CVSS: 4.3EPSS: 1%CPEs: 6EXPL: 5CVE-2011-1524 – Symantec LiveUpdate Administrator Management GUI - HTML Injection
https://notcve.org/view.php?id=CVE-2011-1524
Cross-site scripting (XSS) vulnerability in the management login GUI page in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event log, a different vulnerability than CVE-2011-0545. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el inicio de sesión de GUI en Symantec LiveUpdate Administrator (LUA) en versiones anteriores a v2.3 , permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de la inyección de un IFRAME en el log de eventos. Está vulnerabilidad diferente de CVE-2011-0545. • https://www.exploit-db.com/exploits/17026 http://securityreason.com/securityalert/8166 http://securitytracker.com/id?1025242 http://sotiriu.de/adv/NSOADV-2011-001.txt http://www.exploit-db.com/exploits/17026 http://www.securityfocus.com/archive/1/517109/100/0/threaded http://www.securityfocus.com/bid/46856 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110321_00 http://www.vupen.com/english/advisories/20 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 4CVE-2011-0545 – Symantec LiveUpdate Administrator Management GUI - HTML Injection
https://notcve.org/view.php?id=CVE-2011-0545
Cross-site request forgery (CSRF) vulnerability in adduser.do in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts, and possibly have unspecified other impact, via the userRole parameter. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en adduser.do de Symantec LiveUpdate Administrator (LUA) en versiones anteriores a v2.3, permite a atacantes remotos secuestrar la autenticación de los administradores y posiblemente algún otro impacto no especificado mediante el parámetro userRole . • https://www.exploit-db.com/exploits/17026 http://secunia.com/advisories/43820 http://securityreason.com/securityalert/8160 http://securitytracker.com/id?1025242 http://sotiriu.de/adv/NSOADV-2011-001.txt http://www.exploit-db.com/exploits/17026 http://www.osvdb.org/71261 http://www.securityfocus.com/archive/1/517109/100/0/threaded http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110321_00 http://www. • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.3EPSS: 1%CPEs: 39EXPL: 0CVE-2011-0688
https://notcve.org/view.php?id=CVE-2011-0688
Intel Alert Management System (aka AMS or AMS2), as used in Symantec Antivirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec System Center (SSC) 10.x, and Symantec Quarantine Server 3.5 and 3.6, allows remote attackers to execute arbitrary commands via crafted messages over TCP, as discovered by Junaid Bohio, a different vulnerability than CVE-2010-0110 and CVE-2010-0111. NOTE: some of these details are obtained from third party information. Intel Alert Management System(también conocido como AMS o AMS2), tal como se utiliza en Symantec Antivirus Corporate Edition (SAVCE) v10.x anterior a v10,1 MR10, Symantec System Center (SSC) v10.x, Symantec Quarantine Server v3.5 y v3.6, permite a atacantes remotos ejecutar comandos de su elección a través de mensajes manipulados a través de TCP, como lo descubrió Junaid Bohío, una vulnerabilidad diferente de CVE-2010-0110 y CVE-2010 0111. NOTA: algunos de estos detalles han sido obtenidos de información de terceros. • http://secunia.com/advisories/43099 http://securitytracker.com/id?1024996 http://www.securityfocus.com/bid/45936 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110126_00 http://www.vupen.com/english/advisories/2011/0234 https://exchange.xforce.ibmcloud.com/vulnerabilities/65071 • CWE-287: Improper Authentication •
CVSS: 8.5EPSS: 1%CPEs: 19EXPL: 0CVE-2010-3719 – Symantec IM Manager Administrative Interface IMAdminSchedTask.asp Eval Code Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-3719
Eval injection vulnerability in IMAdminSchedTask.asp in the administrative interface for Symantec IM Manager 8.4.16 and earlier allows remote attackers to execute arbitrary code via unspecified parameters to the ScheduleTask method. Vulnerabilidad de inyección mediante eval en IMAdminSchedTask.asp en la interfaz administrativa para Symantec IM Manager v8.4.16 y anteriores, permite a atacantes remotos ejecutar código de su elección a través de parámetros no especificados en el método ScheduleTask. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec IM Manager. Authentication is required to exploit this vulnerability in that a logged in user must be coerced into visiting a malicious link. The specific flaw exists within the ScheduleTask method exposed by the IMAdminSchedTask.asp page hosted on the web interface. This function does not properly sanitize user input from a POST variable before passing it to an eval call. • http://osvdb.org/70755 http://secunia.com/advisories/43143 http://www.securityfocus.com/archive/1/516103/100/0/threaded http://www.securityfocus.com/bid/45946 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110131_00 http://www.vupen.com/english/advisories/2011/0259 http://www.zerodayinitiative.com/advisories/ZDI-11-037 https://exchange.xforce.ibmcloud.com/vulnerabilities/65040 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 94%CPEs: 39EXPL: 0CVE-2010-0110 – Symantec AMS Intel Alert Service AMSSendAlertAct Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-0110
Multiple stack-based buffer overflows in Intel Alert Management System (aka AMS or AMS2), as used in Symantec AntiVirus Corporate Edition (SAVCE) 10.x before 10.1 MR10, Symantec System Center (SSC) 10.x, and Symantec Quarantine Server 3.5 and 3.6, allow remote attackers to execute arbitrary code via (1) a long string to msgsys.exe, related to the AMSSendAlertAct function in AMSLIB.dll in the Intel Alert Handler service (aka Symantec Intel Handler service); a long (2) modem string or (3) PIN number to msgsys.exe, related to pagehndl.dll in the Intel Alert Handler service; or (4) a message to msgsys.exe, related to iao.exe in the Intel Alert Originator service. Múltiples desbordamientos de búfer basados en pila en Intel Alert Management System (también conocido como AMS o AMS2), como es usado en Symantec AntiVirus Corporate Edition (SAVCE) v10.x anterior a v10.1 MR10, Symantec System Center (SSC) v10.x,y Symantec Quarantine Server v3.5 y v3.6, permite a atacantes remotos ejecutar código de su elección a través de (1) una cadena larga para msgsys.exe, relacionada con la función AMSSendAlertAct en AMSLIB.dll en el servicio Intel Alert Handler (también conocido como servicio Symantec Intel Handler); una larga (2)cadena modem o (3) número PIN para msgsys.exe, relacionado con pagehndl.dll en el servicio Intel Alert Handler; o (4) un mensaje para msgsys.exe, relacionado con iao.exe en el servicio Intel Alert Originator . This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Alert Management System. Authentication is not required to exploit this vulnerability. The specific flaw exists within the AMSLIB.dll module while processing data sent from the msgsys.exe process which listens by default on TCP port 38292. The DLL allocates a fixed length stack buffer and subsequently copies a user-supplied string using memcpy without validating the size. • http://secunia.com/advisories/43099 http://secunia.com/advisories/43106 http://securitytracker.com/id?1024996 http://www.securityfocus.com/bid/45936 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110126_00 http://www.vupen.com/english/advisories/2011/0234 http://www.zerodayinitiative.com/advisories/ZDI-11-028 http://www.zerodayinitiative.com/advisories/ZDI-11-030 http://www.zerodayinitiative.com/advisories/ZDI-11-0 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •