Vulnerabilities > Symantec > Endpoint Protection Manager > High

DATE CVE VULNERABILITY TITLE RISK
2020-05-11 CVE-2020-5835 Race Condition vulnerability in Symantec Endpoint Protection Manager
Symantec Endpoint Protection Manager, prior to 14.3, has a race condition in client remote deployment which may result in an elevation of privilege on the remote machine.
local
high complexity
symantec CWE-362
7.0
2019-11-15 CVE-2019-12759 Unspecified vulnerability in Symantec Endpoint Protection Manager and Mail Security
Symantec Endpoint Protection Manager (SEPM) and Symantec Mail Security for MS Exchange (SMSMSE), prior to versions 14.2 RU2 and 7.5.x respectively, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
local
low complexity
symantec
7.8
2019-11-15 CVE-2018-18368 Improper Privilege Management vulnerability in Symantec Endpoint Protection Manager
Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU1, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
local
low complexity
symantec CWE-269
7.8
2019-04-25 CVE-2018-18367 Untrusted Search Path vulnerability in Symantec Endpoint Protection Manager
Symantec Endpoint Protection Manager (SEPM) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead.
local
low complexity
symantec CWE-426
7.8
2016-06-30 CVE-2016-3653 Cross-Site Request Forgery (CSRF) vulnerability in Symantec Endpoint Protection Manager 12.1.6
Multiple cross-site request forgery (CSRF) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allow remote authenticated users to hijack the authentication of arbitrary users.
network
low complexity
symantec CWE-352
8.0
2016-06-30 CVE-2016-3651 Information Exposure vulnerability in Symantec Endpoint Protection Manager 12.1.6
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover the PHP JSESSIONID value via unspecified vectors.
network
low complexity
symantec CWE-200
8.0
2016-06-30 CVE-2016-3650 7PK - Security Features vulnerability in Symantec Endpoint Protection Manager 12.1.6
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to discover credentials via a brute-force attack.
network
low complexity
symantec CWE-254
8.8
2016-06-30 CVE-2016-3648 7PK - Security Features vulnerability in Symantec Endpoint Protection Manager 12.1.6
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to bypass the Authentication Lock protection mechanism, and conduct brute-force password-guessing attacks against management-console accounts, by entering data into the authorization window.
network
low complexity
symantec CWE-254
8.8
2016-06-30 CVE-2016-3647 Unspecified vulnerability in Symantec Endpoint Protection Manager 12.1.6
Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, and trigger network traffic to arbitrary intranet hosts, via a crafted request.
network
low complexity
symantec
7.7
2016-03-18 CVE-2015-8154 Permissions, Privileges, and Access Controls vulnerability in Symantec Endpoint Protection Manager
The SysPlant.sys driver in the Application and Device Control (ADC) component in the client in Symantec Endpoint Protection (SEP) 12.1 before RU6-MP4 allows remote attackers to execute arbitrary code via a crafted HTML document, related to "RWX Permissions."
network
low complexity
symantec CWE-264
8.8