Symantec
520 CVEs across 275 Symantec products. Browse Symantec vulnerabilities, severities, and proof-of-concept exploits.
Symantec products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-8501 | High | 7.8 | 2026-06-01 | Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the PCTCoreDriver WDM d… |
CVE-2025-3599 | Medium | 6.5 | 2025-04-30 | Symantec Endpoint Protection Windows Agent, running an ERASER Engine prior to 119.1.7.8, may be susceptible to an Elevation of Privilege vulnerability, which m… |
CVE-2024-11035 | Low | 2.5 | 2025-03-05 | Carbon Black Cloud Windows Sensor, prior to 4.0.3, may be susceptible to an Information Leak vulnerability, which s a type of issue whereby sensitive informati… |
CVE-2025-0893 | High | 7.8 | 2025-02-19 | Symantec Diagnostic Tool (SymDiag), prior to 3.0.79, may be susceptible to a Privilege Escalation vulnerability. |
CVE-2024-23617 | Critical | 9.6 | 2024-01-26 | A buffer overflow vulnerability exists in Symantec Data Loss Prevention version 14.0.2 and before. A remote, unauthenticated attacker can exploit this vulnerab… |
CVE-2024-23616 | Critical | 10.0 | 2024-01-26 | A buffer overflow vulnerability exists in Symantec Server Management Suite version 7.9 and before. A remote, anonymous attacker can exploit this vulnerability… |
CVE-2024-23615 | Critical | 10.0 | 2024-01-26 | A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 10.5 and before. A remote, anonymous attacker can exploit this vulnerability to a… |
CVE-2024-23614 | Critical | 10.0 | 2024-01-26 | A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 9.5 and before. A remote, anonymous attacker can exploit this vulnerability to ac… |
CVE-2024-23613 | Critical | 10.0 | 2024-01-26 | A buffer overflow vulnerability exists in Symantec Deployment Solution version 7.9 when parsing UpdateComputer tokens. A remote, anonymous attacker can exploit… |
CVE-2023-23958 | Medium | 6.8 | 2023-09-27 | Symantec Protection Engine, prior to 9.1.0, may be susceptible to a Hash Leak vulnerability. |
CVE-2023-23957 | Medium | 5.4 | 2023-09-19 | An authenticated user can see and modify the value for ‘next’ query parameter in Symantec Identity Portal 14.4 |
CVE-2022-25630 | Medium | 5.4 | 2022-12-09 | An authenticated user can embed malicious content with XSS into the admin group policy page. |
CVE-2022-25629 | Medium | 5.4 | 2022-12-09 | An authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be executed on the annotation… |
CVE-2022-37015 | Critical | 9.8 | 2022-11-08 | Symantec Endpoint Detection and Response (SEDR) Appliance, prior to 4.7.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue… |
CVE-2022-25623 | High | 7.8 | 2022-03-04 | The Symantec Management Agent is susceptible to a privilege escalation vulnerability. A low privilege local account can be elevated to the SYSTEM level through… |
CVE-2021-30642 | Critical | 9.8 | 2021-04-27 | An input validation flaw in the Symantec Security Analytics web UI 7.2 prior 7.2.7, 8.1, prior to 8.1.3-NSR3, 8.2, prior to 8.2.1-NSR2 or 8.2.2 allows a remote… |
CVE-2020-12593 | High | 7.5 | 2020-11-18 | Symantec Endpoint Detection & Response, prior to 4.5, may be susceptible to an information disclosure issue, which is a type of vulnerability that could potent… |
CVE-2020-5839 | High | 7.5 | 2020-07-08 | Symantec Endpoint Detection And Response, prior to 4.4, may be susceptible to an information disclosure issue, which is a type of vulnerability that could pote… |
CVE-2020-5838 | Medium | 4.8 | 2020-05-13 | Symantec IT Analytics, prior to 2.9.1, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can potentially enable attacke… |
