deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-5839
Published: 2016-06-29
Description: WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://www.debian.org/security/2016/dsa-3639; http://www.securityfocus.com/bid/91364; http://www.securitytracker.com/id/1036163
CVE: CVE-2016-0322
Published: 2016-06-30
Description: Cross-site scripting (XSS) vulnerability in IBM Connections 4.0 through CR4, 4.5 through CR5, 5.0 through CR4, and 5.5 before CR1 allows remote authenticated users to inject arbitrary web script or HTML by uploading an HTML document.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LO88783; http://www-01.ibm.com/support/docview.wss?uid=swg21982611; http://www-01.ibm.com/support/docview.wss?uid=swg1LO88783
CVE: CVE-2016-0349
Published: 2016-06-30
Description: IBM Business Process Manager 8.5.6 through 8.5.6.2 and 8.5.7 before 8.5.7.CF201606 allows remote authenticated users to bypass intended access restrictions and update process-instance variables via a REST API call.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg1JR55701; http://www-01.ibm.com/support/docview.wss?uid=swg21981094; http://www.securitytracker.com/id/1036185
CVE: CVE-2016-2141
Published: 2016-06-30
Description: It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.
CVSS Score: 9.8 (CRITICAL)
References: http://rhn.redhat.com/errata/RHSA-2016-1435.html; http://rhn.redhat.com/errata/RHSA-2016-1439.html; http://rhn.redhat.com/errata/RHSA-2016-2035.html
CVE: CVE-2016-4057
Published: 2016-06-30
Description: Huawei FusionCompute before V100R005C10SPC700 allows remote authenticated users to cause a denial of service (resource consumption) via a large number of crafted packets.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160330-01-fusioncompute-en; http://www.securityfocus.com/bid/85738; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160330-01-fusioncompute-en
CVE: CVE-2016-4086
Published: 2016-06-30
Description: Huawei HiSuite (In China) before 4.0.4.301 and (Out of China) before 4.0.4.204_ove allows remote attackers to install arbitrary apps on a connected phone via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160422-01-hisuite-en; http://www.securityfocus.com/bid/92622; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160422-01-hisuite-en
CVE: CVE-2016-4474
Published: 2016-06-30
Description: The image build process for the overcloud images in Red Hat OpenStack Platform 8.0 (Liberty) director and Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) director (aka overcloud-full) use a default root password of ROOTPW, which allows attackers to gain access via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200, CWE-254
References: http://rhn.redhat.com/errata/RHSA-2016-1222.html; https://access.redhat.com/security/vulnerabilities/2359821; https://rhn.redhat.com/errata/RHSA-2016-1223.html
CVE: CVE-2016-5230
Published: 2016-06-30
Description: Huawei Mate8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to bypass permission checks and control partial module functions via a crafted app.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160520-01-smartphone-en; http://www.securityfocus.com/bid/91554; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160520-01-smartphone-en
CVE: CVE-2016-5231
Published: 2016-06-30
Description: Huawei Mate8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to bypass permission checks and delete user data via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160520-01-smartphone-en; http://www.securityfocus.com/bid/91556; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160520-01-smartphone-en
CVE: CVE-2016-5232
Published: 2016-06-30
Description: Buffer overflow in Huawei Mate8 NXT-AL before NXT-AL10C00B182, NXT-CL before NXT-CL00C92B182, NXT-DL before NXT-DL00C17B182, and NXT-TL before NXT-TL00C01B182 allows attackers to cause a denial of service (system crash) via a crafted app.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160520-01-smartphone-en; http://www.securityfocus.com/bid/91555; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160520-01-smartphone-en
CVE: CVE-2016-5248
Published: 2016-06-30
Description: The StopProxy command in LSC.Services.SystemService in Lenovo Solution Center before 3.3.003 allows local users to terminate arbitrary processes via the PID argument.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: https://support.lenovo.com/us/en/product_security/len_7814; https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-012/?fid=8073; https://support.lenovo.com/us/en/product_security/len_7814
CVE: CVE-2016-5249
Published: 2016-06-30
Description: Lenovo Solution Center (LSC) before 3.3.003 allows local users to execute arbitrary code with LocalSystem privileges via vectors involving the LSC.Services.SystemService StartProxy command with a named pipe created in advance and crafted .NET assembly.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: https://support.lenovo.com/us/en/product_security/len_7814; https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-012/?fid=8073; https://support.lenovo.com/us/en/product_security/len_7814
CVE: CVE-2016-5368
Published: 2016-06-30
Description: Memory leak in Huawei AR3200 before V200R007C00SPC900 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted Multiprotocol Label Switching (MPLS) packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160608-01-mpls-en; http://www.securityfocus.com/bid/91557; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160608-01-mpls-en
CVE: CVE-2016-5729
Published: 2016-06-30
Description: Lenovo BIOS EFI Driver allows local administrators to execute arbitrary code with System Management Mode (SMM) privileges via unspecified vectors.
