CVE-2018-12246

Symantec Web Isolation (WI) 1.11 prior to 1.11.21 is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote attacker can target end users protected by WI with social engineering attacks using crafted URLs for legitimate web sites. A successful attack allows injecting malicious JavaScript code into the website's rendered copy running inside the end user's web browser. It does not allow injecting code into the real (isolated) copy of the website running on the WI Threat Isolation Engine.

• CWE-79

• http://www.securityfocus.com/bid/105581Third Party Advisory, VDB Entry
• https://support.symantec.com/content/unifiedweb/en_US/article.SYMSA1464.htmlVendor Advisory
• http://www.securityfocus.com/bid/105581Third Party Advisory, VDB Entry
• https://support.symantec.com/content/unifiedweb/en_US/article.SYMSA1464.htmlVendor Advisory

Published

Oct 22, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12240The Norton Identity Safe product prior to 5.3.0.976 may be s…5.9
• CVE-2018-12241The Symantec Security Analytics (SA) 7.x prior to 7.3.4 Web …
• CVE-2018-12242The Symantec Messaging Gateway product prior to 10.6.6 may b…
• CVE-2018-12243The Symantec Messaging Gateway product prior to 10.6.6 may b…
• CVE-2018-12244SEP (Mac client) prior to and including 12.1 RU6 MP9 and pri…
• CVE-2018-12245Symantec Endpoint Protection prior to 14.2 MP1 may be suscep…
• CVE-2018-12247An issue was discovered in mruby 1.4.1. There is a NULL poin…
• CVE-2018-12248An issue was discovered in mruby 1.4.1. There is a heap-base…
• CVE-2018-12249An issue was discovered in mruby 1.4.1. There is a NULL poin…7.5
• CVE-2018-1225Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-12250An issue was discovered in Elite CMS Pro 2.01. In /admin/add…
• CVE-2018-12254router.php in the Harmis Ek rishta (aka ek-rishta) 2.10 comp…