CVE-2015-8157

High

Published: 08/06/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CVE-2015-8157 is a SQL injection vulnerability in the Management Server of Symantec Embedded Security products. It allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Risk Assessment

This vulnerability may lead to unauthorized access and manipulation of data within systems, posing a serious threat to the integrity and confidentiality of information in the organization.

Recommendation

It is recommended to upgrade to the latest versions of the products that address this vulnerability and to implement additional security measures to restrict access to the management server.

Other vulnerabilities in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, SES:CSP 6.5.0 before MP1, SCSP before 5.2.9 MP6, DCS:SA 6.x before 6.5 MP1 and 6.6 before MP1

CVE-2015-8798High
CVE-2015-8798 describes a directory traversal vulnerability in the Management Server of Symantec Embedded Security products. It allows remote authenticated users to execute arbitrary code via unspecified vectors.

Original NVD description (English source)

SQL injection vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.