in process memory. The description indicates local administrators can read memory to retrieve credentials, making this a local access issue. No explicit exploit details or mitigation are pr...

CVE-2006-3456

The Symantec NAVOPTS.DLL ActiveX control aka Symantec.Norton.AntiVirus.NAVOptions 12.2.0.13, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, is designed for use only in application-embedded web browsers, which allows remote attackers to "crash the control" via...

CVE-2006-3456

The Symantec NAVOPTS.DLL ActiveX control aka Symantec.Norton.AntiVirus.NAVOptions 12.2.0.13, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, is designed for use only in application-embedded web browsers, which allows remote attackers to "crash the control" via...

CVE-2006-3456

CVE-2006-3456 concerns the Symantec NAVOPTS.DLL ActiveX control (NAVOptions) in Norton AntiVirus/Internet Security/System Works 2005–2006 (NAVOptions 12.2.0.13). The control, intended for application-embedded web browsers, can be loaded in a standard browser window, causing initialization errors ...

CVE-2007-2619: Undefined Security Weakness

Symantec pcAnywhere 11.5.x and 12.0.x retains unencrypted login credentials for the most recent login within process memory, which allows local administrators to obtain the credentials by reading process memory, a different vulnerability than CVE-2006-3785...

CVE-2006-3456: Improper Control of Generation of Code

The Symantec NAVOPTS.DLL ActiveX control aka Symantec.Norton.AntiVirus.NAVOptions 12.2.0.13, as used in Norton AntiVirus, Internet Security, and System Works 2005 and 2006, is designed for use only in application-embedded web browsers, which allows remote attackers to "crash the control" via...

Norton Antivirus NAVOpts.dll ActiveX控件绕过安全限制漏洞

Symantec Norton AntiVirus是一款功能强大的反病毒程序。 Norton AntiVirus所带的ActiveX控件实现上存在漏洞，远程攻击者可能利用此漏洞绕过浏览器的安全限制。 Norton会安装以下ActiveX控件： Progid：Symantec.Norton.AntiVirus.NAVOptions Clsid：085ABFE2-D753-445C-8A2A-D4BD46CE0811 文件：C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVOpts.dll 版本：12.2.0.13...

Symantec pcAnywhere Remote User Credential Disclosure

SUMMARY Symantec pcAnywhere fails to properly protect remote user credentials stored in memory. Risk Impact Low Remote Access | No ---|--- Local Access | Yes Authentication Required | Yes Exploit publicly available | No AFFECTED PRODUCTS Products | Versions ---|--- Symantec pcAnywhere | 11.5.x No...

Symantec Norton Antivirus NAVOPTS.DLL ActiveX Control Remote Code Execution Vulnerability

Description Symantec Norton Antivirus ActiveX control is prone to a remote code-execution vulnerability. An attacker may exploit this issue by enticing victims into opening a maliciously crafted HTML document. Successful exploits will allow attackers to execute arbitrary code in the context of th...

Symantec Products SupportSoft ActiveX Control Multiple Buffer Overflows (CVE-2006-6490)

Multiple vulnerabilities have been reported in Symantec SupportSoft ActiveX controls. SupportSoft provides third party ActiveX controls used for remote assistance and other technical support functions. A remote attacker could cause the browser to crash allowing execution of arbitrary commands.The...

Code injection

The agent remote upgrade interface in Symantec Enterprise Security Manager ESM before 20070405 does not verify the authenticity of upgrades, which allows remote attackers to execute arbitrary code via software that implements the agent upgrade protocol...

CVE-2007-2375

The agent remote upgrade interface in Symantec Enterprise Security Manager ESM before 20070405 does not verify the authenticity of upgrades, which allows remote attackers to execute arbitrary code via software that implements the agent upgrade protocol...

CVE-2007-2375

The CVE-2007-2375 issue affects Symantec Enterprise Security Manager (ESM) prior to 20070405, where the agent remote upgrade interface does not verify the authenticity of upgrades. This allows remote attackers to execute arbitrary code through software implementing the agent upgrade protocol. The...

CVE-2007-2375

The agent remote upgrade interface in Symantec Enterprise Security Manager ESM before 20070405 does not verify the authenticity of upgrades, which allows remote attackers to execute arbitrary code via software that implements the agent upgrade protocol...

Design/Logic Flaw

Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of restore points images are configured, uses weak permissions world readable for a configuration file with network share credentials, which allows local users to...

Default credentials

Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of restore point images are configured, encrypt network share credentials with a key formed by a hash of the username, which allows local users to obtain the...

Buffer overflow

Buffer overflow in Ghost Service Manager, as used in Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, allows local users to gain privileges via a long string...

CVE-2007-2361

Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, when remote backups of restore points images are configured, uses weak permissions world readable for a configuration file with network share credentials, which allows local users to...

CVE-2007-2359

Buffer overflow in Ghost Service Manager, as used in Symantec Norton Ghost, Norton Save & Recovery, LiveState Recovery, and BackupExec System Recovery before 20070426, allows local users to gain privileges via a long string...