CVSS: 7.1EPSS: 92%CPEs: 1EXPL: 1CVE-2017-6331 – Symantec Endpoint Protection 12.1 - Tamper-Protection Bypass
https://notcve.org/view.php?id=CVE-2017-6331
Prior to SEP 14 RU1 Symantec Endpoint Protection product can encounter an issue of Tamper-Protection Bypass, which is a type of attack that bypasses the real time protection for the application that is run on servers and clients. En versiones anteriores a SEP 14 RU1, el producto Symantec Endpoint Protection puede encontrarse con un problema de omisión de protección contra manipulaciones, que es un tipo de ataque que omite la protección en tiempo real para la aplicación que se ejecuta en servidores y clientes. Symantec Endpoint Protection version 12.1.6 suffers from a tamper protection bypass vulnerability. • https://www.exploit-db.com/exploits/43134 http://www.securityfocus.com/bid/101502 http://www.securitytracker.com/id/1039775 https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20171106_00 •
CVSS: 7.2EPSS: 0%CPEs: 28EXPL: 0CVE-2012-4348
https://notcve.org/view.php?id=CVE-2012-4348
The management console in Symantec Endpoint Protection (SEP) 11.0 before RU7-MP3 and 12.1 before RU2, and Symantec Endpoint Protection Small Business Edition 12.x before 12.1 RU2, does not properly validate input for PHP scripts, which allows remote authenticated users to execute arbitrary code via unspecified vectors. La consola de administración de Symantec Endpoint Protection (SEP) v11.0 antes de RU7-MP3 y v12.1 antes de RU2 y Symantec Endpoint Protection Small Business Edition v12.x antes de v12.1 RU2, no valida correctamente la entrada para secuencias de comandos PHP, lo que permite a usuarios remotos autenticados ejecutar código arbitrario a través de vectores no especificados. • http://www.securityfocus.com/bid/56846 http://www.securitytracker.com/id?1027863 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20121210_00 • CWE-20: Improper Input Validation •
CVSS: 5.8EPSS: 0%CPEs: 3EXPL: 0CVE-2012-0294
https://notcve.org/view.php?id=CVE-2012-0294
Directory traversal vulnerability in the Manager service in the management console in Symantec Endpoint Protection (SEP) 12.1 before 12.1 RU1-MP1 allows remote attackers to delete files via unspecified vectors. Vulnerabilidad de salto de directorio en el Servicio Manager en la consola de administracion en Symantec Endpoint Protection (SEP) v12.1 anterior a v12.1 RU1-MP1 permite a atacantes remotos eliminar ficheros mediante vectores desconocidos. • http://www.securityfocus.com/bid/53182 http://www.securitytracker.com/id?1027093 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120522_01 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.3EPSS: 1%CPEs: 3EXPL: 0CVE-2012-0295
https://notcve.org/view.php?id=CVE-2012-0295
The Manager service in the management console in Symantec Endpoint Protection (SEP) 12.1 before 12.1 RU1-MP1 allows remote attackers to conduct file-insertion attacks and execute arbitrary code by leveraging exploitation of CVE-2012-0294. El servicio The Manager de la consola de administración de Symantec Endpoint Protection (SEP) v12.1 anterior a 12.1 RU1-MP1 permite a atacantes remotos realizar ataques de inserción de archivos y ejecutar código arbitrario mediante el aprovechamiento de la explotación de CVE-2012-0294. • http://www.securityfocus.com/bid/53183 http://www.securityfocus.com/bid/53184 http://www.securitytracker.com/id?1027093 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120522_01 • CWE-94: Improper Control of Generation of Code ('Code Injection') •