CVE-2020-5837 | High | 7.8 | 2020-05-11 | Symantec Endpoint Protection, prior to 14.3, may not respect file permissions when writing to log files that are replaced by symbolic links, which can lead to… |
CVE-2020-5836 | High | 7.8 | 2020-05-11 | Symantec Endpoint Protection, prior to 14.3, can potentially reset the ACLs on a file as a limited user while Symantec Endpoint Protection's Tamper Protection… |
CVE-2020-5835 | High | 7.0 | 2020-05-11 | Symantec Endpoint Protection Manager, prior to 14.3, has a race condition in client remote deployment which may result in an elevation of privilege on the remo… |
CVE-2020-5834 | Medium | 5.3 | 2020-05-11 | Symantec Endpoint Protection Manager, prior to 14.3, may be susceptible to a directory traversal attack that could allow a remote actor to determine the size o… |
CVE-2020-5833 | Low | 3.3 | 2020-05-11 | Symantec Endpoint Protection Manager, prior to 14.3, may be susceptible to an out of bounds vulnerability, which is a type of issue that results in an existing… |
CVE-2019-18376 | Medium | 5.9 | 2020-04-10 | A CSRF token disclosure vulnerability allows a remote attacker, with access to an authenticated Management Center (MC) user's web browser history or a network… |
CVE-2020-5832 | High | 7.8 | 2020-04-06 | Symantec Data Center Security Manager Component, prior to 6.8.2 (aka 6.8 MP2), may be susceptible to a privilege escalation vulnerability, which is a type of i… |
CVE-2012-6277 | High | 7.8 | 2020-02-21 | Multiple unspecified vulnerabilities in Autonomy KeyView IDOL before 10.16, as used in Symantec Mail Security for Microsoft Exchange before 6.5.8, Symantec Mai… |
CVE-2020-5831 | Low | 3.3 | 2020-02-11 | Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU2 MP1, may be susceptible to an out of bounds vulnerability, which is a type of issue that results… |
CVE-2020-5830 | Low | 3.3 | 2020-02-11 | Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU2 MP1, may be susceptible to an out of bounds vulnerability, which is a type of issue that results… |
CVE-2020-5829 | Low | 3.3 | 2020-02-11 | Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU2 MP1, may be susceptible to an out of bounds vulnerability, which is a type of issue that results… |
CVE-2020-5828 | Low | 3.3 | 2020-02-11 | Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU2 MP1, may be susceptible to an out of bounds vulnerability, which is a type of issue that results… |
CVE-2020-5827 | Low | 3.3 | 2020-02-11 | Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU2 MP1, may be susceptible to an out of bounds vulnerability, which is a type of issue that results… |
CVE-2020-5826 | Medium | 5.5 | 2020-02-11 | Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respect… |
CVE-2020-5825 | Medium | 5.5 | 2020-02-11 | Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respect… |
CVE-2020-5824 | Medium | 5.5 | 2020-02-11 | Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respect… |
CVE-2020-5823 | High | 7.8 | 2020-02-11 | Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respect… |
CVE-2020-5822 | High | 7.8 | 2020-02-11 | Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respect… |
CVE-2020-5821 | High | 7.8 | 2020-02-11 | Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respect… |
CVE-2020-5820 | High | 7.8 | 2020-02-11 | Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respect… |
CVE-2016-6592 | High | 7.8 | 2020-01-14 | A vulnerability was found in Symantec Norton Download Manager versions prior to 5.6. A remote user can create a specially crafted DLL file that, when placed on… |
CVE-2019-19548 | High | 7.8 | 2020-01-14 | Norton Power Eraser, prior to 5.3.0.67, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to… |
