CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6554
https://notcve.org/view.php?id=CVE-2015-6554
Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP3 allows remote attackers to execute arbitrary OS commands via crafted data. Symantec Endpoint Protection Manager (SEPM) 12.1 anteriores a 12.1-RU6-MP3 permite a atacantes remotos ejecutar comandos OS arbitrarios a través de datos manipulados. • http://www.securityfocus.com/bid/77494 http://www.securitytracker.com/id/1034139 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20151109_00 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6555
https://notcve.org/view.php?id=CVE-2015-6555
Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP3 allows remote attackers to execute arbitrary Java code by connecting to the console Java port. Symantec Endpoint Protection Manager (SEPM) 12.1 en versiones anteriores a 12.1-RU6-MP3 permite a atacantes remotos ejecutar código Java arbitrario mediante la conexión a la consola del puerto de Java. • http://www.securityfocus.com/bid/77495 http://www.securitytracker.com/id/1034139 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20151109_00 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 5%CPEs: 5EXPL: 2CVE-2014-3437 – Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2014-3437
The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. La consola de gestión en Symantec Endpoint Protection Manager (SEPM) 12.1 anterior a RU5 permite a atacantes remotos leer ficheros arbitrarios o enviar solicitudes TCP a servidores de intranet a través de datos XML que contienen una declaración de entidad externa en conjunto con una referencia de entidad, relacionado con un problema de entidad externa XML (XXE). Symantec Endpoint Protection version 12.1.4023.4080 suffers from XXE injection, cross site scripting, and arbitrary file write vulnerabilities. • https://www.exploit-db.com/exploits/35181 http://seclists.org/fulldisclosure/2014/Nov/7 http://www.securityfocus.com/archive/1/533918/100/0/threaded http://www.securityfocus.com/bid/70843 http://www.securitytracker.com/id/1031176 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20141105_00 https://exchange.xforce.ibmcloud.com/vulnerabilities/98525 •
CVSS: 4.3EPSS: 4%CPEs: 5EXPL: 2CVE-2014-3438 – Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2014-3438
Multiple cross-site scripting (XSS) vulnerabilities in console interface scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de XSS en las secuencias de comandos de la interfaz de la consola en Symantec Endpoint Protection Manager (SEPM) 12.1 anterior a RU5 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. Symantec Endpoint Protection version 12.1.4023.4080 suffers from XXE injection, cross site scripting, and arbitrary file write vulnerabilities. • https://www.exploit-db.com/exploits/35181 http://seclists.org/fulldisclosure/2014/Nov/7 http://www.securityfocus.com/archive/1/533918/100/0/threaded http://www.securityfocus.com/bid/70844 http://www.securitytracker.com/id/1031176 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20141105_00 https://exchange.xforce.ibmcloud.com/vulnerabilities/98526 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 5EXPL: 2CVE-2014-3439 – Symantec Endpoint Protection 12.1.4023.4080 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2014-3439
ConsoleServlet in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to write to arbitrary files via unspecified vectors. ConsoleServlet en Symantec Endpoint Protection Manager (SEPM) 12.1 anterior a RU5 permite a atacantes remotos escribir a ficheros arbitrarios a través de vectores no especificados. Symantec Endpoint Protection version 12.1.4023.4080 suffers from XXE injection, cross site scripting, and arbitrary file write vulnerabilities. • https://www.exploit-db.com/exploits/35181 http://seclists.org/fulldisclosure/2014/Nov/7 http://www.securityfocus.com/archive/1/533918/100/0/threaded http://www.securityfocus.com/bid/70845 http://www.securitytracker.com/id/1031176 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20141105_00 https://exchange.xforce.ibmcloud.com/vulnerabilities/98527 •