CVSS: 4.6EPSS: 0%CPEs: 24EXPL: 0CVE-2013-5010
https://notcve.org/view.php?id=CVE-2013-5010
The Application/Device Control (ADC) component in the client in Symantec Endpoint Protection (SEP) 11.x before 11.0.7.4 and 12.x before 12.1.2 RU2 and Endpoint Protection Small Business Edition 12.x before 12.1.2 RU2 does not properly handle custom polices, which allows local users to bypass intended policy restrictions and access files or directories via unspecified vectors. El componente Application/Device Control (ADC) del cliente de Symantec Endpoint Protection (SEP) 11.x anteriores a 11.0.7.4 y 12.x anteriores a 12.1.2 RU2 y Endpoint Protection Small Business Edition 12.x anteriores a 12.1.2 RU2 no maneja apropiadamente politicas personalizadas, lo cual permite a usuarios locales sortear políticas de restricción y acceder a archivos o directorios a través de vectores no especificados. • http://www.securityfocus.com/bid/64129 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140109_00 https://exchange.xforce.ibmcloud.com/vulnerabilities/90225 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.4EPSS: 0%CPEs: 24EXPL: 0CVE-2013-5009
https://notcve.org/view.php?id=CVE-2013-5009
The Management Console in Symantec Endpoint Protection (SEP) 11.x before 11.0.7.4 and 12.x before 12.1.2 RU2 and Endpoint Protection Small Business Edition 12.x before 12.1.2 RU2 does not properly perform authentication, which allows remote authenticated users to gain privileges by leveraging access to a limited-admin account. La Consola de Administración en Symantec Endpoint Protection (SEP) 11.x anteriores a 11.0.7.4 y 12.x anteriores a 12.1.2 RU2 y Endpoint Protection Small Business Edition 12.x anteriores a 12.1.2 RU2 no realizan la autenticación de forma apropiada , lo cual permite a usuarios remotos autenticados obtener privilegios aprovechando el acceso a una cuenta de administrador limitada. • http://www.securityfocus.com/bid/64128 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140109_00 https://exchange.xforce.ibmcloud.com/vulnerabilities/90224 • CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 24EXPL: 0CVE-2013-5011
https://notcve.org/view.php?id=CVE-2013-5011
Unquoted Windows search path vulnerability in the client in Symantec Endpoint Protection (SEP) 11.x before 11.0.7.4 and 12.x before 12.1.2 RU2 and Endpoint Protection Small Business Edition 12.x before 12.1.2 RU2 allows local users to gain privileges via a crafted program in the %SYSTEMDRIVE% directory. Vulnerabilidad unquoted Windows search path en el cliente de Symantec Endpoint Protection (SEP) 11.x anteriores a 11.0.7.4 y 12.x anteriores a 12.1.2 RU2 y Endpoint Protection Small Business Edition 12.x anteriores a 12.1.2 RU2 permite a usuarios locales obtener privilegios a través de un programa manipulado en el directorio %SYSTEMDRIVE%. • http://www.securityfocus.com/bid/64130 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140109_00 https://exchange.xforce.ibmcloud.com/vulnerabilities/90226 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.6EPSS: 0%CPEs: 4EXPL: 0CVE-2013-5008
https://notcve.org/view.php?id=CVE-2013-5008
The agent and task-agent components in Symantec Management Platform 7.0 and 7.1 before 7.1 SP2 Mp1.1v7 rollup, as used in certain Altiris products, use the same registry-entry encryption key across different customers' installations, which makes it easier for local users to obtain sensitive information about package-server access, or cause a denial of service, by leveraging knowledge of this key. Los componentes del agente y del task-agent de Symantec Management Platform 7.0 y 7.1 SP2 Mp1.1v7 rollup, tal como se utiliza en algunos productos de Altiris, utilizan la misma clave de cifrado a través del registro de entrada para instalaciones de diferentes clientes, lo que hace que sea más fácil para los usuarios locales obtener información sensible acerca del acceso de paquetes del servidor, o causar una denegación de servicio, mediante el aprovechamiento de los conocimientos de esta clave. • http://www.securityfocus.com/bid/62757 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20131008_00 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 85%CPEs: 4EXPL: 0CVE-2013-4676
https://notcve.org/view.php?id=CVE-2013-4676
Multiple cross-site scripting (XSS) vulnerabilities in Symantec Backup Exec 2010 R3 before 2010 R3 SP3 and 2012 before SP2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a (1) custom-reports generation page, (2) Storage Devices creation page, or (3) jobs creation page in the management console; or (4) a Backup Exec server-management page in the beutility console. Múltiples vulnerabilidades de cross-site scripting (XSS) en Symantec Backup Exec v2010 R3 anterior a v2010 R3 SP3 y v2012 anterior a SP2, permite a atacantes remotos inyectar secuencias de comandos web y HTML arbitrarias a través de vectores que involucran una (1) página de generación de informes personalizados, (2) una página de creación de dispositivos de almacenamiento, o (3) una página de creación de trabajos en la consola de administración, o (4) una página de Backup Exec del servidor de administración en la consola “beutility”. • http://osvdb.org/95941 http://osvdb.org/95942 http://www.securityfocus.com/bid/61486 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130801_00 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •