CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Mcafee : Security Vulnerabilities (CVSS score between 4 and 4.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-3652 94 2019-10-09 2019-10-15
4.6
None Local Low Not required Partial Partial Partial
Code Injection vulnerability in EPSetup.exe in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to get their malicious code installed by the ENS installer via code injection into EPSetup.exe by an attacker with access to the installer.
2 CVE-2019-3638 79 Exec Code XSS 2019-09-12 2019-10-09
4.3
None Remote Medium Not required None Partial None
Reflected Cross Site Scripting vulnerability in Administrators web console in McAfee Web Gateway (MWG) 7.8.x prior to 7.8.2.13 allows remote attackers to collect sensitive information or execute commands with the MWG administrator's credentials via tricking the administrator to click on a carefully constructed malicious link.
3 CVE-2019-3637 264 +Priv 2019-08-14 2019-10-09
4.6
None Local Low Not required Partial Partial Partial
Privilege Escalation vulnerability in McAfee FRP 5.x prior to 5.1.0.209 allows local users to gain elevated privileges via running McAfee Tray with elevated privileges.
4 CVE-2019-3635 200 +Info 2019-08-14 2019-10-09
4.3
None Remote Medium Not required Partial None None
Exfiltration of Data in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows attackers to obtain sensitive data via crafting a complex webpage that will trigger the Web Gateway to block the user accessing an iframe.
5 CVE-2019-3634 119 Overflow 2019-08-21 2019-10-09
4.9
None Local Low Not required None None Complete
Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via an encrypted message sent to DLPe which when decrypted results in DLPe reading unallocated memory.
6 CVE-2019-3633 119 Overflow Bypass 2019-08-21 2019-10-09
4.9
None Local Low Not required None None Complete
Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via a carefully constructed message sent to DLPe which bypasses DLPe internal checks and results in DLPe reading unallocated memory.
7 CVE-2019-3629 287 Bypass 2019-06-27 2019-10-09
4.3
None Remote Medium Not required None Partial None
Application protection bypass vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows unauthenticated user to impersonate system users via specially crafted parameters.
8 CVE-2019-3622 284 2019-07-24 2019-07-25
4.6
None Local Low Not required Partial Partial Partial
Files or Directories Accessible to External Parties in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows authenticated user to redirect DLPe log files to arbitrary locations via incorrect access control applied to the DLPe log folder allowing privileged users to create symbolic links.
9 CVE-2019-3621 287 Bypass 2019-07-25 2019-10-09
4.6
None Local Low Not required Partial Partial Partial
Authentication protection bypass vulnerability in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows physical local user to bypass the Windows lock screen via DLPe processes being killed just prior to the screen being locked or when the screen is locked. The attacker requires physical access to the machine.
10 CVE-2019-3619 200 +Info 2019-07-03 2019-07-09
4.0
None Remote Low Single system Partial None None
Information Disclosure vulnerability in the Agent Handler in McAfee ePolicy Orchestrator (ePO) 5.9.x and 5.10.0 prior to 5.10.0 update 4 allows remote unauthenticated attacker to view sensitive information in plain text via sniffing the traffic between the Agent Handler and the SQL server.
11 CVE-2019-3599 200 +Info 2019-02-28 2019-10-09
4.3
None Remote Medium Not required Partial None None
Information Disclosure vulnerability in Remote logging (which is disabled by default) in McAfee Agent (MA) 5.x allows remote unauthenticated users to access sensitive information via remote logging when it is enabled.
12 CVE-2019-3595 77 Exec Code 2019-07-24 2019-10-09
4.4
None Local Medium Not required Partial Partial Partial
Improper Neutralization of Special Elements used in a Command ('Command Injection') in ePO extension in McAfee Data Loss Prevention (DLP) 11.x prior to 11.3.0 allows Authenticated Adminstrator to execute arbitrary code with their local machine privileges via a specially crafted DLP policy, which is exported and opened on the their machine. In our checks, the user must explicitly allow the code to execute.
