CVE-2019-9699

CVE-2019-9699 affects Symantec Messaging Gateway (SMG) 10.x prior to 10.7.0. The issue is an information-disclosure vulnerability that could allow unauthorized data access. Remediation is to upgrade to SMG version 10.7.0 (per vendor advisories). Several connected sources confirm the affected prod...

CVE-2022-25629

CVE-2022-25629 affects Broadcom Symantec Messaging Gateway (SMG) prior to version 10.8. An authenticated user with the ability to add/edit annotations on the Content tab can craft a malicious annotation that is executed on the annotations page (Annotation Text Column). The vulnerability is descri...

CVE-2022-25630

Broadcom Symantec Messaging Gateway is affected by CVE-2022-25630, a stored XSS vulnerability exploitable by an authenticated user on the admin group policy page. Public details describe an authenticated user injecting payloads via the AdminGroupPolicyFlow$save.flo endpoint, with the issue enabli...

CVE-2017-15532

CVE-2017-15532 affects Symantec Messaging Gateway prior to version 10.6.4, exposing a directory traversal flaw in the product’s handling of input that allows access to files outside the web root. The root cause is an improper validation/manipulation of variables used in file operations within the...

CVE-2019-18377

Symantec Messaging Gateway (SMG) versions prior to 10.7.3 are affected by a privilege-escalation vulnerability (CVE-2019-18377). The issue allows an attacker to gain elevated access within the affected SMG deployment. References from multiple sources (including Symantec’s advisory and CNVD/Red Ha...

CVE-2018-12243

Symantec Messaging Gateway (SMG) versions prior to 10.6.6 are vulnerable to an XML external entity (XXE) flaw (CVE-2018-12243). The issue arises from a weakly configured XML parser that can process XML input containing external entity references, enabling access to files via file:// URIs or relat...

CVE-2019-18378

Symantec Messaging Gateway (SMG) versions prior to 10.7.3 are affected by CVE-2019-18378, a cross-site scripting (XSS) vulnerability caused by improper sanitization of user-supplied input. An unauthenticated attacker could entice a user to click a crafted URL to execute arbitrary script in the vi...

CVE-2019-18379

CVE-2019-18379 affects Symantec Messaging Gateway (SMG) versions prior to 10.7.3. The issue is a server-side request forgery (SSRF) that could allow the backend server to send crafted requests or access services via the loopback interface. Impact is described as enabling unauthorized internal req...

CVE-2018-12242

CVE-2018-12242 affects Symantec Messaging Gateway prior to version 10.6.6, enabling an authentication bypass that could let an attacker circumvent security controls and gain access to the system or network. Public sources in the provided documents corroborate an authentication bypass for SMG befo...