CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-12239
https://notcve.org/view.php?id=CVE-2018-12239
29 Nov 2018 — Norton prior to 22.15; Symantec Endpoint Protection (SEP) prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Edition (SEP SBE) prior to NIS-22.15.1.8 & SEP-12.1.7454.7000; and Symantec Endpoint Protection Cloud (SEP Cloud) prior to 22.15.1 may be susceptible to an AV bypass issue, which is a type of exploit that works to circumvent one of the virus detection engines to avoid a specific type of virus protection. One of the antivirus engines depends on a signature pattern from a datab... • http://www.securityfocus.com/bid/105918 •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-12245
https://notcve.org/view.php?id=CVE-2018-12245
29 Nov 2018 — Symantec Endpoint Protection prior to 14.2 MP1 may be susceptible to a DLL Preloading vulnerability, which in this case is an issue that can occur when an application being installed unintentionally loads a DLL provided by a potential attacker. Note that this particular type of exploit only manifests at install time; no remediation is required for software that has already been installed. This issue only impacted the Trialware media for Symantec Endpoint Protection, which has since been updated. Symantec En... • http://www.securityfocus.com/bid/105919 • CWE-426: Untrusted Search Path •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2018-5236
https://notcve.org/view.php?id=CVE-2018-5236
20 Jun 2018 — Symantec Endpoint Protection prior to 14 RU1 MP1 or 12.1 RU6 MP10 may be susceptible to a race condition (or race hazard). This type of issue occurs in software where the output is dependent on the sequence or timing of other uncontrollable events. Symantec Endpoint Protection en versiones anteriores a la 14 RU1 MP1 o 12.1 RU6 MP10 podría ser vulnerable a una condición de carrera may be susceptible to a race condition (o condición de secuencia). Este tipo de problema ocurre en software cuando la salida depe... • http://www.securityfocus.com/bid/104198 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2018-5237
https://notcve.org/view.php?id=CVE-2018-5237
20 Jun 2018 — Symantec Endpoint Protection prior to 14 RU1 MP1 or 12.1 RU6 MP10 could be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to gain elevated access to resources that are normally protected at lower access levels. Symantec Endpoint Protection, en versiones anteriores a 14 RU1 MP1 o 12.1 RU6 MP10, podría ser susceptible a una vulnerabilidad de escalado de privilegios. Este tipo de problema permite que un usuario obtenga accesos elevados a recursos que, normalmen... • http://www.securityfocus.com/bid/104199 •
CVSS: 7.0EPSS: 0%CPEs: 8EXPL: 0CVE-2016-9093
https://notcve.org/view.php?id=CVE-2016-9093
16 Apr 2018 — A version of the SymEvent Driver that shipped with Symantec Endpoint Protection 12.1 RU6 MP6 and earlier fails to properly sanitize logged-in user input. SEP 14.0 and later are not impacted by this issue. A non-admin user would need to be able to save an executable file to disk and then be able to successfully run that file. If properly constructed, the file could access the driver interface and potentially manipulate certain system calls. On all 32-bit systems and in most cases on 64-bit systems, this will... • http://www.securityfocus.com/bid/96294 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-9094
https://notcve.org/view.php?id=CVE-2016-9094
16 Apr 2018 — Symantec Endpoint Protection clients place detected malware in quarantine as part of the intended product functionality. The quarantine logs can be exported for review by the user in a variety of formats including .CSV files. Prior to 14.0 MP1 and 12.1 RU6 MP7, the potential exists for file metadata to be interpreted and evaluated as a formula. Successful exploitation of an attack of this type requires considerable direct user-interaction from the user exporting and then opening the log files on the intende... • http://www.securityfocus.com/bid/96298 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 4CVE-2018-9233 – Sophos Endpoint Protection Control Panel 10.7 - Weak Password Encryption
https://notcve.org/view.php?id=CVE-2018-9233
04 Apr 2018 — Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it easier for attackers to determine a cleartext password, and subsequently choose unsafe malware settings, via rainbow tables or other approaches. Sophos Endpoint Protection 10.7 emplea un hash SHA-1 sin sal para almacenar contraseñas en %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml. Esto facilita que los atacantes determinen una contraseña e... • https://packetstorm.news/files/id/147040 • CWE-916: Use of Password Hash With Insufficient Computational Effort •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 4CVE-2018-4863 – Sophos Endpoint Protection 10.7 - Tamper-Protection Bypass
https://notcve.org/view.php?id=CVE-2018-4863
04 Apr 2018 — Sophos Endpoint Protection 10.7 allows local users to bypass an intended tamper protection mechanism by deleting the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Sophos Endpoint Defense\ registry key. Sophos Endpoint Protection 10.7 permite que usuarios locales omitan un mecanismo de protección contra manipulaciones mediante la eliminación de la clave de registro HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Sophos Endpoint Defense\. Sophos Endpoint Protection version 10.7 suffers from a tamp... • https://packetstorm.news/files/id/147039 • CWE-254: 7PK - Security Features •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-13681
https://notcve.org/view.php?id=CVE-2017-13681
06 Nov 2017 — Symantec Endpoint Protection prior to SEP 12.1 RU6 MP9 could be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to gain elevated access to resources that are normally protected at lower access levels. In the circumstances of this issue, the capability of exploit is limited by the need to perform multiple file and directory writes to the local filesystem and as such, is not feasible in a standard drive-by type attack. Symantec Endpoint Protection, en versiones... • http://www.securityfocus.com/bid/101504 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2017-13680
https://notcve.org/view.php?id=CVE-2017-13680
06 Nov 2017 — Prior to SEP 12.1 RU6 MP9 & SEP 14 RU1 Symantec Endpoint Protection Windows endpoint can encounter a situation whereby an attacker could use the product's UI to perform unauthorized file deletes on the resident file system. En versiones anteriores a SEP 12.1 RU6 MP9 SEP 14 RU1, el endpoint Symantec Endpoint Protection Windows puede encontrarse con una situación en la que un atacante podría emplear la interfaz de usuario del producto para realizar borrados no autorizados de archivos en el sistema de archivos... • http://www.securityfocus.com/bid/101503 •