13 CVE-2019-3592 264 2019-07-18 2019-10-09
4.6
None Local Low Not required Partial Partial Partial
Privilege escalation vulnerability in McAfee Agent (MA) before 5.6.1 HF3, allows local administrator users to potentially disable some McAfee processes by manipulating the MA directory control and placing a carefully constructed file in the MA directory.
14 CVE-2019-3591 79 XSS 2019-07-24 2019-07-26
4.3
None Remote Medium Not required None Partial None
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ePO extension in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted upload to a remote website which is correctly blocked by DLPe Web Protection. This would then render as an XSS when the DLP Admin viewed the event in the ePO UI.
15 CVE-2018-6757 Exec Code 2018-12-06 2019-10-09
4.6
None Local Low Not required Partial Partial Partial
Privilege Escalation vulnerability in Microsoft Windows client in McAfee True Key (TK) 5.1.230.7 and earlier allows local users to execute arbitrary code via specially crafted malware.
16 CVE-2018-6756 Exec Code 2018-12-06 2019-10-09
4.6
None Local Low Not required Partial Partial Partial
Authentication Abuse vulnerability in Microsoft Windows client in McAfee True Key (TK) 5.1.230.7 and earlier allows local users to execute unauthorized commands via specially crafted malware.
17 CVE-2018-6755 732 Exec Code 2018-12-06 2019-10-09
4.6
None Local Low Not required Partial Partial Partial
Weak Directory Permission Vulnerability in Microsoft Windows client in McAfee True Key (TK) 5.1.230.7 and earlier allows local users to execute arbitrary code via specially crafted malware.
18 CVE-2018-6707 400 DoS Exec Code 2018-12-13 2019-10-09
4.4
None Local Medium Not required Partial Partial Partial
Denial of Service through Resource Depletion vulnerability in the agent in non-Windows McAfee Agent (MA) 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows local users to cause DoS, unexpected behavior, or potentially unauthorized code execution via knowledge of the internal trust mechanism.
19 CVE-2018-6705 Exec Code 2018-12-12 2019-10-09
4.6
None Local Low Not required Partial Partial Partial
Privilege escalation vulnerability in McAfee Agent (MA) for Linux 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows local users to perform arbitrary command execution via specific conditions.
20 CVE-2018-6704 Exec Code 2018-12-12 2019-10-09
4.6
None Local Low Not required Partial Partial Partial
Privilege escalation vulnerability in McAfee Agent (MA) for Linux 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows local users to perform arbitrary command execution via specific conditions.
21 CVE-2018-6695 2018-10-03 2019-10-09
4.3
None Remote Medium Not required None Partial None
SSH host keys generation vulnerability in the server in McAfee Threat Intelligence Exchange Server (TIE Server) 1.3.0, 2.0.x, 2.1.x, 2.2.0 allows man-in-the-middle attackers to spoof servers via acquiring keys from another environment.
22 CVE-2018-6689 287 Bypass 2018-10-03 2019-10-09
4.6
None Local Low Not required Partial Partial Partial
Authentication Bypass vulnerability in McAfee Data Loss Prevention Endpoint (DLPe) 10.0.x earlier than 10.0.510, and 11.0.x earlier than 11.0.600 allows attackers to bypass local security protection via specific conditions.
23 CVE-2018-6687 400 2019-02-21 2019-10-09
4.3
None Remote Medium Not required None None Partial
Loop with Unreachable Exit Condition ('Infinite Loop') in McAfee GetSusp (GetSusp) 3.0.0.461 and earlier allows attackers to DoS a manual GetSusp scan via while scanning a specifically crafted file . GetSusp is a free standalone McAfee tool that runs on several versions of Microsoft Windows.
24 CVE-2018-6686 287 Bypass 2018-07-27 2019-10-09
4.6
None Local Low Not required Partial Partial Partial
Authentication Bypass vulnerability in TPM autoboot in McAfee Drive Encryption (MDE) 7.1.0 and above allows physically proximate attackers to bypass local security protection via specific set of circumstances.
25 CVE-2018-6683 276 Bypass 2018-07-23 2019-10-09
4.6
None Local Low Not required Partial Partial Partial
Exploiting Incorrectly Configured Access Control Security Levels vulnerability in McAfee Data Loss Prevention (DLP) for Windows versions prior to 10.0.505 and 11.0.405 allows local users to bypass DLP policy via editing of local policy files when offline.
26 CVE-2018-6682 79 XSS 2018-09-24 2019-10-09
4.3
None Remote Medium Not required Partial None None
Cross Site Scripting Exposure in McAfee True Key (TK) 4.0.0.0 and earlier allows local users to expose confidential data via a crafted web site.
27 CVE-2018-6672 200 +Info 2018-06-15 2019-10-09
4.0
None Remote Low Single system Partial None None
Information disclosure vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows authenticated users to view sensitive information in plain text format via unspecified vectors.
28 CVE-2018-6671 Bypass 2018-06-15 2019-10-09
4.0
None Remote Low Single system None Partial None
Application Protection Bypass vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows remote authenticated users to bypass localhost only access security protection for some ePO features via a specially crafted HTTP request.
29 CVE-2018-6670 611 2018-06-07 2019-10-09
4.0
None Remote Low Single system Partial None None
External Entity Attack vulnerability in the ePO extension in McAfee Common UI (CUI) 2.0.2 allows remote authenticated users to view confidential information via a crafted HTTP request parameter.
30 CVE-2018-6668 Bypass 2018-12-31 2019-10-09
4.6
None Local Low Not required Partial Partial Partial
A whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and before allows execution bypass, for example, with simple DLL through interpreters such as PowerShell.
31 CVE-2018-6660 22 Dir. Trav. Bypass 2018-04-02 2019-10-09
4.0
None Remote Low Single system Partial None None
Directory Traversal vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows administrators to use Windows alternate data streams, which could be used to bypass the file extensions, via not properly validating the path when exporting a particular XML file.
32 CVE-2017-4011 79 XSS 2017-05-17 2017-07-07
4.3
None Remote Medium Not required None Partial None
Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to get session/cookie information via modification of the HTTP request.
33 CVE-2017-3971 326 2018-04-04 2019-10-09
4.0
None Remote Low Single system Partial None None
Cryptanalysis vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to view confidential information via insecure use of RC4 encryption cyphers.
34 CVE-2017-3969 417 2018-04-04 2019-10-09
4.3
None Remote Medium Not required Partial None None
Abuse of communication channels vulnerability in the server in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows man-in-the-middle attackers to decrypt messages via an inadequate implementation of SSL.
35 CVE-2017-3967 94 2018-04-04 2019-10-09
4.3
None Remote Medium Not required None Partial None
Target influence via framing vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to inject arbitrary web script or HTML via application pages inability to break out of 3rd party HTML frames.
36 CVE-2017-3934 200 +Info 2017-10-31 2017-11-21
4.3
None Remote Medium Not required Partial None None
Missing HTTP Strict Transport Security state information vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows man-in-the-middle attackers to expose confidential data via read files on the webserver.
37 CVE-2017-3912 287 Exec Code Bypass 2018-09-18 2019-10-09
4.6
None Local Low Not required Partial Partial Partial
Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility.
38 CVE-2017-3899 89 Sql +Info 2017-03-14 2017-03-23
4.0
None Remote Low Single system Partial None None
SQL injection vulnerability in Intel Security Advanced Threat Defense (ATD) Linux 3.6.0 and earlier allows remote authenticated users to obtain product information via a crafted HTTP request parameter.
