CVE-2009-1428: Symantec Antivirus

Medium severity, CVSS 4.3. EPSS: 2.3% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in ccLgView.exe in the Symantec Log Viewer, as used in Symantec AntiVirus (SAV) before 10.1 MR8, Symantec Endpoint Protection (SEP) 11.0 before 11.0 MR1, Norton 360 1.0, and Norton Internet Security 2005 through 2008, allow remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, related to "two parsing errors."

Affected products

• Symantec Antivirus: up to and including 10.1; version 10.0 only; version 10.0.1 only; version 10.0.1.1 only; version 10.0.2 only; version 10.0.2.1 only; …
• Symantec Endpoint Protection: version 11.0 only
• Symantec Norton 360: version 1.0 only
• Symantec Norton Internet Security: version 2005 only; version 2005_contains_nav_11.0.0 only; version 2006 only; version 2007 only; version 2008 only

Published 2009-04-29. Last modified 2026-06-16.