CVSS Score: 8.2 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/91536; https://support.lenovo.com/us/en/product_security/len_4901; http://www.securityfocus.com/bid/91536
CVE: CVE-2016-5840
Published: 2016-06-30
Description: hotfix_upload.cgi in Trend Micro Deep Discovery Inspector (DDI) 3.7, 3.8 SP1 (3.81), and 3.8 SP2 (3.82) allows remote administrators to execute arbitrary code via shell metacharacters in the filename parameter of the Content-Disposition header.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://esupport.trendmicro.com/solution/en-US/1114281.aspx; http://jvn.jp/en/jp/JVN55428526/index.html; http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000103.html
CVE: CVE-2015-8899
Published: 2016-06-30
Description: Dnsmasq before 2.76 allows remote servers to cause a denial of service (crash) via a reply with an empty DNS address that has an (1) A or (2) AAAA record defined locally.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2016q2/010479.html; http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2016q2/010505.html; http://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=41a8d9e99be9f2cc8b02051dd322cb45e0faac87
CVE: CVE-2016-3189
Published: 2016-06-30
Description: Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html; http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html; http://www.openwall.com/lists/oss-security/2016/06/20/1
CVE: CVE-2016-4309
Published: 2016-06-30
Description: Session fixation vulnerability in Symphony CMS 2.6.7, when session.use_only_cookies is disabled, allows remote attackers to hijack web sessions via the PHPSESSID parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: http://hyp3rlinx.altervista.org/advisories/SYMPHONY-CMS-SESSION-FIXATION.txt; http://packetstormsecurity.com/files/137551/Symphony-CMS-2.6.7-Session-Fixation.html; http://www.securityfocus.com/archive/1/538714/100/0/threaded
CVE: CVE-2016-4472
Published: 2016-06-30
Description: The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91528; http://www.ubuntu.com/usn/USN-3013-1; https://bugzilla.redhat.com/show_bug.cgi?id=1344251
CVE: CVE-2016-4803
Published: 2016-06-30
Description: CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email headers via CRLF sequences in the subject.
CVSS Score: 7.5 (HIGH)
References: http://seclists.org/fulldisclosure/2016/May/69; http://www.securityfocus.com/bid/91529; https://dotcms.com/docs/latest/change-log#release-3.3.2
CVE: CVE-2016-4971
Published: 2016-06-30
Description: GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.
CVSS Score: 8.8 (HIGH)
References: http://git.savannah.gnu.org/cgit/wget.git/commit/?id=e996e322ffd42aaa051602da182d03178d0f13e1; http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html; http://lists.opensuse.org/opensuse-updates/2016-08/msg00043.html
CVE: CVE-2016-5020
Published: 2016-06-30
Description: F5 BIG-IP before 12.0.0 HF3 allows remote authenticated users to modify the account configuration of users with the Resource Administration role and gain privilege via a crafted external Extended Application Verification (EAV) monitor script.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/91532; http://www.securitytracker.com/id/1036131; https://support.f5.com/kb/en-us/solutions/public/k/00/sol00265182.html
CVE: CVE-2016-5301
Published: 2016-06-30
Description: The parse_chunk_header function in libtorrent before 1.1.1 allows remote attackers to cause a denial of service (crash) via a crafted (1) HTTP response or possibly a (2) UPnP broadcast.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2016-06/msg00079.html; http://lists.opensuse.org/opensuse-updates/2016-06/msg00103.html; http://lists.opensuse.org/opensuse-updates/2016-09/msg00043.html
CVE: CVE-2016-5360
Published: 2016-06-30
Description: HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memory access and crash) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://git.haproxy.org/?p=haproxy-1.6.git%3Ba=commit%3Bh=60f01f8c89e4fb2723d5a9f2046286e699567e0b; http://www.openwall.com/lists/oss-security/2016/06/09/5; http://www.openwall.com/lists/oss-security/2016/06/09/6
CVE: CVE-2015-8801
Published: 2016-06-30
Description: Race condition in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6 MP5 allows local users to bypass intended restrictions on USB file transfer by conducting filesystem operations before the SEP device manager recognizes a new USB device.