CVE-2019-19547 | Medium | 6.1 | 2020-01-13 | Symantec Endpoint Detection and Response (SEDR), prior to 4.3.0, may be susceptible to a cross site scripting (XSS) issue. XSS is a type of issue that can enab… |
CVE-2016-5311 | High | 7.8 | 2020-01-09 | A Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton In… |
CVE-2016-6585 | Medium | 5.3 | 2020-01-08 | A Denial of Service vulnerability exists in Symantec Norton Mobile Security for Android prior to 3.16, which could let a remote malicious user conduct a man-in… |
CVE-2016-6587 | Medium | 5.5 | 2020-01-08 | An Information Disclosure vulnerability exists in the mid.dat file stored on the SD card in Symantec Norton Mobile Security for Android before 3.16, which coul… |
CVE-2016-6588 | Medium | 5.4 | 2020-01-08 | A Cross-Site Scripting (XSS) vulnerability exists in the ITMS workflow process manager console in Symantec IT Management Suite 8.0. |
CVE-2016-6586 | Low | 3.7 | 2020-01-08 | A security bypass vulnerability exists in Symantec Norton Mobile Security for Android before 3.16, which could let a malicious user conduct a man-in-the-middle… |
CVE-2016-6593 | High | 7.8 | 2020-01-08 | A code-execution vulnerability exists during startup in jhi.dll and otpiha.dll in Symantec VIP Access Desktop before 2.2.2, which could let local malicious use… |
CVE-2016-6591 | High | 7.1 | 2020-01-08 | A security bypass vulnerability exists in Symantec Norton App Lock 1.0.3.186 and earlier if application pinning is enabled, which could let a local malicious u… |
CVE-2016-6590 | High | 7.8 | 2020-01-08 | A privilege escalation vulnerability exists when loading DLLs during boot up and reboot in Symantec IT Management Suite 8.0 prior to 8.0 HF4 and Suite 7.6 prio… |
CVE-2016-6589 | Medium | 6.5 | 2020-01-08 | A Denial of Service vulnerability exists in the ITMS workflow process manager login window in Symantec IT Management Suite 8.0. |
CVE-2019-18379 | High | 7.3 | 2019-12-11 | Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a server-side request forgery (SSRF) exploit, which is a type of issue that can let an attac… |
CVE-2019-18378 | Medium | 4.8 | 2019-12-11 | Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can enable attackers to… |
CVE-2019-18377 | High | 7.2 | 2019-12-11 | Symantec Messaging Gateway, prior to 10.7.3, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attem… |
CVE-2019-18380 | Medium | 6.5 | 2019-12-09 | Symantec Industrial Control System Protection (ICSP), versions 6.x.x, may be susceptible to an unauthorized access issue that could potentially allow a threat… |
CVE-2019-18374 | Critical | 9.8 | 2019-11-25 | Symantec Critical System Protection (CSP), versions 8.0, 8.0 HF1 & 8.0 MP1, may be susceptible to an authentication bypass vulnerability, which is a type of is… |
CVE-2019-18373 | Medium | 5.6 | 2019-11-18 | Norton App Lock, prior to 1.4.0.503, may be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to circumvent the app… |
CVE-2019-18372 | High | 7.8 | 2019-11-15 | Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may a… |
CVE-2019-12759 | High | 7.8 | 2019-11-15 | Symantec Endpoint Protection Manager (SEPM) and Symantec Mail Security for MS Exchange (SMSMSE), prior to versions 14.2 RU2 and 7.5.x respectively, may be susc… |
CVE-2019-12758 | Medium | 6.7 | 2019-11-15 | Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to an unsigned code execution vulnerability, which may allow an individual to execute code… |
CVE-2019-12757 | High | 7.8 | 2019-11-15 | Symantec Endpoint Protection (SEP), prior to 14.2 RU2 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition (SEP SBE) prior to 12.1 RU6 MP10d… |
CVE-2019-12756 | Low | 2.3 | 2019-11-15 | Symantec Endpoint Protection (SEP), prior to 14.2 RU2 may be susceptible to a password protection bypass vulnerability whereby the secondary layer of password… |
CVE-2018-18368 | High | 7.8 | 2019-11-15 | Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU1, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an… |
CVE-2019-12752 | Medium | 6.1 | 2019-11-01 | The Symantec SONAR component, prior to 12.0.2, may be susceptible to a tamper protection bypass vulnerability which could potentially allow an attacker to circ… |
CVE-2019-9699 | Medium | 4.5 | 2019-10-24 | Symantec Messaging Gateway (prior to 10.7.0), may be susceptible to an information disclosure issue, which is a type of vulnerability that could potentially al… |
CVE-2019-12755 | Medium | 5.5 | 2019-09-17 | Norton Password Manager, prior to 6.5.0.2104, may be susceptible to an information disclosure issue, which is a type of vulnerability whereby there is an unint… |
CVE-2019-9697 | Medium | 6.5 | 2019-08-30 | An information disclosure vulnerability in the Management Center (MC) REST API 2.0, 2.1, and 2.2 prior to 2.2.2.1 allows a malicious authenticated user to obta… |
CVE-2019-12754 | Medium | 4.8 | 2019-08-30 | Symantec My VIP portal, previous version which has already been auto updated, was susceptible to a cross-site scripting (XSS) exploit, which is a type of issue… |
CVE-2019-12753 | Medium | 4.9 | 2019-08-30 | An information disclosure vulnerability in Symantec Reporter web UI 10.3 prior to 10.3.2.5 allows a malicious authenticated administrator user to obtain passwo… |
CVE-2019-12750 | High | 7.8 | 2019-07-31 | Symantec Endpoint Protection, prior to 14.2 RU1 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition, prior to 12.1 RU6 MP10c (12.1.7491.700… |
CVE-2019-12751 | Critical | 9.8 | 2019-07-11 | Symantec Messaging Gateway, prior to 10.7.1, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attem… |
CVE-2019-9703 | High | 7.8 | 2019-07-01 | Symantec Endpoint Encryption, prior to SEE 11.3.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to g… |
CVE-2019-9702 | High | 7.8 | 2019-07-01 | Symantec Endpoint Encryption, prior to SEE 11.3.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue that allows a user to g… |
CVE-2019-9701 | Medium | 4.8 | 2019-06-19 | DLP 15.5 MP1 and all prior versions may be susceptible to a cross-site scripting (XSS) vulnerability, a type of issue that can enable attackers to inject clien… |
CVE-2019-9698 | Medium | 5.5 | 2019-05-08 | Symantec AV Engine, prior to 13.0.9r17, may be susceptible to an arbitrary file deletion issue, which is a type of vulnerability that could allow an attacker t… |
CVE-2018-18367 | High | 7.8 | 2019-04-25 | Symantec Endpoint Protection Manager (SEPM) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a DLL Preloading vulnerability, whi… |
CVE-2018-18366 | Medium | 6.5 | 2019-04-25 | Symantec Norton Security prior to 22.16.3, SEP (Windows client) prior to and including 12.1 RU6 MP9, and prior to 14.2 RU1, SEP SBE prior to Cloud Agent 3.00.3… |
CVE-2018-12244 | Medium | 6.3 | 2019-04-25 | SEP (Mac client) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a CSV/DDE injection (also known as formula injection) vulnerab… |
CVE-2018-18369 | High | 7.8 | 2019-04-25 | Norton Security (Windows client) prior to 22.16.3 and SEP SBE (Windows client) prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22 & SEP-12.1.7484.7002, may be s… |
CVE-2019-9694 | High | 7.8 | 2019-04-10 | Symantec Endpoint Encryption prior to SEE 11.2.1 MP1 may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker m… |
CVE-2019-9696 | Medium | 6.1 | 2019-04-09 | Symantec VIP Enterprise Gateway (all versions) may be susceptible to a cross-site scripting (XSS) exploit, which is a type of issue that can enable attackers t… |
