CVE-2016-8027

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in core services in Intel Security McAfee ePolicy Orchestrator (ePO) 5.3.2 and earlier and 5.1.3 and earlier allows attackers to alter a SQL query, which can result in disclosure of information within the database or impersonation of an agent without authentication via a specially crafted HTTP post.

Metrics

CVSS 3.0 10.0/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	McAfee ePolicy Orchestrator (ePO) 5.3.2 and earlier and 5.1.3 and earlier	McAfee ePolicy Orchestrator (ePO) 5.3.2 and earlier and 5.1.3 and earlier

References

http://www.securityfocus.com/bid/95981Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037777Third Party Advisory, VDB Entry
https://kc.mcafee.com/corporate/index?page=content&id=SB10187Vendor Advisory
http://www.securityfocus.com/bid/95981Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037777Third Party Advisory, VDB Entry
https://kc.mcafee.com/corporate/index?page=content&id=SB10187Vendor Advisory

Timeline

Published: Mar 14, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-80304.3A memory corruption vulnerability in Scriptscan COM Object in McAfee VirusScan Enterprise 8.8 Patch 8 and earlier allows remote attackers to CVE-2016-80317.3Software Integrity Attacks vulnerability in Intel Security Anti-Virus Engine (AVE) 5200 through 5800 allows local users to bypass local secu CVE-2016-80327.3Software Integrity Attacks vulnerability in Intel Security Anti-Virus Engine (AVE) 5200 through 5800 allows local attackers to bypass local CVE-2016-81005.5Intel Integrated Performance Primitives (aka IPP) Cryptography before 9.0.4 makes it easier for local users to discover RSA private keys via CVE-2016-81017.8The updater subsystem in Intel SSD Toolbox before 3.3.7 allows local users to gain privileges via unspecified vectors.CVE-2016-81027.8Unquoted service path vulnerability in Intel Wireless Bluetooth Drivers 16.x, 17.x, and before 18.1.1607.3129 allows local users to launch p CVE-2016-81036.7SMM call out in all Intel Branded NUC Kits allows a local privileged user to access the System Management Mode and take full control of the CVE-2016-81045.5Buffer overflow in Intel PROSet/Wireless Software and Drivers in versions before 19.20.3 allows a local user to crash iframewrk.exe causing CVE-2016-81056.5Drivers for the Intel Ethernet Controller X710 and Intel Ethernet Controller XL710 families before version 22.0 are vulnerable to a denial o CVE-2016-81065.9A Denial of Service in Intel Ethernet Controller's X710/XL710 with Non-Volatile Memory Images before version 5.05 allows a remote attacker t CVE-2016-82018.0A CSRF vulnerability in Brocade Virtual Traffic Manager versions released prior to and including 11.0 could allow an attacker to trick a log CVE-2016-82028.8A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and