CVSS Score: 2.9 (LOW)
CWE: CWE-254, CWE-284
References: http://www.securityfocus.com/bid/91446; http://www.securitytracker.com/id/1036196; https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01
CVE: CVE-2016-2207
Published: 2016-06-30
Description: The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory access violation) via a crafted RAR file that is mishandled during decompression.
CVSS Score: 8.4 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/91434; http://www.securitytracker.com/id/1036198; http://www.securitytracker.com/id/1036199
CVE: CVE-2016-2209
Published: 2016-06-30
Description: Buffer overflow in Dec2SS.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code via a crafted file.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91436; http://www.securitytracker.com/id/1036198; http://www.securitytracker.com/id/1036199
CVE: CVE-2016-2210
Published: 2016-06-30
Description: Buffer overflow in Dec2LHA.dll in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code via a crafted file.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91437; http://www.securitytracker.com/id/1036198; http://www.securitytracker.com/id/1036199
CVE: CVE-2016-2211
Published: 2016-06-30
Description: The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted CAB file that is mishandled during decompression.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/91438; http://www.securitytracker.com/id/1036198; http://www.securitytracker.com/id/1036199
CVE: CVE-2016-3644
Published: 2016-06-30
Description: The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via modified MIME data in a message.
CVSS Score: 8.4 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/91431; http://www.securitytracker.com/id/1036198; http://www.securitytracker.com/id/1036199
CVE: CVE-2016-3645
Published: 2016-06-30
Description: Integer overflow in the TNEF unpacker in the AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to have an unspecified impact via crafted TNEF data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-189
References: http://www.securityfocus.com/bid/91439; http://www.securitytracker.com/id/1036198; http://www.securitytracker.com/id/1036199
CVE: CVE-2016-3646
Published: 2016-06-30
Description: The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec Data Center Security:Server (SDCS:S) 6.x through 6.6 MP1; Symantec Web Gateway; Symantec Endpoint Protection (SEP) before 12.1 RU6 MP5; Symantec Endpoint Protection (SEP) for Mac; Symantec Endpoint Protection (SEP) for Linux before 12.1 RU6 MP5; Symantec Protection Engine (SPE) before 7.0.5 HF01, 7.5.x before 7.5.3 HF03, 7.5.4 before HF01, and 7.8.0 before HF01; Symantec Protection for SharePoint Servers (SPSS) 6.0.3 through 6.0.5 before 6.0.5 HF 1.5 and 6.0.6 before HF 1.6; Symantec Mail Security for Microsoft Exchange (SMSMSE) before 7.0_3966002 HF1.1 and 7.5.x before 7.5_3966008 VHF1.2; Symantec Mail Security for Domino (SMSDOM) before 8.0.9 HF1.1 and 8.1.x before 8.1.3 HF1.2; CSAPI before 10.0.4 HF01; Symantec Message Gateway (SMG) before 10.6.1-4; Symantec Message Gateway for Service Providers (SMG-SP) 10.5 before patch 254 and 10.6 before patch 253; Norton AntiVirus, Norton Security, Norton Internet Security, and Norton 360 before NGC 22.7; Norton Security for Mac before 13.0.2; Norton Power Eraser (NPE) before 5.1; and Norton Bootable Removal Tool (NBRT) before 2016.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory access violation) via a crafted ZIP archive that is mishandled during decompression.
CVSS Score: 8.4 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/91435; http://www.securitytracker.com/id/1036198; http://www.securitytracker.com/id/1036199
CVE: CVE-2016-3647
Published: 2016-06-30
Description: Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, and trigger network traffic to arbitrary intranet hosts, via a crafted request.
CVSS Score: 7.7 (HIGH)
References: http://www.securityfocus.com/bid/91433; http://www.securitytracker.com/id/1036196; https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01