Symantec
Page 2 of 6 — Symantec CVEs from a corpus of 520, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-5237 | High | 8.8 | 2018-06-20 | Symantec Endpoint Protection prior to 14 RU1 MP1 or 12.1 RU6 MP10 could be susceptible to a privilege escalation vulnerability, which is a type of issue that a… |
CVE-2018-5236 | Medium | 5.3 | 2018-06-20 | Symantec Endpoint Protection prior to 14 RU1 MP1 or 12.1 RU6 MP10 may be susceptible to a race condition (or race hazard). This type of issue occurs in softwar… |
CVE-2018-5242 | Medium | 6.2 | 2018-06-13 | Norton App Lock prior to version 1.3.0.329 can be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to circumvent t… |
CVE-2018-5234 | High | 8.0 | 2018-04-30 | The Norton Core router prior to v237 may be susceptible to a command injection exploit. This is a type of attack in which the goal is execution of arbitrary co… |
CVE-2017-6323 | High | 8.0 | 2018-04-16 | The Symantec Management Console prior to ITMS 8.1 RU1, ITMS 8.0_POST_HF6, and ITMS 7.6_POST_HF7 has an issue whereby XML input containing a reference to an ext… |
CVE-2016-9094 | High | 7.8 | 2018-04-16 | Symantec Endpoint Protection clients place detected malware in quarantine as part of the intended product functionality. The quarantine logs can be exported fo… |
CVE-2016-9093 | High | 7.0 | 2018-04-16 | A version of the SymEvent Driver that shipped with Symantec Endpoint Protection 12.1 RU6 MP6 and earlier fails to properly sanitize logged-in user input. SEP 1… |
CVE-2017-15534 | Medium | 6.7 | 2018-03-26 | The Norton App Lock prior to version 1.3.0.13 can be susceptible to an authentication bypass exploit. In this type of circumstance, the exploit can allow the u… |
CVE-2011-3477 | Medium | 5.5 | 2018-02-19 | GEAR Software CD DVD Filter driver (aka GEARAspiWDM.sys), as used in Symantec Backup Exec System Recovery 8.5 and BESR 2010, Symantec System Recovery 2011, Nor… |
CVE-2010-0109 | Medium | 6.5 | 2018-02-19 | DBManager in Symantec Altiris Deployment Solution 6.9.x before DS 6.9 SP4 allows remote attackers to cause a denial of service via a crafted request. |
CVE-2017-15531 | Critical | 9.8 | 2018-01-23 | Symantec Reporter 9.5 prior to 9.5.4.1 and 10.1 prior to 10.1.5.5 does not restrict excessive authentication attempts for management interface users. A remote… |
CVE-2017-15532 | Medium | 5.7 | 2017-12-20 | Prior to 10.6.4, Symantec Messaging Gateway may be susceptible to a path traversal attack (also known as directory traversal). These types of attacks aim to ac… |
CVE-2017-15530 | Low | 3.3 | 2017-12-13 | Prior to 4.4.1.10, the Norton Family Android App can be susceptible to an Information Disclosure issue. Information disclosure is a very common issue that atta… |
CVE-2017-15529 | Medium | 6.2 | 2017-12-13 | Prior to 4.4.1.10, the Norton Family Android App can be susceptible to a Denial of Service (DoS) exploit. A DoS attack is a type of attack whereby the perpetra… |
CVE-2017-15527 | Medium | 6.8 | 2017-11-20 | Prior to ITMS 8.1 RU4, the Symantec Management Console can be susceptible to a directory traversal exploit, which is a type of attack that can occur when there… |
CVE-2017-15526 | Medium | 6.8 | 2017-11-13 | Prior to SEE v11.1.3MP1, Symantec Endpoint Encryption can be susceptible to a null pointer de-reference issue, which can result in a NullPointerException that… |
CVE-2017-15525 | Medium | 4.5 | 2017-11-13 | Prior to SEE v11.1.3MP1, Symantec Endpoint Encryption can be susceptible to a denial of service (DoS) attack, which is a type of attack whereby the perpetrator… |
CVE-2017-6331 | High | 7.1 | 2017-11-06 | Prior to SEP 14 RU1 Symantec Endpoint Protection product can encounter an issue of Tamper-Protection Bypass, which is a type of attack that bypasses the real t… |
CVE-2017-13681 | High | 7.8 | 2017-11-06 | Symantec Endpoint Protection prior to SEP 12.1 RU6 MP9 could be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a use… |
CVE-2017-13680 | Medium | 5.5 | 2017-11-06 | Prior to SEP 12.1 RU6 MP9 & SEP 14 RU1 Symantec Endpoint Protection Windows endpoint can encounter a situation whereby an attacker could use the product's UI t… |
CVE-2017-13683 | Medium | 5.7 | 2017-10-23 | In Symantec Endpoint Encryption before SEE 11.1.3HF3, a kernel memory leak is a type of resource leak that can occur when a computer program incorrectly manage… |
CVE-2017-13682 | Medium | 5.7 | 2017-10-23 | In Symantec Encryption Desktop before SED 10.4.1 MP2HF1, a kernel memory leak is a type of resource leak that can occur when a computer program incorrectly man… |
CVE-2017-13679 | Medium | 4.2 | 2017-10-10 | A denial of service (DoS) attack in Symantec Encryption Desktop before SED 10.4.1 MP2HF1 allows remote attackers to make a particular machine or network resour… |
CVE-2017-13675 | Medium | 4.2 | 2017-10-10 | A denial of service (DoS) attack in Symantec Endpoint Encryption before SEE 11.1.3HF2 allows remote attackers to make a particular machine or network resource… |
CVE-2017-6330 | Medium | 6.5 | 2017-09-13 | Symantec Encryption Desktop before SED 10.4.1MP2 can allow remote attackers to cause a denial of service (resource consumption) via crafted web requests." |
CVE-2015-4523 | Critical | 9.3 | 2017-09-11 | Blue Coat Malware Analysis Appliance (MAA) before 4.2.5 and Malware Analyzer G2 allow remote attackers to bypass a virtual machine protection mechanism and con… |
CVE-2017-13674 | High | 7.8 | 2017-09-01 | Symantec ProxyClient 3.4 for Windows is susceptible to a privilege escalation vulnerability. A malicious local Windows user can, under certain circumstances, e… |
CVE-2017-6329 | High | 7.8 | 2017-08-21 | Symantec VIP Access for Desktop prior to 2.2.4 can be susceptible to a DLL Pre-Loading vulnerability. These types of issues occur when an application looks to… |
CVE-2017-6328 | High | 8.8 | 2017-08-11 | The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of cross site request forgery (also known as one-click attack and is abbreviated as CSR… |
CVE-2017-6327 | High | 8.8 | 2017-08-11 | The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain… |
CVE-2017-6326 | Critical | 10.0 | 2017-06-26 | The Symantec Messaging Gateway can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to exe… |
CVE-2017-6325 | Medium | 6.6 | 2017-06-26 | The Symantec Messaging Gateway can encounter a file inclusion vulnerability, which is a type of vulnerability that is most commonly found to affect web applica… |
CVE-2017-6324 | High | 7.3 | 2017-06-26 | The Symantec Messaging Gateway, when processing a specific email attachment, can allow a malformed or corrupted Word file with a potentially malicious macro th… |
CVE-2016-9092 | High | 8.8 | 2017-05-11 | The Symantec Content Analysis (CA) 1.3, 2.x prior to 2.2.1.1, and Mail Threat Defense (MTD) 1.1 management consoles are susceptible to a cross-site request for… |
CVE-2016-5312 | Medium | 6.5 | 2017-04-14 | Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to read arbitrary fil… |
CVE-2016-5310 | Medium | 5.5 | 2017-04-14 | The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP); Symantec Email Security.Cloud; Symantec… |
CVE-2016-5309 | Medium | 5.5 | 2017-04-14 | The RAR file parser component in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection: Network (ATP); Symantec Email Security.Cloud; Symantec… |
CVE-2016-5313 | High | 8.8 | 2017-04-12 | Symantec Web Gateway (SWG) before 5.2.5 allows remote authenticated users to execute arbitrary OS commands. |
CVE-2016-5308 | Medium | 5.5 | 2016-07-12 | The Client Intrusion Detection System (CIDS) driver before 15.0.6 in Symantec Endpoint Protection (SEP) and before 15.1.2 in Norton Security allows remote atta… |
CVE-2016-2206 | Medium | 5.7 | 2016-07-12 | The management console in Symantec Workspace Streaming (SWS) 7.5.x before 7.5 SP1 HF9 and 7.6.0 before 7.6 HF5 and Symantec Workspace Virtualization (SWV) 7.5… |
CVE-2016-2205 | Medium | 5.7 | 2016-07-12 | Directory traversal vulnerability in the file-download configuration file in the management console in Symantec Workspace Streaming (SWS) 7.5.x before 7.5 SP1… |
CVE-2016-5307 | Medium | 4.3 | 2016-06-30 | Directory traversal vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to read arbitrary files… |
CVE-2016-5306 | Medium | 5.3 | 2016-06-30 | Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 does not properly implement the HSTS protection mechanism, which makes it easier for remote att… |
CVE-2016-5305 | Medium | 5.4 | 2016-06-30 | Multiple cross-site scripting (XSS) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allow remote authe… |
