CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Mcafee : Security Vulnerabilities

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2018-6661 426 +Priv 2018-04-02 2018-05-15
6.8
None Remote Medium Not required Partial Partial Partial
DLL Side-Loading vulnerability in Microsoft Windows Client in McAfee True Key before 4.20.110 allows local users to gain privilege elevation via not verifying a particular DLL file signature.
2 CVE-2018-6660 22 Dir. Trav. Bypass 2018-04-02 2018-05-17
4.0
None Remote Low Single system Partial None None
Directory Traversal vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows administrators to use Windows alternate data streams, which could be used to bypass the file extensions, via not properly validating the path when exporting a particular XML file.
3 CVE-2018-6659 79 XSS 2018-04-02 2018-05-17
3.5
None Remote Medium Single system None Partial None
Reflected Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows remote authenticated users to exploit an XSS issue via not sanitizing the user input.
4 CVE-2017-4057 264 +Priv 2017-07-12 2017-07-17
6.5
None Remote Low Single system Partial Partial Partial
Privilege Escalation vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authenticated users to gain elevated privileges via the GUI or GUI terminal commands.
5 CVE-2017-4055 306 Bypass 2017-07-12 2017-07-17
5.0
None Remote Low Not required None Partial None
Exploitation of Authentication vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remote attackers to bypass ATD detection via loose enforcement of authentication and authorization.
6 CVE-2017-4054 77 Exec Code 2017-07-12 2017-07-17
6.5
None Remote Low Single system Partial Partial Partial
Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authenticated users to execute a command of their choice via a crafted HTTP request parameter.
7 CVE-2017-4053 77 Exec Code 2017-07-12 2017-07-17
7.5
None Remote Low Not required Partial Partial Partial
Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remote attackers to execute a command of their choice via a crafted HTTP request parameter.
8 CVE-2017-4052 306 Bypass 2017-07-12 2017-07-17
7.5
None Remote Low Not required Partial Partial Partial
Authentication Bypass vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remote attackers to change or update any configuration settings, or gain administrator functionality via a crafted HTTP request parameter.
9 CVE-2017-4028 74 2018-04-03 2018-05-10
2.1
None Local Low Not required None Partial None
Maliciously misconfigured registry vulnerability in all Microsoft Windows products in McAfee consumer and corporate products allows an administrator to inject arbitrary code into a debugged McAfee process via manipulation of registry parameters.
10 CVE-2017-4017 200 +Info 2017-05-17 2017-07-07
5.0
None Remote Low Not required Partial None None
User Name Disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to view user information via the appliance web interface.
11 CVE-2017-4016 200 +Info 2017-05-17 2017-07-07
5.0
None Remote Low Not required Partial None None
Web Server method disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to exploit and find another hole via HTTP response header.
12 CVE-2017-4015 20 2017-05-17 2017-07-07
3.5
None Remote Medium Single system None Partial None
Clickjacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to inject arbitrary web script or HTML via HTTP response header.
13 CVE-2017-4014 384 2017-05-17 2017-07-07
6.0
None Remote Medium Single system Partial Partial Partial
Session Side jacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view, add, and remove users via modification of the HTTP request.
14 CVE-2017-4013 200 +Info 2017-05-17 2017-07-07
5.0
None Remote Low Not required Partial None None
Banner Disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to obtain product information via HTTP response header.
15 CVE-2017-4012 264 2017-05-17 2017-07-07
5.0
None Remote Low Not required Partial None None
Privilege Escalation vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential information via modification of the HTTP request.
16 CVE-2017-4011 79 XSS 2017-05-17 2017-07-07
4.3
None Remote Medium Not required None Partial None
Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to get session/cookie information via modification of the HTTP request.
17 CVE-2017-3980 22 Exec Code Dir. Trav. 2017-05-18 2017-06-01
6.5
None Remote Low Single system Partial Partial Partial
A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, and 5.1.3 and earlier allows remote authenticated users to execute a command of their choice via an authenticated ePO session.
18 CVE-2017-3972 200 Exec Code +Info 2018-04-03 2018-05-10
7.5
None Remote Low Not required Partial Partial Partial
Infrastructure-based foot printing vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to execute arbitrary code via the server banner leaking potentially sensitive or security relevant information.
19 CVE-2017-3971 310 2018-04-04 2018-05-10
4.0
None Remote Low Single system Partial None None
Cryptanalysis vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to view confidential information via insecure use of RC4 encryption cyphers.