CVE-2018-18365 | High | 7.5 | 2019-04-09 | Norton Password Manager may be susceptible to an address spoofing issue. This type of issue may allow an attacker to disguise their origin IP address in order… |
CVE-2019-9695 | Medium | 6.8 | 2019-03-29 | Norton Core prior to v278 may be susceptible to an arbitrary code execution issue, which is a type of vulnerability that has the potential of allowing an indiv… |
CVE-2018-18364 | High | 7.3 | 2019-02-08 | Symantec Ghost Solution Suite (GSS) versions prior to 3.3 RU1 may be susceptible to a DLL hijacking vulnerability, which is a type of issue whereby a potential… |
CVE-2018-12237 | High | 7.2 | 2019-01-24 | The Symantec Reporter CLI 10.1 prior to 10.1.5.6 and 10.2 prior to 10.2.1.8 is susceptible to an OS command injection vulnerability. An authenticated malicious… |
CVE-2018-18363 | Medium | 6.2 | 2019-01-24 | Norton App Lock prior to 1.4.0.445 can be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to circumvent the app t… |
CVE-2018-18362 | Medium | 6.1 | 2018-12-06 | Norton Password Manager for Android (formerly Norton Identity Safe) may be susceptible to a cross site scripting (XSS) exploit, which is a type of issue that c… |
CVE-2018-12245 | High | 7.8 | 2018-11-29 | Symantec Endpoint Protection prior to 14.2 MP1 may be susceptible to a DLL Preloading vulnerability, which in this case is an issue that can occur when an appl… |
CVE-2018-12239 | Medium | 6.8 | 2018-11-29 | Norton prior to 22.15; Symantec Endpoint Protection (SEP) prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Edition (SEP SBE) prior t… |
CVE-2018-12238 | High | 7.8 | 2018-11-29 | Norton prior to 22.15; Symantec Endpoint Protection (SEP) prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Edition (SEP SBE) prior t… |
CVE-2018-12241 | Medium | 6.1 | 2018-11-27 | The Symantec Security Analytics (SA) 7.x prior to 7.3.4 Web UI is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote attacker with k… |
CVE-2018-12246 | Medium | 6.1 | 2018-10-22 | Symantec Web Isolation (WI) 1.11 prior to 1.11.21 is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote attacker can target end user… |
CVE-2018-12243 | High | 8.8 | 2018-09-19 | The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity (XXE) exploit, which is a type of issue where XML input cont… |
CVE-2018-12242 | Critical | 9.8 | 2018-09-19 | The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to an authentication bypass exploit, which is a type of issue that can allow attacker… |
CVE-2018-12240 | Medium | 5.9 | 2018-08-29 | The Norton Identity Safe product prior to 5.3.0.976 may be susceptible to a privilege escalation issue via a hard coded IV, which is a type of vulnerability th… |
CVE-2018-5238 | High | 7.8 | 2018-08-22 | Norton Power Eraser (prior to 5.3.0.24) and SymDiag (prior to 2.1.242) may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can… |
CVE-2018-5235 | Medium | 6.0 | 2018-08-22 | Norton Utilities (prior to 16.0.3.44) may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks t… |
CVE-2018-5243 | High | 7.5 | 2018-08-20 | The Symantec Encryption Management Server (SEMS) product, prior to version 3.4.2 MP1, may be susceptible to a denial of service (DoS) exploit. A DoS attack is… |
CVE-2018-5240 | High | 8.0 | 2018-07-25 | The Inventory Plugin for Symantec Management Agent prior to 7.6 POST HF7, 8.0 POST HF6, or 8.1 RU7 may be susceptible to a privilege escalation vulnerability… |
CVE-2018-5239 | Medium | 6.2 | 2018-07-16 | Norton App Lock prior to v1.3.0.332 can be susceptible to a bypass exploit. In this type of circumstance, the exploit can allow the user to circumvent the app… |