CVSS: 5.2EPSS: 0%CPEs: 1EXPL: 0CVE-2014-1650
https://notcve.org/view.php?id=CVE-2014-1650
SQL injection vulnerability in user.php in the management console in Symantec Web Gateway (SWG) before 5.2.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en user.php en la consola de gestión en Symantec Web Gateway (SWG) anterior a 5.2.1 permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través de vectores no especificados. • http://www.securityfocus.com/bid/67753 http://www.securitytracker.com/id/1030443 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=securit%20y_advisory&pvid=security_advisory&year=&suid=20140616_00 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2014&suid=20140616_00 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 2.3EPSS: 26%CPEs: 2EXPL: 0CVE-2014-1652
https://notcve.org/view.php?id=CVE-2014-1652
Multiple cross-site scripting (XSS) vulnerabilities in the management console in Symantec Web Gateway (SWG) before 5.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified report parameters. Múltiples vulnerabilidades de XSS en la consola de gestión en Symantec Web Gateway (SWG) anterior a 5.2 permiten a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de parámetros report manipulados. • http://www.kb.cert.org/vuls/id/719172 http://www.securityfocus.com/bid/67755 http://www.securitytracker.com/id/1030443 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=securit%20y_advisory&pvid=security_advisory&year=&suid=20140616_00 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2014&suid=20140616_00 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 5%CPEs: 2EXPL: 0CVE-2014-1651
https://notcve.org/view.php?id=CVE-2014-1651
SQL injection vulnerability in clientreport.php in the management console in Symantec Web Gateway (SWG) before 5.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en clientreport.php en la consola de gestión en Symantec Web Gateway (SWG) anterior a 5.2 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados. • http://www.kb.cert.org/vuls/id/719172 http://www.securityfocus.com/bid/67754 http://www.securitytracker.com/id/1030443 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=securit%20y_advisory&pvid=security_advisory&year=&suid=20140616_00 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2014&suid=20140616_00 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2013-5017 – Symantec Web Gateway user.php SQL Injection and snmpConfig.php Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-5017
SNMPConfig.php in the management console in Symantec Web Gateway (SWG) before 5.2.1 allows remote attackers to execute arbitrary commands via unspecified vectors. SNMPConfig.php en la consola de gestión en Symantec Web Gateway (SWG) anterior a 5.2.1 permite a atacantes remotos ejecutar comandos arbitrarios a través de vectores no especificados. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Web Gateway. Authentication is required to exploit this vulnerability. The specific flaws exist within the user.php and snmpConfig.php files. SQL injection and command injection is possible through vulnerable request parameters. • http://www.securityfocus.com/bid/67752 http://www.securitytracker.com/id/1030443 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=securit%20y_advisory&pvid=security_advisory&year=&suid=20140616_00 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2014&suid=20140616_00 •
CVSS: 10.0EPSS: 97%CPEs: 6EXPL: 2CVE-2014-1649 – Symantec Workspace Streaming Agent XMLRPC Request putFile Method Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-1649
The server in Symantec Workspace Streaming (SWS) before 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS. El servidor en Symantec Workspace Streaming (SWS) anterior a 7.5.0.749 permite a atacantes remotos acceder a archivos y funcionalidad mediante el envío de una solicitud XMLRPC manipulada sobre HTTPS. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Workspace Streaming. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SWS Agent (as_agent.exe) component. By sending a crafted XMLRPC request to this component, an attacker is able to overwrite configuration files for the Workspace Streaming server. • https://www.exploit-db.com/exploits/33521 http://www.exploit-db.com/exploits/33521 http://www.securityfocus.com/bid/67189 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140512_00 http://zerodayinitiative.com/advisories/ZDI-14-127 • CWE-264: Permissions, Privileges, and Access Controls •