39 CVE-2017-3898 20 2017-09-01 2019-10-02
4.3
None Remote Medium Not required None Partial None
A man-in-the-middle attack vulnerability in the non-certificate-based authentication mechanism in McAfee LiveSafe (MLS) versions prior to 16.0.3 allows network attackers to modify the Windows registry value associated with the McAfee update via the HTTP backend-response.
40 CVE-2017-3896 20 2017-02-13 2017-07-25
4.3
None Remote Medium Not required None None Partial
Unvalidated parameter vulnerability in the remote log viewing capability in Intel Security McAfee Agent 5.0.x versions prior to 5.0.4.449 allows remote attackers to pass unexpected input parameters via a URL that was not completely validated.
41 CVE-2016-8032 284 Bypass 2017-03-31 2017-07-11
4.4
None Local Medium Not required Partial Partial Partial
Software Integrity Attacks vulnerability in Intel Security Anti-Virus Engine (AVE) 5200 through 5800 allows local attackers to bypass local security protection via a crafted input file.
42 CVE-2016-8031 264 Bypass 2017-03-28 2017-07-11
4.4
None Local Medium Not required Partial Partial Partial
Software Integrity Attacks vulnerability in Intel Security Anti-Virus Engine (AVE) 5200 through 5800 allows local users to bypass local security protection via a crafted input file.
43 CVE-2016-8030 119 DoS Overflow Mem. Corr. 2017-04-25 2017-05-08
4.3
None Remote Medium Not required None None Partial
A memory corruption vulnerability in Scriptscan COM Object in McAfee VirusScan Enterprise 8.8 Patch 8 and earlier allows remote attackers to create a Denial of Service on the active Internet Explorer tab via a crafted HTML link.
44 CVE-2016-8026 264 Exec Code +Priv 2017-03-14 2017-05-01
4.6
None Local Low Not required Partial Partial Partial
Arbitrary command execution vulnerability in Intel Security McAfee Security Scan Plus (SSP) 3.11.469 and earlier allows authenticated users to gain elevated privileges via unspecified vectors.
45 CVE-2016-8019 79 XSS 2017-03-14 2017-09-02
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in attributes in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows unauthenticated remote attackers to inject arbitrary web script or HTML via a crafted user input.
46 CVE-2016-8017 20 2017-03-14 2017-09-02
4.0
None Remote Low Single system Partial None None
Special element injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to read files on the webserver via a crafted user input.
47 CVE-2016-8012 264 2017-03-14 2017-03-31
4.6
None Local Low Not required Partial Partial Partial
Access control vulnerability in Intel Security Data Loss Prevention Endpoint (DLPe) 9.4.200 and 9.3.600 allows authenticated users with Read-Write-Execute permissions to inject hook DLLs into other processes via pages in the target process memory get.
48 CVE-2016-8010 284 Bypass 2017-03-14 2017-03-30
4.6
None Local Low Not required Partial Partial Partial
Application protections bypass vulnerability in Intel Security McAfee Application Control (MAC) 7.0 and earlier and Endpoint Security (ENS) 10.2 and earlier allows local users to bypass local security protection via a command-line utility.
49 CVE-2016-8009 264 Exec Code 2017-03-14 2017-03-27
4.6
None Local Low Not required Partial Partial Partial
Privilege escalation vulnerability in Intel Security McAfee Application Control (MAC) 7.0 and 6.x versions allows attackers to cause DoS, unexpected behavior, or potentially unauthorized code execution via an unauthorized use of IOCTL call.
50 CVE-2016-8005 264 2017-03-14 2017-03-30
4.0
None Remote Low Single system None Partial None
File extension filtering vulnerability in Intel Security McAfee Email Gateway (MEG) before 7.6.404h1128596 allows attackers to fail to identify the file name properly via scanning an email with a forged attached filename that uses a null byte within the filename extension.
Total number of vulnerabilities : 105   Page : 1 (This Page)2 3
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.