Symantec Protection Engine, prior to 9.1.0, may be susceptible to a Hash Leak vulnerability.
Max CVSS
6.8
EPSS Score
0.05%
Published
2023-09-27
Updated
2023-09-28
An authenticated user can see and modify the value for ‘next’ query parameter in Symantec Identity Portal 14.4
Max CVSS
5.4
EPSS Score
0.05%
Published
2023-09-19
Updated
2023-09-21
An authenticated user can embed malicious content with XSS into the admin group policy page.
Max CVSS
5.4
EPSS Score
0.05%
Published
2022-12-09
Updated
2023-04-10
An authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be executed on the annotations page (Annotation Text Column).
Max CVSS
5.4
EPSS Score
0.05%
Published
2022-12-09
Updated
2023-03-01
Symantec Endpoint Protection Manager, prior to 14.3, may be susceptible to a directory traversal attack that could allow a remote actor to determine the size of files in the directory.
Max CVSS
5.3
EPSS Score
0.07%
Published
2020-05-11
Updated
2020-05-14
Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respectively, may be susceptible to an out of bounds vulnerability, which is a type of issue that results in an existing application reading memory outside of the bounds of the memory that had been allocated to the program.
Max CVSS
5.5
EPSS Score
0.05%
Published
2020-02-11
Updated
2021-07-21
Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respectively, may be susceptible to an arbitrary file write vulnerability, which is a type of issue whereby an attacker is able to overwrite existing files on the resident system without proper privileges.
Max CVSS
5.5
EPSS Score
0.20%
Published
2020-02-11
Updated
2021-07-21
Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respectively, may be susceptible to a denial of service vulnerability, which is a type of issue whereby a threat actor attempts to tie up the resources of a resident application, thereby making certain functions unavailable.
Max CVSS
5.5
EPSS Score
0.16%
Published
2020-02-11
Updated
2020-02-14
Symantec Endpoint Detection and Response (SEDR), prior to 4.3.0, may be susceptible to a cross site scripting (XSS) issue. XSS is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. An XSS vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy.
Max CVSS
6.1
EPSS Score
0.10%
Published
2020-01-13
Updated
2023-01-31
Symantec Industrial Control System Protection (ICSP), versions 6.x.x, may be susceptible to an unauthorized access issue that could potentially allow a threat actor to create or modify application user accounts without proper authentication.
Max CVSS
6.5
EPSS Score
0.06%
Published
2019-12-09
Updated
2019-12-17
A CSRF token disclosure vulnerability allows a remote attacker, with access to an authenticated Management Center (MC) user's web browser history or a network device that intercepts/logs traffic to MC, to obtain CSRF tokens and use them to perform CSRF attacks against MC.
Max CVSS
5.9
EPSS Score
0.08%
Published
2020-04-10
Updated
2021-07-21
Norton App Lock, prior to 1.4.0.503, may be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to circumvent the app to prevent it from locking other apps on the device, thereby allowing the individual to gain access.
Max CVSS
5.6
EPSS Score
0.05%
Published
2019-11-18
Updated
2019-11-20
Norton Password Manager, prior to 6.5.0.2104, may be susceptible to an information disclosure issue, which is a type of vulnerability whereby there is an unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information.
Max CVSS
5.5
EPSS Score
0.05%
Published
2019-09-17
Updated
2021-07-21
The Symantec SONAR component, prior to 12.0.2, may be susceptible to a tamper protection bypass vulnerability which could potentially allow an attacker to circumvent the existing tamper protection in use on the resident system.
Max CVSS
6.1
EPSS Score
0.05%
Published
2019-11-01
Updated
2019-11-07
Symantec AV Engine, prior to 13.0.9r17, may be susceptible to an arbitrary file deletion issue, which is a type of vulnerability that could allow an attacker to delete files on the resident system without elevated privileges.
