← Vulnerability feed

Vulnerability record · CVE-2015-8157 · published 8 June 2016

CVE-2015-8157: Broadcom symantec critical system protection sql injection vulnerability

Broadcom · Symantec Critical System Protection

SQL injection vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

8.8 CVSS 3.1 High EPSS 1.5% · top 26.7% CWE-89 · SQL injection
8.8CVSS 3.1 base score, v2 6.5
1.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
5Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

SQL injection vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/90889 Third Party AdvisoryVDB Entry
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=& Technical DescriptionVendor Advisory
http://www.securityfocus.com/bid/90889 Third Party AdvisoryVDB Entry
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=& Technical DescriptionVendor Advisory

Track CVE-2015-8157 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-18374Broadcom symantec critical system protection improper authentication vulnerabilitySymantec Critical System Protection (CSP), versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentication bypass vulnerability, which is a …EPSS 1.7%9.0CVE-2014-3440Broadcom symantec critical system protection improper input validation vulnerabilityThe Agent Control Interface in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and Symantec Data Center Security…EPSS 3.3%8.8CVE-2024-23617Broadcom symantec data center security server memory buffer overflow vulnerabilityA buffer overflow vulnerability exists in Symantec Data Loss Prevention version 14.0.2 and before. A remote, unauthenticated attacker can exploit thi…EPSS 1.7%8.0CVE-2015-8798Broadcom symantec critical system protection path traversal vulnerabilityDirectory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, …EPSS 2.4%7.6CVE-2015-8799Broadcom symantec critical system protection path traversal vulnerabilityDirectory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, …EPSS 5.3%7.6CVE-2013-5016Broadcom symantec critical system protection permissions and access controls vulnerabilitySymantec Critical System Protection (SCSP) before 5.2.9, when installed on an unpatched Windows Server 2003 R2 platform, allows remote attackers to b…EPSS 2.4%7.3CVE-2015-8800Broadcom symantec critical system protection injection vulnerabilitySymantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers …EPSS 1.2%7.2CVE-2014-9226Broadcom symantec critical system protection permissions and access controls vulnerabilityThe management server in Symantec Critical System Protection (SCSP) 5.2.9 through MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.…EPSS 1.5%

Source: NIST National Vulnerability Database (record CVE-2015-8157), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.