CVSS: 8.2EPSS: 0%CPEs: 7EXPL: 0CVE-2016-2204
https://notcve.org/view.php?id=CVE-2016-2204
The management console on Symantec Messaging Gateway (SMG) Appliance devices before 10.6.1 allows local users to obtain root-shell access via crafted terminal-window input. La consola de gestión en dispositivos Symantec Messaging Gateway (SMG) Appliance en versiones anteriores a 10.6.1 permite a usuarios locales obtener acceso root-shell a través de la entrada en ventana de terminal manipulada. • http://www.securityfocus.com/bid/86138 http://www.securitytracker.com/id/1035609 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160418_00 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 4.3EPSS: 43%CPEs: 6EXPL: 1CVE-2014-1648 – Symantec Messaging Gateway 10.5.1 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2014-1648
Cross-site scripting (XSS) vulnerability in brightmail/setting/compliance/DlpConnectFlow$view.flo in the management console in Symantec Messaging Gateway 10.x before 10.5.2 allows remote attackers to inject arbitrary web script or HTML via the displayTab parameter. Vulnerabilidad de XSS en brightmail/setting/compliance/DlpConnectFlow$view.flo en la consola de gestión en Symantec Messaging Gateway 10.x anterior a 10.5.2 permite a atacantes remotos inyectar script Web o HTML arbitrarios a través del parámetro displayTab. Symantec Messaging Gateway version 10.5.1 suffers from a reflective cross site scripting vulnerability. • http://seclists.org/fulldisclosure/2014/Apr/256 http://www.securityfocus.com/bid/66966 http://www.securitytracker.com/id/1030136 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140422_00 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •