Vulnerabilities > Symantec > Critical
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2008-02-07 | CVE-2008-0457 | Improper Input Validation vulnerability in Symantec Backupexec System Recovery 7.0/7.01 Unrestricted file upload vulnerability in the FileUpload class running on the Symantec LiveState Apache Tomcat server, as used by Symantec Backup Exec System Recovery Manager 7.0 and 7.0.1, allows remote attackers to upload and execute arbitrary JSP files via unknown vectors. | 10.0 |
| 2007-11-10 | CVE-2007-5910 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products Stack-based buffer overflow in Autonomy (formerly Verity) KeyView Viewer, Filter, and Export SDK before 9.2.0.12, as used by ActivePDF DocConverter, wp6sr.dll in IBM Lotus Notes 8.0 and before 7.0.3, Symantec Mail Security, and other products, allows remote attackers to execute arbitrary code via a crafted WordPerfect (WPD) file. | 9.3 |
| 2007-11-10 | CVE-2007-5909 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products Multiple stack-based buffer overflows in Autonomy (formerly Verity) KeyView Viewer, Filter, and Export SDK before 9.2.0.12, as used by ActivePDF DocConverter, IBM Lotus Notes before 7.0.3, Symantec Mail Security, and other products, allow remote attackers to execute arbitrary code via a crafted (1) AG file to kpagrdr.dll, (2) AW file to awsr.dll, (3) DLL or (4) EXE file to exesr.dll, (5) DOC file to mwsr.dll, (6) MIF file to mifsr.dll, (7) SAM file to lasr.dll, or (8) RTF file to rtfsr.dll. | 9.3 |
| 2007-10-05 | CVE-2007-3699 | Remote vulnerability in Symantec AntiVirus Malformed CAB and RAR Compression The Decomposer component in multiple Symantec products allows remote attackers to cause a denial of service (infinite loop) via a certain value in the PACK_SIZE field of a RAR archive file header. | 9.3 |
| 2007-10-05 | CVE-2007-0447 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Symantec products Heap-based buffer overflow in the Decomposer component in multiple Symantec products allows remote attackers to execute arbitrary code via multiple crafted CAB archives. | 9.3 |
| 2007-09-27 | CVE-2007-5126 | Unspecified vulnerability in Symantec Veritas Backup Exec 11D Unspecified vulnerability in the client in Symantec Veritas Backup Exec for Windows Servers 11d has unknown impact and remote attack vectors. | 10.0 |
| 2007-08-18 | CVE-2007-4422 | Unspecified vulnerability in Symantec Enterprise Firewall 6 The login interface in Symantec Enterprise Firewall 6.x, when a VPN with pre-shared key (PSK) authentication is enabled, generates different responses depending on whether or not a username is valid, which allows remote attackers to enumerate valid usernames. | 9.3 |
| 2007-06-06 | CVE-2007-3095 | Authentication Bypass vulnerability in Symantec Client Security, Norton Antivirus and Reporting Server Unspecified vulnerability in Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec AntiVirus Corporate Edition (SAV CE) 10.1 and later, allows attackers to "disable the authentication system" and bypass authentication via unknown vectors. | 9.0 |
| 2007-06-06 | CVE-2007-2514 | Remote Buffer Overflow vulnerability in Multiple Vendor XFERWAN.EXE Filename Stack-based buffer overflow in XferWan.exe as used in multiple products including (1) Symantec Discovery 6.5, (2) Numara Asset Manager 8.0, and (3) Centennial UK Ltd Discovery 2006 Feature Pack, allows remote attackers to execute arbitrary code via a long request. | 9.3 |
| 2007-06-04 | CVE-2007-2279 | Permissions, Privileges, and Access Controls vulnerability in Symantec Veritas Storage Foundation 5.0 The Scheduler Service (VxSchedService.exe) in Symantec Storage Foundation for Windows 5.0 allows remote attackers to bypass authentication and execute arbitrary code via certain requests to the service socket that create (1) PreScript or (2) PostScript registry values under Veritas\VxSvc\CurrentVersion\Schedules specifying future command execution. | 9.3 |