CVE-2016-5304 | Medium | 6.8 | 2016-06-30 | Open redirect vulnerability in a report-routing component in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users… |
CVE-2016-3653 | High | 8.0 | 2016-06-30 | Multiple cross-site request forgery (CSRF) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allow remot… |
CVE-2016-3652 | Medium | 5.4 | 2016-06-30 | Multiple cross-site scripting (XSS) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allow remote authe… |
CVE-2016-3651 | High | 8.0 | 2016-06-30 | Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover the PHP JSESSIONID value via unspecified vectors. |
CVE-2016-3650 | High | 8.8 | 2016-06-30 | Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover credentials via a brute-force attack. |
CVE-2016-3649 | Medium | 4.3 | 2016-06-30 | Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated administrators to enumerate administrator accounts via modified GET… |
CVE-2016-3648 | High | 8.8 | 2016-06-30 | Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to bypass the Authentication Lock protection mechanism, and c… |
CVE-2016-3647 | High | 7.7 | 2016-06-30 | Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, and tr… |
CVE-2016-3646 | High | 8.4 | 2016-06-30 | The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web G… |
CVE-2016-3645 | Critical | 9.8 | 2016-06-30 | Integer overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SD… |
CVE-2016-3644 | High | 8.4 | 2016-06-30 | The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web G… |
CVE-2016-2211 | High | 7.8 | 2016-06-30 | The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web G… |
CVE-2016-2210 | High | 7.3 | 2016-06-30 | Buffer overflow in Dec2LHA.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6… |
CVE-2016-2209 | High | 7.3 | 2016-06-30 | Buffer overflow in Dec2SS.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6… |
CVE-2016-2207 | High | 8.4 | 2016-06-30 | The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web G… |
CVE-2015-8801 | Low | 2.9 | 2016-06-30 | Race condition in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6 MP5 allows local users to bypass intended restrictions on USB file transfer… |
CVE-2016-2208 | Critical | 9.1 | 2016-05-19 | The kernel component in Symantec Anti-Virus Engine (AVE) 20151.1 before 20151.1.1.4 allows remote attackers to execute arbitrary code or cause a denial of serv… |
CVE-2015-8156 | High | 7.8 | 2016-05-14 | Unquoted Windows search path vulnerability in EEDService in Symantec Endpoint Encryption (SEE) 11.x before 11.1.1 allows local users to gain privileges via a T… |
CVE-2016-2204 | High | 8.2 | 2016-04-22 | The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to obtain root-shell access via crafted terminal-… |
CVE-2016-2203 | High | 7.8 | 2016-04-22 | The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to discover an encrypted AD password by leveragin… |
CVE-2016-2202 | Medium | 5.5 | 2016-04-20 | The Inventory Solution component in the Management Agent in the client in Symantec Altiris IT Management Suite (ITMS) through 7.6 HF7 allows local users to byp… |
CVE-2015-8154 | High | 8.8 | 2016-03-18 | The SysPlant.sys driver in the Application and Device Control (ADC) component in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6-MP4 allows re… |
CVE-2015-8153 | High | 8.8 | 2016-03-18 | SQL injection vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to execute arbitrary SQL comma… |
CVE-2015-8152 | High | 8.0 | 2016-03-18 | Cross-site request forgery (CSRF) vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to hijack… |
CVE-2015-8151 | Critical | 9.1 | 2016-02-18 | Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote authenticated users to execute arbitrary OS commands by leveraging console adminis… |
CVE-2015-8150 | High | 7.8 | 2016-02-18 | Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows local users to obtain root access by modifying a batch file. |
CVE-2015-8149 | High | 7.5 | 2016-02-18 | The LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to cause a denial of service (heap memory corruption… |
CVE-2015-8148 | High | 7.5 | 2016-02-18 | The LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to obtain sensitive information about administrator… |
