CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8113
https://notcve.org/view.php?id=CVE-2015-8113
Untrusted search path vulnerability in the client in Symantec Endpoint Protection (SEP) 12.1 before 12.1-RU6-MP3 allows local users to gain privileges via a Trojan horse DLL in a client install package. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1492. Vulnerabilidad de búsqueda de ruta no confiable en el cliente en Symantec Endpoint Protection (SEP) 12.1 en versiones anteriores a 12.1-RU6-MP3 permite a usuarios locales obtener privilegios a través de un Troyano DLL en un paquete de instalación en el cliente. NOTA: ésta vulnerabilidad existe debido a una solución incompleta para CVE-2015-1492. • http://www.securityfocus.com/bid/77585 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20151109_00 •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6549
https://notcve.org/view.php?id=CVE-2015-6549
Cross-site scripting (XSS) vulnerability in an application console in the server in Symantec NetBackup OpsCenter before 7.7.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en la consola de una aplicación en el servidor de Symantec NetBackup OpsCenter en versiones anteriores a 7.7.1 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • http://www.securityfocus.com/bid/76896 http://www.securitytracker.com/id/1033726 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20151001_00 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-9229
https://notcve.org/view.php?id=CVE-2014-9229
Multiple SQL injection vulnerabilities in interface PHP scripts in the Manager component in Symantec Endpoint Protection (SEP) before 12.1.6 allow remote authenticated users to execute arbitrary SQL commands by leveraging the Limited Administrator role. Vulnerabilidad de inyección SQL múltiple en la interfaz de scripts PHP en el componente Manager en Symantec Endpoint Protection (SEP) en versiones anteriores a 12.1.6, permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios mediante el aprovechamiento del rol Limited Administrator. • http://www.securityfocus.com/bid/75204 http://www.securitytracker.com/id/1032616 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150617_00 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6547
https://notcve.org/view.php?id=CVE-2015-6547
The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands at boot time via unspecified vectors. Vulnerabilidad en la consola de gestión en Symantec Web Gateway (SWG) en dispositivos con software en versiones anteriores a 5.2.2 DB 5.0.0.1277, permite a usuarios remotos autenticados ejecutar comandos arbitrarios en tiempo de arranque a través de vectores no especificados. • http://www.securityfocus.com/bid/76730 http://www.securitytracker.com/id/1033625 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150916_00 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6548
https://notcve.org/view.php?id=CVE-2015-6548
Multiple SQL injection vulnerabilities in a PHP script in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL múltiple en el script PHP en la consola de gestión en Symantec Web Gateway (SWG) en aparatos con software en versiones anteriores a 5.2.2 DB 5.0.0.1277, permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través de vectores no especificados. • http://www.securityfocus.com/bid/76729 http://www.securitytracker.com/id/1033625 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150916_00 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •