CVE-2011-0549

Concretely, CVE-2011-0549 affects Symantec Web Gateway 4.5.x, where the forget.php management interface passes the username parameter unfiltered, enabling remote SQL injection. The vulnerability allows an unauthenticated attacker to manipulate the backend database; CVSSv2 is 7.5 (HIGH). Vendor ad...

CVE-2011-0549: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in forget.php in the management GUI in Symantec Web Gateway 4.5.x allows remote attackers to execute arbitrary SQL commands via the username parameter...

Symantec Web Gateway Blind SQL Injection

SUMMARY Symantecs Web Gateway management GUI is susceptible to blind SQL injection which could result in the injection of arbitrary code into the backend database. AFFECTED PRODUCTS Product | Version | Solution ---|---|--- Symantec Web Gateway | 4.5.x | Upgrade to Symantec Web Gateway 5.0.1 ISSUE...

PT-2011-2437

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway versions 4.5.x Description The issue allows remote attackers to execute arbitrary SQL commands via the username parameter in the forget.php file of the management GUI. Recommendations For Symantec Web Gateway versions 4.5....

Symantec Web Gateway forget.php SQL Injection Vulnerability

This vulnerability allows remote attackers to inject arbitrary SQL on vulnerable installations of the Symantec Web Gateway appliance. Authentication is not required to exploit this vulnerability. The specific flaw exists within the username parameter of POST requests to the forget.php script. The...

Symantec Web Gateway Management GUI远程SQL注入漏洞

BUGTRAQ ID: 45742 CVE ID: CVE-2010-0115 Symantec Web Gateway是赛门铁克企业级网页威胁防护解决方案。 Symantec Web Gateway在SQL查询中使用用户提供的数据前没有正确过滤，在实现上存在安全漏洞，远程攻击者可利用此漏洞控制设备、访问或修改数据或利用基础数据库中的潜在漏洞。 在向login.php页面发送解析请求时，进程未正确过滤USERNAME POST参数。提供发送特制的字符串，远程攻击者可利用此漏洞向服务器上的后端数据库注入任意SQL。 Symantec Web Gateway 4.5 厂商补丁： Symant...

CVE-2010-0115

SQL injection vulnerability in login.php in the GUI management console in Symantec Web Gateway 4.5 before 4.5.0.376 allows remote attackers to execute arbitrary SQL commands via the USERNAME parameter...

Sql injection

SQL injection vulnerability in login.php in the GUI management console in Symantec Web Gateway 4.5 before 4.5.0.376 allows remote attackers to execute arbitrary SQL commands via the USERNAME parameter...

CVE-2010-0115

SQL injection vulnerability in login.php in the GUI management console in Symantec Web Gateway 4.5 before 4.5.0.376 allows remote attackers to execute arbitrary SQL commands via the USERNAME parameter...

CVE-2010-0115

Symantec Web Gateway 4.5 (before 4.5.0.376) contains a SQL injection in login.php’s USERNAME parameter in the GUI management console. The vulnerability allows remote attackers to inject arbitrary SQL into backend queries, potentially affecting data confidentiality, integrity, and availability. So...

CVE-2010-0115: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in the GUI management console in Symantec Web Gateway 4.5 before 4.5.0.376 allows remote attackers to execute arbitrary SQL commands via the USERNAME parameter...

Symantec Web Gateway Blind SQL Injection

SUMMARY Symantecs Web Gateway management GUI is susceptible to a blind SQL injection attack which could result in injection of arbitrary code into the backend database. AFFECTED PRODUCTS Product | Version | Solution ---|---|--- Symantec Web Gateway | 4.5 | Apply DB update 4.5.0.376 ISSUES Severit...

PT-2011-1358

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway versions prior to 4.5.0.376 Description The issue allows remote attackers to execute arbitrary SQL commands via the USERNAME parameter in the login.php file of the GUI management console. This can lead to remote code...

Symantec Web Gateway Management Interface USERNAME Blind SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Web Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the management interface which listens by default on TCP port 443. While parsing...

Information disclosure

SmartFilter Web Gateway Security 4.2.1.00 stores user credentials in cleartext in adminbackup.xml files and uses insecure permissions for these files, which allows local users to gain privileges. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2009-2429

SmartFilter Web Gateway Security 4.2.1.00 stores user credentials in cleartext in adminbackup.xml files and uses insecure permissions for these files, which allows local users to gain privileges. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2009-2429

McAfee SmartFilter (Web Gateway Security) 4.2.1.00 stores user credentials in cleartext in admin_backup.xml files and uses insecure file permissions, enabling local users to gain privileges via access to those files. Affected component/file: admin_backup.xml (within SmartFilter Administration/ser...

CVE-2009-2429

SmartFilter Web Gateway Security 4.2.1.00 stores user credentials in cleartext in adminbackup.xml files and uses insecure permissions for these files, which allows local users to gain privileges. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2009-2429: Undefined Security Weakness

SmartFilter Web Gateway Security 4.2.1.00 stores user credentials in cleartext in adminbackup.xml files and uses insecure permissions for these files, which allows local users to gain privileges. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

Design/Logic Flaw

SmartFilter Web Gateway Security 4.2.1.00 stores user credentials in cleartext in config.txt and uses insecure permissions for this file, which allows local users to gain privileges...