Web Security
Vendor:
First CVE: Dec 31, 2004 · Active for 21 years
7
Total CVEs
More Total CVEs than 83% of tracked products
2.3
Avg CVEs / Year
Higher CVE frequency than 73% of tracked products
5.9
Avg CVSS
Higher Avg CVSS than 18% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Web Security over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 31, 2004
21 years ago
Most Recent CVE
Oct 5, 2007
6,867 days ago
CVE Severity & Scoring
Web Security7 CVEs
14%
43%
43%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local0 (0.0%)
Network0 (0.0%)
Unknown7 (100.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low0 (0.0%)
High0 (0.0%)
Unknown7 (100.0%)
User Interaction
None0 (0.0%)
Unknown7 (100.0%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None0 (0.0%)
Unknown7 (100.0%)
Top CVEs
Signals from CVEs in this product scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2005-0249HIGH Heap-based buffer overflow in the DEC2EXE module for Symantec AntiVirus Library allows remote attackers to execute arbitrary code via a UPX compressed file containing a negative vi | Feb 8, 2005 | 7.5 | 27 | NO | NO |
CVE-2007-3699HIGH The Decomposer component in multiple Symantec products allows remote attackers to cause a denial of service (infinite loop) via a certain value in the PACK_SIZE field of a RAR arch | Oct 5, 2007 | 9.3 | 26 | NO | NO |
CVE-2007-0447HIGH Heap-based buffer overflow in the Decomposer component in multiple Symantec products allows remote attackers to execute arbitrary code via multiple crafted CAB archives. | Oct 5, 2007 | 9.3 | 25 | NO | NO |
CVE-2004-2755MEDIUM Cross-site scripting (XSS) vulnerability in Symantec Web Security 2.5, 3.0.0, and 3.0.1 before build 62 allows remote attackers to inject arbitrary web script or HTML via the query | Dec 31, 2004 | 4.3 | 18 | NO | NO |
CVE-2007-0563MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in Symantec Web Security (SWS) before 3.0.1.85 allow remote attackers to inject arbitrary web script or HTML via unspecified vec | Jan 30, 2007 | 4.3 | 14 | NO | NO |
CVE-2007-0564MEDIUM The license registering interface in Symantec Web Security (SWS) before 3.0.1.85 allows attackers to cause a denial of service (CPU consumption) by submitting a large file. | Jan 30, 2007 | 4.0 | 14 | NO | NO |
Multiple Symantec AntiVirus products, including Norton AntiVirus 2005 11.0.0, Web Security Web Security 3.0.1.72, Mail Security for SMTP 4.0.5.66, AntiVirus Scan Engine 4.3.7.27, S | May 2, 2005 | 2.6 | 12 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (7 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (7 CVEs).
Media Mentions
Signals from CVEs in this product scope (7 CVEs).
Top CNAs Publishing CVEs For Web Security
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 5.0 | 2 | 9.3 | 4.9% | 0 | 0 |
| 3.0.1_build_3.01.74 | 2 | 9.3 | 4.9% | 0 | 0 |
| 3.0.1_build_3.01.72 | 2 | 9.3 | 4.9% | 0 | 0 |
| 3.0.1_build_3.01.70 | 2 | 9.3 | 4.9% | 0 | 0 |
| 3.0.1.76 | 2 | 9.3 | 4.9% | 0 | 0 |
| 3.0.1.72 | 2 | 3.5 | 1.8% | 0 | 0 |
| 3.0.1.70 | 2 | 9.3 | 4.9% | 0 | 0 |
| 3.01.68 | 5 | 6.9 | 6.3% | 0 | 0 |
| 3.01.67 | 5 | 6.9 | 6.3% | 0 | 0 |
| 3.01.63 | 5 | 6.9 | 6.3% | 0 | 0 |
| 3.01.62 | 5 | 6.9 | 6.3% | 0 | 0 |
| 3.01.61 | 5 | 6.9 | 6.3% | 0 | 0 |
| 3.01.60 | 5 | 6.9 | 6.3% | 0 | 0 |
| 3.01.59 | 5 | 6.9 | 6.3% | 0 | 0 |
| 3.0.1 | 3 | 7.6 | 3.9% | 0 | 0 |
| 3.0 | 3 | 7.6 | 3.9% | 0 | 0 |
| 2.5 | 3 | 7.6 | 3.9% | 0 | 0 |