CVE-2014-3437

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published
Nov 7, 2014
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2014

CVE-2014-34384.3Multiple cross-site scripting (XSS) vulnerabilities in console interface scripts in Symantec Endpoint Protection Manager (SEPM) 12.1 before CVE-2014-34396.1ConsoleServlet in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU5 allows remote attackers to write to arbitrary files via unspecCVE-2014-34409.0The Agent Control Interface in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and Symantec Data CenterCVE-2014-34414.3codec\libpng_plugin.dll in VideoLAN VLC Media Player 2.1.3 allows remote attackers to cause a denial of service (crash) via a crafted .png fCVE-2014-34424.3Winamp 5.666 and earlier allows remote attackers to cause a denial of service (memory corruption and crash) via a malformed .FLV file, relatCVE-2014-34434.3JetMPAd.ax in JetAudio 8.1.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted .ogg file.CVE-2014-34449.3The GetGUID function in codecs/dmp4.dll in RealNetworks RealPlayer 16.0.3.51 and earlier allows remote attackers to execute arbitrary code oCVE-2014-34459.8backup.php in HandsomeWeb SOS Webpages before 1.1.12 does not require knowledge of the cleartext password, which allows remote attackers to CVE-2014-34467.5SQL injection vulnerability in wcm/system/pages/admin/getnode.aspx in BSS Continuity CMS 4.2.22640.0 allows remote attackers to execute arbiCVE-2014-34477.5BSS Continuity CMS 4.2.22640.0 has a Remote Denial Of Service vulnerabilityCVE-2014-34489.8BSS Continuity CMS 4.2.22640.0 has a Remote Code Execution vulnerability due to unauthenticated file uploadCVE-2014-34499.8BSS Continuity CMS 4.2.22640.0 has an Authentication Bypass vulnerability
CVE-2014-3437: High severity, CVSS 7.5 | Vulnix