Design/Logic Flaw

Unquoted Windows search path vulnerability in RDDService in Symantec PGP Desktop 10.0.x through 10.2.x and Symantec Encryption Desktop 10.3.0 before MP3 allows local users to gain privileges via a Trojan horse application in the %SYSTEMDRIVE% top-level directory...

Information disclosure

The NDMP protocol implementation in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allows remote authenticated users to obtain sensitive host-version information via unspecified vectors...

KLA10351 Multiple vulnerabilities in Symantec Backup Exec

Multiple serious vulnerabilities have been found in Symantec Backup Exec. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, read-write backup files, inject scripts and execute arbitrary code Below is a complete list of vulnerabilities 1...

CVE-2013-1610

Unquoted Windows search path vulnerability in RDDService in Symantec PGP Desktop 10.0.x through 10.2.x and Symantec Encryption Desktop 10.3.0 before MP3 allows local users to gain privileges via a Trojan horse application in the %SYSTEMDRIVE% top-level directory...

CVE-2013-4678

CVE-2013-4678 concerns the NDMP protocol implementation in Symantec Backup Exec 2010 R3 (before SP3) and 2012 (before SP2). The issue allows remote authenticated users to obtain sensitive host-version information via unspecified vectors, indicating an information-disclosure risk tied to the NDMP ...

CVE-2013-4679

Symantec Workspace Virtualization before 6.x before 6.4.1953.0, when a virtual application layer is configured, allows local users to gain privileges via an application that performs crafted interaction with the operating system...

CVE-2013-4676

Symantec Backup Exec Server is affected by CVE-2013-4676: multiple cross-site scripting (XSS) vulnerabilities in the management console and the beutility console. The issues allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) the custom-reports generation page,...

CVE-2013-4676

Multiple cross-site scripting XSS vulnerabilities in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a 1 custom-reports generation page, 2 Storage Devices creation page, or 3 jobs creation page...

CVE-2013-4677

CVE-2013-4677 concerns Symantec Backup Exec data files stored with weak ACLs, enabling local users to read or alter backup data by direct file access. The affected products, per sources, are: Symantec Backup Exec 2010 R3 (before SP3) and Symantec Backup Exec 2012 (before SP2). The underlying issu...

CVE-2013-1610

CVE-2013-1610 : Unquoted Windows search path in Symantec PGP Desktop/RDDService and Symantec Encryption Desktop 10.x could allow local privilege escalation via a Trojan placed in the SYSTEMDRIVE root. Affected: PGP Desktop 10.0.x–10.2.x and Encryption Desktop 10.3.0 before MP3. Root cause: unquot...

CVE-2013-4679

The CVE-2013-4679 entry concerns Symantec Workspace Virtualization, affected when a virtual application layer is enabled. A local privilege escalation exists due to insufficient input sanitization in the interaction with the operating system, allowing a local user to obtain SYSTEM-level privilege...

CVE-2013-4678

The NDMP protocol implementation in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allows remote authenticated users to obtain sensitive host-version information via unspecified vectors...

CVE-2013-4575

Heap-based buffer overflow in the utility program in the Linux agent in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allows remote attackers to cause a denial of service agent crash or possibly execute arbitrary code via unspecified vectors...

CVE-2013-4677

Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 uses weak permissions Everyone: Read and Everyone: Change for backup data files, which allows local users to obtain sensitive information or modify the outcome of a restore via direct access to these files...

CVE-2013-4575

The CVE-2013-4575 issue is a heap-based buffer overflow in the Linux agent utility of Symantec Backup Exec (affecting Backup Exec 2010 R3 before SP3 and 2012 before SP2; also reflected for RALUS installations per Nessus). This allows remote, unauthenticated attackers to cause a denial of service ...

CVE-2013-4672

The management console on the Symantec Web Gateway SWG appliance before 5.1.1 has an incorrect sudoers file, which allows local users to bypass intended access restrictions via a command...

CVE-2013-4670

Multiple cross-site scripting XSS vulnerabilities in the management console on the Symantec Web Gateway SWG appliance before 5.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-4671

Cross-site request forgery CSRF vulnerability in the management console on the Symantec Web Gateway SWG appliance before 5.1.1 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...

CVE-2013-1616

The management console on the Symantec Web Gateway SWG appliance before 5.1.1 allows remote attackers to execute arbitrary commands by injecting a command into an application script...

CVE-2013-1617

Multiple SQL injection vulnerabilities in the management console on the Symantec Web Gateway SWG appliance before 5.1.1 allow remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors...