CVE-2016-3652 EXPLOIT
5.4
MEDIUM · CVSS 3.0 · EPSS 2.6% (pctl 85)
Patch early
A public exploit exists.
Description
Multiple cross-site scripting (XSS) vulnerabilities in management scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Scoring
| CVSS | 5.4 (MEDIUM, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| EPSS | 2.55% — more likely to be exploited than 85% of all CVEs |
| Weakness | CWE-79 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2016-06-30 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| symantec | endpoint protection manager |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Symantec Endpoint Protection Manager 12.1 - Multiple Vulnerabilities | 2016-06-29 |
References
- http://www.securityfocus.com/bid/91444
- http://www.securitytracker.com/id/1036196
- https://www.exploit-db.com/exploits/40041/
- https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01
- http://www.securityfocus.com/bid/91444
- http://www.securitytracker.com/id/1036196
- https://www.exploit-db.com/exploits/40041/
- https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160628_01
→ the Explorer · watch your stack · NVD