20 CVE-2017-3969 417 2018-04-04 2018-05-10
4.3
None Remote Medium Not required Partial None None
Abuse of communication channels vulnerability in the server in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows man-in-the-middle attackers to decrypt messages via an inadequate implementation of SSL.
21 CVE-2017-3967 94 2018-04-04 2018-05-15
4.3
None Remote Medium Not required None Partial None
Target influence via framing vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to inject arbitrary web script or HTML via application pages inability to break out of 3rd party HTML frames.
22 CVE-2017-3966 613 2018-04-04 2018-05-15
6.5
None Remote Low Single system Partial Partial Partial
Exploitation of session variables, resource IDs and other trusted credentials vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to exploit or harm a user's browser via reusing the exposed session token in the application URL.
23 CVE-2017-3965 352 CSRF 2018-04-04 2018-05-09
6.8
None Remote Medium Not required Partial Partial Partial
Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to perform unauthorized tasks such as retrieving internal system information or manipulating the database via specially crafted URLs.
24 CVE-2017-3964 79 XSS 2018-04-04 2018-05-09
3.5
None Remote Medium Single system None Partial None
Reflective Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to inject arbitrary web script or HTML via a URL parameter.
25 CVE-2017-3948 79 XSS 2017-06-23 2017-07-05
3.5
None Remote Medium Single system None Partial None
Cross Site Scripting (XSS) in IMG Tags in the ePO extension in McAfee Data Loss Prevention Endpoint (DLP Endpoint) 10.0.x allows authenticated users to inject arbitrary web script or HTML via injecting malicious JavaScript into a user's browsing session.
26 CVE-2017-3935 200 +Info 2017-10-31 2017-11-22
5.0
None Remote Low Not required Partial None None
Network Data Loss Prevention is vulnerable to MIME type sniffing which allows older versions of Internet Explorer to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the intended content type.
27 CVE-2017-3934 200 +Info 2017-10-31 2017-11-21
4.3
None Remote Medium Not required Partial None None
Missing HTTP Strict Transport Security state information vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows man-in-the-middle attackers to expose confidential data via read files on the webserver.
28 CVE-2017-3933 79 XSS CSRF 2017-10-31 2017-11-18
3.5
None Remote Medium Single system None Partial None
Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential information via a cross site request forgery attack.
29 CVE-2017-3902 79 XSS Bypass 2017-02-13 2017-07-25
3.5
None Remote Medium Single system None Partial None
Cross-site scripting (XSS) vulnerability in the Web user interface (UI) in Intel Security ePO 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows authenticated users to inject malicious Java scripts via bypassing input validation.
30 CVE-2017-3899 89 Sql +Info 2017-03-14 2017-03-23
4.0
None Remote Low Single system Partial None None
SQL injection vulnerability in Intel Security Advanced Threat Defense (ATD) Linux 3.6.0 and earlier allows remote authenticated users to obtain product information via a crafted HTTP request parameter.
31 CVE-2017-3898 284 2017-09-01 2017-09-06
4.3
None Remote Medium Not required None Partial None
A man-in-the-middle attack vulnerability in the non-certificate-based authentication mechanism in McAfee LiveSafe (MLS) versions prior to 16.0.3 allows network attackers to modify the Windows registry value associated with the McAfee update via the HTTP backend-response.
32 CVE-2017-3897 94 Exec Code 2017-09-01 2017-09-06
7.5
None Remote Low Not required Partial Partial Partial
A Code Injection vulnerability in the non-certificate-based authentication mechanism in McAfee Live Safe versions prior to 16.0.3 and McAfee Security Scan Plus (MSS+) versions prior to 3.11.599.3 allows network attackers to perform a malicious file execution via a HTTP backend-response.
33 CVE-2017-3896 20 2017-02-13 2017-07-25
4.3
None Remote Medium Not required None None Partial
Unvalidated parameter vulnerability in the remote log viewing capability in Intel Security McAfee Agent 5.0.x versions prior to 5.0.4.449 allows remote attackers to pass unexpected input parameters via a URL that was not completely validated.
34 CVE-2016-8032 284 Bypass 2017-03-31 2017-07-11
4.4
None Local Medium Not required Partial Partial Partial
Software Integrity Attacks vulnerability in Intel Security Anti-Virus Engine (AVE) 5200 through 5800 allows local attackers to bypass local security protection via a crafted input file.