Max CVSS
5.5
EPSS Score
0.05%
Published
2019-05-08
Updated
2020-08-24
An information disclosure vulnerability in the Management Center (MC) REST API 2.0, 2.1, and 2.2 prior to 2.2.2.1 allows a malicious authenticated user to obtain passwords for external backup and CPL policy import servers that they might not otherwise be authorized to access.
Max CVSS
6.5
EPSS Score
0.06%
Published
2019-08-30
Updated
2021-07-21
Symantec VIP Enterprise Gateway (all versions) may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy.
Max CVSS
6.1
EPSS Score
0.09%
Published
2019-04-09
Updated
2019-04-10
Symantec Norton Security prior to 22.16.3, SEP (Windows client) prior to and including 12.1 RU6 MP9, and prior to 14.2 RU1, SEP SBE prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22, SEP-12.1.7484.7002 and SEP Cloud prior to 22.16.3 may be susceptible to a kernel memory disclosure, which is a type of issue where a specially crafted IRP request can cause the driver to return uninitialized memory.
Max CVSS
6.5
EPSS Score
0.05%
Published
2019-04-25
Updated
2020-08-24
Norton Password Manager for Android (formerly Norton Identity Safe) may be susceptible to a cross site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy.
Max CVSS
6.1
EPSS Score
0.08%
Published
2018-12-06
Updated
2019-01-02
Symantec Web Isolation (WI) 1.11 prior to 1.11.21 is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote attacker can target end users protected by WI with social engineering attacks using crafted URLs for legitimate web sites. A successful attack allows injecting malicious JavaScript code into the website's rendered copy running inside the end user's web browser. It does not allow injecting code into the real (isolated) copy of the website running on the WI Threat Isolation Engine.
Max CVSS
6.1
EPSS Score
0.18%
Published
2018-10-22
Updated
2018-12-06
SEP (Mac client) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a CSV/DDE injection (also known as formula injection) vulnerability, which is a type of issue whereby an application or website allows untrusted input into CSV files.
Max CVSS
6.8
EPSS Score
0.08%
Published
2019-04-25
Updated
2020-08-24
The Symantec Security Analytics (SA) 7.x prior to 7.3.4 Web UI is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote attacker with knowledge of the SA web UI hostname or IP address can craft a malicious URL for the SA web UI and target SA web UI users with phishing attacks or other social engineering techniques. A successful attack allows injecting malicious JavaScript code into the SA web UI client application.
Max CVSS
6.1
EPSS Score
0.21%
Published
2018-11-27
Updated
2019-02-11
The Norton Identity Safe product prior to 5.3.0.976 may be susceptible to a privilege escalation issue via a hard coded IV, which is a type of vulnerability that can potentially increase the likelihood of encrypted data being recovered without adequate credentials.
Max CVSS
5.9
EPSS Score
0.11%
Published
2018-08-29
Updated
2020-07-15
Norton prior to 22.15; Symantec Endpoint Protection (SEP) prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Edition (SEP SBE) prior to NIS-22.15.1.8 & SEP-12.1.7454.7000; and Symantec Endpoint Protection Cloud (SEP Cloud) prior to 22.15.1 may be susceptible to an AV bypass issue, which is a type of exploit that works to circumvent one of the virus detection engines to avoid a specific type of virus protection. One of the antivirus engines depends on a signature pattern from a database to identify malicious files and viruses; the antivirus bypass exploit looks to alter the file being scanned so it is not detected.
Max CVSS
6.8
EPSS Score
0.08%
Published
2018-11-29
Updated
2019-10-03
Symantec Endpoint Protection prior to 14 RU1 MP1 or 12.1 RU6 MP10 may be susceptible to a race condition (or race hazard). This type of issue occurs in software where the output is dependent on the sequence or timing of other uncontrollable events.
Max CVSS
5.3
EPSS Score
0.12%
Published
2018-06-20
Updated
2018-08-11
169 vulnerabilities found
1 2 3 4 5 6 7
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!