symantec

Latest CVEs · RSS

• CVE-2026-19810 2026-10-13 · CVSS 5.4
  Symantec Endpoint Detection and Response (SEDR) Console, prior to 4.13, may be susceptible to a Cross-Site Scripting (XSS) vulnerability, which is a type of iss
• CVE-2026-15380 2026-07-17 · CVSS 5.1
  A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task scheduler logic chain — no network access, no memory corruption r
• CVE-2026-15379 2026-07-17 · CVSS 5.1
  The Altiris WMI provider exposes a class (AltirisAgent_Stream) that allows any local standard user to read the contents of any file accessible to the SYSTEM acc
• CVE-2026-11626 2026-06-10 · CVSS 5.4
  CleanWipe Removal Tool (macOS), prior to 16.0.0.65, may be susceptible to an Local Privilege Escalation vulnerability, which is a type of issue whereby an attac
• CVE-2026-11815 2026-06-10 · CVSS 5.3
  An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deserialize arbitrary objects. T
• CVE-2026-3991 2026-03-30 · CVSS 7.8
  Symantec Data Loss Prevention Windows Endpoint, prior to 25.1 MP1, 16.1 MP2, 16.0 RU2 HF9, 16.0 RU1 MP1 HF12, and 16.0 MP2 HF15, may be susceptible to a Elevati
• CVE-2026-3862 2026-03-10 · CVSS 4.6
  Cross-site Scripting (XSS) allows an attacker to submit specially crafted data to the application which is returned unaltered in the resulting web page.
• CVE-2025-13919 2026-01-28 · CVSS 4.4
  Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of
• CVE-2025-13918 2026-01-28 · CVSS 6.7
  Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a Elevation of Privilege vulnerability, which is a
• CVE-2025-13917 2026-01-28 · CVSS 7.0
  WSS Agent, prior to 9.8.5, may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereby an attacker may attempt to compromise
• CVE-2025-10847 2025-10-01 · CVSS 8.4
  DX Unified Infrastructure Management (Nimsoft/UIM) and below contains an improper ACL handling vulnerability in the robot (controller) component. A remote attac
• CVE-2025-9059 2025-09-11 · CVSS 8.8
  The Altiris Core Agent Updater package (AeXNSC.exe) is prone to an elevation of privileges vulnerability through DLL hijacking.
• CVE-2025-8661 2025-08-11 · CVSS 4.6
  A stored Cross-Site Scripting vulnerability (XSS) occurs when the server does not properly validate or encode the data entered by the user.
• CVE-2025-8660 2025-08-11 · CVSS 5.6
  Privilege escalation occurs when a user gets access to more resources or functionality than they are normally allowed.
• CVE-2025-24508 2025-07-07 · CVSS 6.4
  Extraction of Account Connectivity Credentials (ACCs) from the IT Management Agent secure storage
• CVE-2025-5333 2025-07-06 · CVSS 9.5
  Remote attackers can execute arbitrary code in the context of the vulnerable service process.
• CVE-2025-3599 2025-04-30 · CVSS 6.5
  Symantec Endpoint Protection Windows Agent, running an ERASER Engine prior to 119.1.7.8, may be susceptible to an Elevation of Privilege vulnerability, which ma
• CVE-2024-11035 2025-03-05 · CVSS 2.5
  Carbon Black Cloud Windows Sensor, prior to 4.0.3, may be susceptible to an Information Leak vulnerability, which s a type of issue whereby sensitive informatio
• CVE-2025-0893 2025-02-19 · CVSS 7.8
  Symantec Diagnostic Tool (SymDiag), prior to 3.0.79, may be susceptible to a Privilege Escalation vulnerability.
• CVE-2025-24507 2025-01-30 · CVSS 8.9
  This vulnerability allows appliance compromise at boot time.
• CVE-2025-24506 2025-01-30 · CVSS 5.3
  A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types.
• CVE-2025-24505 2025-01-30 · CVSS 8.8
  This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploading a specially craft
• CVE-2025-24504 2025-01-30 · CVSS 5.3
  An improper input validation the CSRF filter results in unsanitized user input written to the application logs.
• CVE-2025-24503 2025-01-30 · CVSS 9.3
  A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server.
• CVE-2025-24502 2025-01-30 · CVSS 5.3
  An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by s