CVE-2018-18362

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Norton Password Manager for Android (formerly Norton Identity Safe) may be susceptible to a cross site scripting (XSS) exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Symantec Corporation	Norton Password Manager	Prior to 6.1.0.1045

References

http://www.securityfocus.com/bid/106055Third Party Advisory, VDB Entry
https://support.symantec.com/en_US/article.SYMSA1470.htmlVendor Advisory
http://www.securityfocus.com/bid/106055Third Party Advisory, VDB Entry
https://support.symantec.com/en_US/article.SYMSA1470.htmlVendor Advisory

Timeline

Published: Dec 6, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-183636.2Norton App Lock prior to 1.4.0.445 can be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to c CVE-2018-183647.3Symantec Ghost Solution Suite (GSS) versions prior to 3.3 RU1 may be susceptible to a DLL hijacking vulnerability, which is a type of issue CVE-2018-183657.5Norton Password Manager may be susceptible to an address spoofing issue. This type of issue may allow an attacker to disguise their origin I CVE-2018-183666.5Symantec Norton Security prior to 22.16.3, SEP (Windows client) prior to and including 12.1 RU6 MP9, and prior to 14.2 RU1, SEP SBE prior to CVE-2018-183677.8Symantec Endpoint Protection Manager (SEPM) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a DLL Preloading CVE-2018-183687.8Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU1, may be susceptible to a privilege escalation vulnerability, which is a type CVE-2018-183697.8Norton Security (Windows client) prior to 22.16.3 and SEP SBE (Windows client) prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22 & SEP-12.1.CVE-2018-183706.1The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web brow CVE-2018-183716.5The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web brow CVE-2018-183726.1A Stored XSS vulnerability has been discovered in KAASoft Library CMS - Powerful Book Management System 2.1.1 via the /admin/book/create/ ti CVE-2018-183735.4In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file uplo CVE-2018-183745.4XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.