CVE-2021-30650

A reflected cross-site scripting XSS vulnerability in the Symantec Layer7 API Management OAuth Toolkit OTK allows a remote attacker to craft a malicious URL for the OTK web UI and target OTK users with phishing attacks or other social engineering techniques. A successful attack allows injecting...

CVE-2021-30650

The CVE-2021-30650 issue affects Symantec Layer7 API Management OAuth Toolkit (OTK). It is a reflected XSS vulnerability where a remote attacker can craft a malicious URL targeting the OTK web UI, enabling injection of arbitrary code into the OTK web UI client application. Impact is described as ...

Broadcom Symantec Layer7 API Management OAuth Toolkit跨站脚本漏洞

Broadcom Symantec Layer7 API Management OAuth Toolkit is a Layer7 API Management Community Blog from Broadcom, Inc. The Broadcom Symantec Layer7 API Management OAuth Toolkit suffers from a cross-site scripting vulnerability that could be exploited by a remote attacker to create a malicious URL fo...

Ukraine Continues to Face Cyber Espionage Attacks from Russian Hackers

Cybersecurity researchers on Monday said they uncovered evidence of attempted attacks by a Russia-linked hacking operation targeting a Ukrainian entity in July 2021. Broadcom-owned Symantec, in a new report published Monday, attributed the attacks to an actor tracked as Gamaredon aka Shuckworm or...

PT-2022-5708 · Symantec · Symantec Endpoint Protection

Name of the Vulnerable Software and Affected Versions: Symantec Endpoint Protection Windows versions prior to 14.3 RU6/14.3 RU5 Patch 1 Description: The issue is related to a Security Control Bypass, which can potentially allow a threat actor to circumvent existing security controls. This...

Norton 360 Now Comes With a Cryptominer

Norton 360, one of the most popular antivirus products on the market today, has installed a cryptocurrency mining program on its customers computers. Nortons parent firm says the cloud-based service that activates the program and allows customers to profit from the scheme -- in which the company...

Symantec Security Advisory for Log4j Vulnerability

Summary Symantec products may be susceptible to a flaw in the Apache Log4j 2 library JNDI lookup mechanism. A remote attacker, who can trigger Log4j to log crafted malicious strings, can execute arbitrary code on the target system. Affected Products The following products and product versions are...

Symantec Messaging Gateway Remote Code Execution Vulnerability

Symantec Messaging Gateway contains an unspecified vulnerability which can allow for remote code execution. With the ability to perform remote code execution, an attacker may also desire to perform privilege escalating actions...

Symantec Web Gateway Local File Inclusion (CVE-2012-2957)

A local file inclusion vulnerability exists in Symantec Web Gateway. Successful exploitation of this vulnerability could allow a remote attacker to damage user systems...

SideWalk Backdoor Linked to China-Linked Spy Group ‘Grayfly’

The novel backdoor technique called SideWalk, seen in campaigns targeting US media and retailers late last month, has been tied to an adversary that’s been around for quite a while: namely, China-linked Grayfly espionage group. ESET researchers, who named and discovered the new “SparklingGoblin”...

A week in security (August 30 – September 5)

Last week on Malwarebytes Labs ProxyToken: another nail-biter from Microsoft Exchange Macs turn on apps signed by Symantec, treat them as malware Google Play sign-ins can be abused to track another person’s movements FTC bans SpyFone and its CEO from continuing to sell stalkerware BrakTooth...

Macs turn on apps signed by Symantec, treat them as malware

On August 23, following an update to Apples security systems on macOS, some Mac users began to see security alerts about some of their apps, claiming that they "will damage your computer," and offering users the option to "report malware to Apple." This has led to much confusion online, and to an...

ICS Focused Malware

Updated July 20, 2021: The U.S. Government attributes this activity to Russian nation-state cyber actors and assess that Russian nation-state cyber actors deployed Havex malware against industrial control systems. For more information on Russian malicious cyber activity, refer...

Symantec Data Center Security Windows Agent < 6.9.1 DoS (SYMSA18255)

The version of Symantec Data Center Security Windows Agent installed on the remote host is prior to 6.9.1. It is, therefore, affected by a denial of service vulnerability due to an unhandled exception in a common driver. Note that Nessus has not tested for this issue but has instead relied only o...

Symantec Endpoint Protection Client < 14.3 RU1 MP1 DoS (SYMSA18255)

The version of Symantec Endpoint Protection SEP Client installed on the remote host is prior to 14.3 RU1 MP1. It is, therefore, affected by a denial of service vulnerability due to an unhandled exception in a common driver. Note that Nessus has not tested for this issue but has instead relied onl...

Symantec Endpoint Protection Manager < 14.3 RU2 Session Token Exposure (SYMSA18255)

The version of Symantec Endpoint Protection Manager SEPM installed on the remote host is prior to 14.3 RU2. It is therefore affected by a vulnerability. HTTPS GET parameters may include session tokens, which could be logged. Note that Nessus has not tested for this issue but has instead relied on...

CVE-2021-30648

The Symantec Advanced Secure Gateway ASG and ProxySG web management consoles are susceptible to an authentication bypass vulnerability. An unauthenticated attacker can execute arbitrary CLI commands, view/modify the appliance configuration and policy, and shutdown/restart the appliance...

Authentication flaw

The Symantec Advanced Secure Gateway ASG and ProxySG web management consoles are susceptible to an authentication bypass vulnerability. An unauthenticated attacker can execute arbitrary CLI commands, view/modify the appliance configuration and policy, and shutdown/restart the appliance...

CVE-2021-30648

CVE-2021-30648 affects Symantec Advanced Secure Gateway (ASG) and ProxySG web management consoles, enabling an unauthenticated authentication bypass that allows arbitrary CLI commands, viewing/modifying appliance configuration and policy, and shutdown/restart. Affected products: ASG and ProxySG. ...

CVE-2021-30648

The Symantec Advanced Secure Gateway ASG and ProxySG web management consoles are susceptible to an authentication bypass vulnerability. An unauthenticated attacker can execute arbitrary CLI commands, view/modify the appliance configuration and policy, and shutdown/restart the appliance...