CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-18371
https://notcve.org/view.php?id=CVE-2018-18371
The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. An information disclosure vulnerability in the WebFTP mode allows a malicious user to obtain plaintext authentication credentials for a remote FTP server from the ASG/ProxySG's web listing of the FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15, 6.6, and 6.7 prior to 6.7.4.2. El modo WebFTP del proxy FTP de ASG/ProxySG, permite interceptar conexiones FTP donde un usuario accede a un servidor FTP por medio de una URL ftp:// en un navegador web. Una vulnerabilidad de divulgación de información en el modo WebFTP permite a un usuario malicioso obtener credenciales de aute de texto plano para un servidor FTP remoto desde un listado web del servidor FTP de ASG/ProxySG. • https://support.symantec.com/us/en/article.SYMSA1472.html • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 0CVE-2018-18370
https://notcve.org/view.php?id=CVE-2018-18370
The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web browser. A stored cross-site scripting (XSS) vulnerability in the WebFTP mode allows a remote attacker to inject malicious JavaScript code in ASG/ProxySG's web listing of a remote FTP server. Exploiting the vulnerability requires the attacker to be able to upload crafted files to the remote FTP server. Affected versions: ASG 6.6 and 6.7 prior to 6.7.4.2; ProxySG 6.5 prior to 6.5.10.15, 6.6, and 6.7 prior to 6.7.4.2. El modo WebFTP del Proxy FTP de ASG/ProxySG, permite interceptar conexiones FTP donde un usuario accede a un servidor FTP por medio de una URL ftp:// en un navegador web. • https://support.symantec.com/us/en/article.SYMSA1472.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 1%CPEs: 5EXPL: 1CVE-2016-10258 – Symantec Advanced Secure Gateway (ASG) / ProxySG - Unrestricted File Upload
https://notcve.org/view.php?id=CVE-2016-10258
Unrestricted file upload vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A malicious appliance administrator can upload arbitrary malicious files to the management console and trick another administrator user into downloading and executing malicious code. Vulnerabilidad de subida de archivos sin restricción en las consolas de gestión Symantec Advanced Secure Gateway (ASG) y ProxySG. Un administrador de aparatos malicioso puede subir archivos arbitrarios maliciosos a la consola de gestión y engañar a otro usuario administrador para que descargue y ejecute código malicioso. • https://www.exploit-db.com/exploits/47392 http://www.securityfocus.com/bid/103685 http://www.securitytracker.com/id/1040757 https://www.symantec.com/security-center/network-protection-security-advisories/SA162 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 4.8EPSS: 0%CPEs: 7EXPL: 0CVE-2017-13678
https://notcve.org/view.php?id=CVE-2017-13678
Stored XSS vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A malicious appliance administrator can inject arbitrary JavaScript code in the management console web client application. Vulnerabilidad de Cross-Site Scripting (XSS) persistente en las consolas de gestión Symantec Advanced Secure Gateway (ASG) y ProxySG. Un administrador de aparatos malicioso puede inyectar código JavaScript arbitrario en la aplicación cliente de la consola de gestión web. • http://www.securityfocus.com/bid/103685 http://www.securitytracker.com/id/1040757 https://www.symantec.com/security-center/network-protection-security-advisories/SA162 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 0CVE-2017-13677
https://notcve.org/view.php?id=CVE-2017-13677
Denial-of-service (DoS) vulnerability in the Symantec Advanced Secure Gateway (ASG) and ProxySG management consoles. A remote attacker can use crafted HTTP/HTTPS requests to cause denial-of-service through management console application crashes. Vulnerabilidad de denegación de servicio (DoS) en las consolas de gestión Symantec Advanced Secure Gateway (ASG) y ProxySG. Un atacante remoto puede emplear peticiones HTTP/HTTPS manipuladas para provocar el cierre inesperado de la aplicación a través de una denegación de servicio (DoS) en la consola de gestión. • http://www.securityfocus.com/bid/103685 http://www.securitytracker.com/id/1040757 https://www.symantec.com/security-center/network-protection-security-advisories/SA162 •