CVE-2010-0112

Multiple SQL injection vulnerabilities in the Administrative Interface in the IIS extension in Symantec IM Manager before 8.4.16 allow remote attackers to execute arbitrary SQL commands via 1 the rdReport parameter to rdpageimlogic.aspx, related to the sGetDefinition function in rdServer.dll, and...

Symantec IM Manager Multiple SQL Injection Vulnerabilities

Symantec IM Manager is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit can allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities i...

Symantec IM Manager Multiple SQL Injection Vulnerabilities

Symantec IM Manager is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C b...

Symantec IM Manager Administrative Interface SummaryReportGroup.lgx Definition File SQL Injection Vulnerabilities

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec IM Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the rdpageimlogic.aspx page which is exposed through an IIS extension on the defau...

Symantec IM Manager Administrative Interface LoggedInUsers.lgx Definition File SQL Injection Vulnerabilities

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec IM Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the rdpageimlogic.aspx and rdPage.aspx pages which is exposed through an IIS...

Symantec IM Manager Administrative Interface DetailReportGroup.lgx Definition File SQL Injection Vulnerabilities

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec IM Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the rdPageImlogic.aspx page which is exposed through an IIS extension on the defau...

Symantec IM Manager Administrative Interface rdpageimlogic.aspx SQL Injection Vulnerabilities

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec IM Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the rdpageimlogic.aspx page which is exposed through an IIS extension on the defau...

Symantec IM Manager Administrative Interface IMAdminReportTrendFormRun.asp SQL Injection Vulnerability

This vulnerability allows remote attackers to inject arbitrary SQL into the packaged database on vulnerable installations of Symantec IM Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Administrative interface installed with IM Manager...

Symantec IM Manager Administrative Interface IMAdminScheduleReport.asp SQL Injection Vulnerability

This vulnerability allows remote attackers to inject arbitrary SQL into the packaged database on vulnerable installations of Symantec IM Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Administrative interface installed with IM Manager...

Symantec IM Manager rdServer.dll sGetDefinition SQL Injection Vulnerability

This vulnerability allows remote attackers to inject arbitrary SQL into the backend database on vulnerable installations of Symantec IM Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the IM Manager interface exposed by the web server which...

Mobile Credits Used as Phishing Lure

Customers of an Italian bank were lured into a phishing scam with promises of mobile phone airtime credits, according to a blog post from analyst Mathew Maniyara on Symantec’s Connect blog. According to Maniyara, phishers posing under the guise of an Italian bank, are using a U.S.-based Web site ...

VERITAS NetBackup Java Authentication Service Format String (CVE-2005-2715)

The Symantec VERITAS NetBackup Server product suite is an enterprise backup system solution available for various platforms. It is capable of performing scheduled automatic backups as well as manual backups invoked by a client. A minimal backup environment consists of backup clients and a master...

Spammers Using SHY Character to Hide Malicious URLs

Spammers have jumped on the little-used soft hyphen or SHY character to fool URL filtering devices. According to researchers at Symantec Corp., spammers are larding up URLs for sites they promote with the soft hyphen character, which many browsers ignore. Spammers aren’t shy about jumping humans...

Stuxnet Analysis Supports Iran-Israel Connections

VANCOUVER – A Symantec researcher filled in more critical details about the Stuxnet worm here, demonstrating the worm’s ability to take control of programmable logic controllers PLCs by Siemens Inc. and disable machinery connected to them. Liam O’Murchu of Symantec, speaking at the Virus Bulletin...

All Eyes On Stuxnet At Annual Virus Researcher Summit

The world will know more about the mysterious Stuxnet virus by week’s end, after top virus researchers reveal the findings of their post mortem on Stuxnet at the annual Virus Bulletin Conference. HED: All eyes on Stuxnet at annual virus researcher summit DEK: Researchers will reveal new details...

Update Protection against Symantec Alert Management System HNDLRSVC Arbitrary Command Execution

An arbitrary command execution vulnerability exists in Symantec Alert Management System AMS2 service shipped with multiple Symantec products. The AMS service starts an alert handler service, HNDLRSVC, that listens for commands from the AMS server. The service does not perform proper authenticatio...

Senate Listens to Data Breach Testimony

The Senate Subcommittee on Consumer Protection, Product Safety, and Insurance heard testimony on from several witnesses yesterday regarding the proposed national data breach legislation, including Maneesha Mithal of the Federal Trade Commission FTC and Mark Bregman, CTO of Symantec. Read the full...

Microsoft Missed 2009 Published Article on Stuxnet-Type Attack

A security flaw affecting Microsoft’s Windows operating system that was exploited by the Stuxnet worm was publicly disclosed more than a year before the worm appeared, according to a researcher at Symantec Corp. On September 17, Symantec researcher Liam O Murchu noted on that company’s Connect bl...

Researchers: Google Aurora Attackers Back in Business?

Just when you thought it was safe to go back in your e-mail…Researchers say a new round of targeted attacks appear to come from the same group responsible for attacks against Google and other top U.S. firms. Writing on the Symantec Security blog...

Cyber Crime Survey Finds Lots of Victims, Lots of Guilt

If you’ve fallen victim to a driveby download, phishing attack or virus laden PDF attachment, don’t despair: you’re in good company, according to a study sponsored by anti malware firm Symantec Corp. The anti virus software found that a whopping 73 percent of Internet users in the U.S. they...