Broadcom Symantec Critical System Protection vulnerabilities

11 CVEs affecting Broadcom Symantec Critical System Protection, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-18374, published 2019-11-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-9225, published 2015-01-21. Medium severity, CVSS 4.0. EPSS: 9.2% chance of exploitation in the next 30 days. The ajaxswing webui in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x through 6.0 MP1 allows…
CVE-2015-8799, published 2016-06-08. High severity, CVSS 7.6. EPSS: 5.3% chance of exploitation in the next 30 days. Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for…
CVE-2014-9224, published 2015-01-21. Low severity, CVSS 3.5. EPSS: 4.6% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the ajaxswing webui in the Management Console server in the management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec…
CVE-2014-7289, published 2015-01-21. Medium severity, CVSS 6.5. EPSS: 4.6% chance of exploitation in the next 30 days. SQL injection vulnerability in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x before 6.0 MP1…
CVE-2014-3440, published 2015-01-21. High severity, CVSS 9.0. EPSS: 3.3% chance of exploitation in the next 30 days. The Agent Control Interface in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x before 6.0 MP1…
CVE-2015-8798, published 2016-06-08. High severity, CVSS 8.0. EPSS: 2.4% chance of exploitation in the next 30 days. Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for…
CVE-2013-5016, published 2014-05-08. High severity, CVSS 7.6. EPSS: 2.4% chance of exploitation in the next 30 days. Symantec Critical System Protection (SCSP) before 5.2.9, when installed on an unpatched Windows Server 2003 R2 platform, allows remote attackers to bypass policy settings via unspecified vectors.
CVE-2019-18374, published 2019-11-25. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. Symantec Critical System Protection (CSP), versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentication bypass vulnerability, which is a type of issue that can potentially allow a threat…
CVE-2014-9226, published 2015-01-21. High severity, CVSS 7.2. EPSS: 1.5% chance of exploitation in the next 30 days. The management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x through 6.0 MP1 allows local users to bypass…
CVE-2015-8157, published 2016-06-08. High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days. SQL injection vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for…

Latest

CVE-2015-8800, published 2016-06-08. High severity, CVSS 7.3. EPSS: 1.2% chance of exploitation in the next 30 days. Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical…