CVE Feed

    Dashboard / CVE / CVE-2015-8799

    CVE-2015-8799

    Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allows remote authenticated users to write update-package data to arbitrary agent locations via unspecified vectors.

    Published:Jun 8, 2016
    Last Modified:Apr 12, 2025
    EPS:Jun 8, 2016
    EPSS Score:0.01625
    CVSS Score:7.6

    Affected Products

    Vendor
    Broadcom
    Product
    Symantec Critical System Protection
    Vendor
    Broadcom
    Product
    Symantec Data Center Security Server
    Vendor
    Broadcom
    Product
    Symantec Data Center Security Server And Agents
    Vendor
    Broadcom
    Product
    Symantec Embedded Security Critical System Protection
    Vendor
    Broadcom
    Product
    Symantec Embedded Security Critical System Protection For Controllers And Devices

    Exploits

    No exploit reference

    Related CVEs

    CVE-2019-18374 (CVSS 9.8) — Symantec Critical System Protection (CSP), versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentic…
    CVE-2015-8157 (CVSS 8.8) — SQL injection vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection…
    CVE-2015-8798 (CVSS 8) — Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Prot…
    CVE-2015-8800 (CVSS 7.3) — Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Crit…
    CVE-2014-9226 (CVSS 7.2) — The management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center…
    CVE-2014-9224 (CVSS 3.5) — Cross-site scripting (XSS) vulnerability in the ajaxswing webui in the Management Console server in the manage…
    CVE-2014-3440 (CVSS 9) — The Agent Control Interface in the management server in Symantec Critical System Protection (SCSP) 5.2.9 befor…
    CVE-2014-7289 (CVSS 6.5) — SQL injection vulnerability in the management server in Symantec Critical System Protection (SCSP) 5.2.9 befor…
    CVE-2014-9225 (CVSS 4) — The ajaxswing webui in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 a…
    CVE-2013-5016 (CVSS 7.6) — Symantec Critical System Protection (SCSP) before 5.2.9, when installed on an unpatched Windows Server 2003 R2…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High