35 CVE-2016-8031 264 Bypass 2017-03-28 2017-07-11
4.4
None Local Medium Not required Partial Partial Partial
Software Integrity Attacks vulnerability in Intel Security Anti-Virus Engine (AVE) 5200 through 5800 allows local users to bypass local security protection via a crafted input file.
36 CVE-2016-8030 119 DoS Overflow Mem. Corr. 2017-04-25 2017-05-08
4.3
None Remote Medium Not required None None Partial
A memory corruption vulnerability in Scriptscan COM Object in McAfee VirusScan Enterprise 8.8 Patch 8 and earlier allows remote attackers to create a Denial of Service on the active Internet Explorer tab via a crafted HTML link.
37 CVE-2016-8027 89 Sql 2017-03-14 2017-07-24
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in core services in Intel Security McAfee ePolicy Orchestrator (ePO) 5.3.2 and earlier and 5.1.3 and earlier allows attackers to alter a SQL query, which can result in disclosure of information within the database or impersonation of an agent without authentication via a specially crafted HTTP post.
38 CVE-2016-8026 264 Exec Code +Priv 2017-03-14 2017-05-01
4.6
None Local Low Not required Partial Partial Partial
Arbitrary command execution vulnerability in Intel Security McAfee Security Scan Plus (SSP) 3.11.469 and earlier allows authenticated users to gain elevated privileges via unspecified vectors.
39 CVE-2016-8025 89 Sql +Info 2017-03-14 2017-09-02
6.0
None Remote Medium Single system Partial Partial Partial
SQL injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to obtain product information via a crafted HTTP request parameter.
40 CVE-2016-8024 113 +Info 2017-03-14 2017-09-02
6.8
None Remote Medium Not required Partial Partial Partial
Improper neutralization of CRLF sequences in HTTP headers vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to obtain sensitive information via the server HTTP response spoofing.
41 CVE-2016-8023 287 Bypass 2017-03-14 2017-09-02
6.8
None Remote Medium Not required Partial Partial Partial
Authentication bypass by assumed-immutable data vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to bypass server authentication via a crafted authentication cookie.
42 CVE-2016-8022 287 DoS Exec Code Bypass 2017-03-14 2017-09-02
5.1
None Remote High Not required Partial Partial Partial
Authentication bypass by spoofing vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote unauthenticated attacker to execute arbitrary code or cause a denial of service via a crafted authentication cookie.
43 CVE-2016-8021 347 Exec Code 2017-03-14 2017-09-02
3.5
None Remote Medium Single system None Partial None
Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to spoof update server and execute arbitrary code via a crafted input file.
44 CVE-2016-8020 94 Exec Code 2017-03-14 2017-09-02
6.0
None Remote Medium Single system Partial Partial Partial
Improper control of generation of code vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to execute arbitrary code via a crafted HTTP request parameter.
45 CVE-2016-8019 79 XSS 2017-03-14 2017-09-02
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in attributes in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows unauthenticated remote attackers to inject arbitrary web script or HTML via a crafted user input.
46 CVE-2016-8018 352 Exec Code CSRF 2017-03-14 2017-09-02
6.0
None Remote Medium Single system Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to execute unauthorized commands via a crafted user input.
47 CVE-2016-8017 20 2017-03-14 2017-09-02
4.0
None Remote Low Single system Partial None None
Special element injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to read files on the webserver via a crafted user input.
48 CVE-2016-8016 200 +Info 2017-03-14 2017-09-02
3.5
None Remote Medium Single system Partial None None
Information exposure in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to obtain the existence of unauthorized files on the system via a URL parameter.
49 CVE-2016-8012 264 2017-03-14 2017-03-31
4.6
None Local Low Not required Partial Partial Partial
Access control vulnerability in Intel Security Data Loss Prevention Endpoint (DLPe) 9.4.200 and 9.3.600 allows authenticated users with Read-Write-Execute permissions to inject hook DLLs into other processes via pages in the target process memory get.
50 CVE-2016-8010 284 Bypass 2017-03-14 2017-03-30
4.6
None Local Low Not required Partial Partial Partial
Application protections bypass vulnerability in Intel Security McAfee Application Control (MAC) 7.0 and earlier and Endpoint Security (ENS) 10.2 and earlier allows local users to bypass local security protection via a command-line utility.
Total number of vulnerabilities : 264   Page : 1 (This Page)2 3 4 5 6
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.