CVE-2015-6556 | | 2015-12-18 | EACommunicatorSrv.exe in the Framework Service in the client in Symantec Endpoint Encryption (SEE) before 11.1.0 allows remote authenticated users to discover… | |
CVE-2015-4334 | | 2015-12-07 | The default configuration of SGOS in Blue Coat ProxySG before 6.2.16.5, 6.5 before 6.5.7.1, and 6.6 before 6.6.2.1 forwards authentication challenges from upst… | |
CVE-2015-8113 | | 2015-11-12 | Untrusted search path vulnerability in the client in Symantec Endpoint Protection (SEP) 12.1 before 12.1-RU6-MP3 allows local users to gain privileges via a Tr… | |
CVE-2015-6555 | | 2015-11-12 | Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP3 allows remote attackers to execute arbitrary Java code by connecting to the console Java p… | |
CVE-2015-6554 | | 2015-11-12 | Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP3 allows remote attackers to execute arbitrary OS commands via crafted data. | |
CVE-2015-6549 | | 2015-10-06 | Cross-site scripting (XSS) vulnerability in an application console in the server in Symantec NetBackup OpsCenter before 7.7.1 allows remote authenticated users… | |
CVE-2015-6548 | | 2015-09-20 | Multiple SQL injection vulnerabilities in a PHP script in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1… | |
CVE-2015-6547 | | 2015-09-20 | The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary… | |
CVE-2015-5693 | | 2015-09-20 | The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary… | |
CVE-2015-5692 | | 2015-09-20 | admin_messages.php in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated user… | |
CVE-2015-5691 | | 2015-09-20 | Multiple cross-site scripting (XSS) vulnerabilities in PHP scripts in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2… | |
CVE-2015-5690 | | 2015-09-20 | The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to bypass intended a… | |
CVE-2015-5689 | | 2015-09-20 | ghostexp.exe in Ghost Explorer Utility in Symantec Ghost Solutions Suite (GSS) before 3.0 HF2 12.0.0.8010 and Symantec Deployment Solution (DS) before 7.6 HF4… | |
CVE-2014-9229 | | 2015-09-20 | Multiple SQL injection vulnerabilities in interface PHP scripts in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allow remote authe… | |
CVE-2014-9228 | | 2015-09-20 | sysplant.sys in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allows local users to cause a denial of service (blocked system shutd… | |
CVE-2014-9227 | | 2015-09-20 | Multiple untrusted search path vulnerabilities in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allow local users to gain privilege… | |
CVE-2015-1492 | | 2015-08-01 | Untrusted search path vulnerability in the client in Symantec Endpoint Protection 12.1 before 12.1-RU6-MP1 allows local users to gain privileges via a Trojan h… | |
CVE-2015-1491 | | 2015-08-01 | SQL injection vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users… | |
CVE-2015-1490 | | 2015-08-01 | Directory traversal vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated… | |
CVE-2015-1489 | | 2015-08-01 | The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to gain privileges via unspeci… | |
CVE-2015-1488 | | 2015-08-01 | An unspecified action handler in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated use… | |
CVE-2015-1487 | | 2015-08-01 | The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to write to arbitrary files, a… | |
CVE-2015-1486 | | 2015-08-01 | The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote attackers to bypass authentication via a crafted p… | |
CVE-2015-1485 | | 2015-06-28 | Cross-site request forgery (CSRF) vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention (DLP) before 12.5.2 allows… | |
CVE-2014-9230 | | 2015-06-28 | Cross-site scripting (XSS) vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention (DLP) before 12.5.2 allows remote… | |
CVE-2015-1484 | | 2015-04-22 | Unquoted Windows search path vulnerability in the agent in Symantec Workspace Streaming (SWS) 6.1 before SP8 MP2 HF7 and 7.5 before SP1 HF4, when AppMgrService… | |
CVE-2015-1483 | | 2015-03-06 | Symantec NetBackup OpsCenter 7.6.0.2 through 7.6.1 on Linux and UNIX allows remote attackers to execute arbitrary JavaScript code via unspecified vectors. | |
CVE-2014-7288 | | 2015-02-01 | Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allow remote authenticated administrators to execute arbitrary shell commands v… |