CVE-2016-8732

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Multiple security flaws exists in InvProtectDrv.sys which is a part of Invincea Dell Protected Workspace 5.1.1-22303. Weak restrictions on the driver communication channel and additional insufficient checks allow any application to turn off some of the protection mechanisms provided by the Invincea product.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-275

Affected software

Vendor	Product	Versions
Invincea	Dell Protected Workspace	build 5.1.1-22303

References

http://www.securityfocus.com/bid/99360Broken Link, Third Party Advisory, VDB Entry
https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0246Exploit, Technical Description, Third Party Advisory
http://www.securityfocus.com/bid/99360Broken Link, Third Party Advisory, VDB Entry
https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0246Exploit, Technical Description, Third Party Advisory

Timeline

Published: Apr 24, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-87338.8An exploitable integer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioct CVE-2016-87346.5Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-servi CVE-2016-87359.8Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before CVE-2016-87369.8Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack.CVE-2016-87378.8In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web sit CVE-2016-87385.9In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is pos CVE-2016-87397.5The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers CVE-2016-87407.5The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict CVE-2016-87417.5The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among th CVE-2016-87427.8The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in the install inherit t CVE-2016-87437.5Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response li CVE-2016-87448.8Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should