CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Mcafee : Security Vulnerabilities (CVSS score between 4 and 4.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2018-6695 310 2018-10-03 2018-11-27
4.3
None Remote Medium Not required None Partial None
SSH host keys generation vulnerability in the server in McAfee Threat Intelligence Exchange Server (TIE Server) 1.3.0, 2.0.x, 2.1.x, 2.2.0 allows man-in-the-middle attackers to spoof servers via acquiring keys from another environment.
2 CVE-2018-6683 284 Bypass 2018-07-23 2018-10-01
4.6
None Local Low Not required Partial Partial Partial
Exploiting Incorrectly Configured Access Control Security Levels vulnerability in McAfee Data Loss Prevention (DLP) for Windows versions prior to 10.0.505 and 11.0.405 allows local users to bypass DLP policy via editing of local policy files when offline.
3 CVE-2018-6682 79 XSS 2018-09-24 2018-11-28
4.3
None Remote Medium Not required Partial None None
Cross Site Scripting Exposure in McAfee True Key (TK) 4.0.0.0 and earlier allows local users to expose confidential data via a crafted web site.
4 CVE-2018-6672 200 +Info 2018-06-15 2018-08-06
4.0
None Remote Low Single system Partial None None
Information disclosure vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows authenticated users to view sensitive information in plain text format via unspecified vectors.
5 CVE-2018-6671 254 Bypass 2018-06-15 2018-08-06
4.0
None Remote Low Single system None Partial None
Application Protection Bypass vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows remote authenticated users to bypass localhost only access security protection for some ePO features via a specially crafted HTTP request.
6 CVE-2018-6660 22 Dir. Trav. Bypass 2018-04-02 2018-05-17
4.0
None Remote Low Single system Partial None None
Directory Traversal vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows administrators to use Windows alternate data streams, which could be used to bypass the file extensions, via not properly validating the path when exporting a particular XML file.
7 CVE-2017-4011 79 XSS 2017-05-17 2017-07-07
4.3
None Remote Medium Not required None Partial None
Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to get session/cookie information via modification of the HTTP request.
8 CVE-2017-3971 310 2018-04-04 2018-05-10
4.0
None Remote Low Single system Partial None None
Cryptanalysis vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to view confidential information via insecure use of RC4 encryption cyphers.
9 CVE-2017-3969 417 2018-04-04 2018-05-10
4.3
None Remote Medium Not required Partial None None
Abuse of communication channels vulnerability in the server in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows man-in-the-middle attackers to decrypt messages via an inadequate implementation of SSL.
10 CVE-2017-3967 94 2018-04-04 2018-05-15
4.3
None Remote Medium Not required None Partial None
Target influence via framing vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to inject arbitrary web script or HTML via application pages inability to break out of 3rd party HTML frames.
11 CVE-2017-3934 200 +Info 2017-10-31 2017-11-21
4.3
None Remote Medium Not required Partial None None
Missing HTTP Strict Transport Security state information vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows man-in-the-middle attackers to expose confidential data via read files on the webserver.
12 CVE-2017-3912 77 Exec Code Bypass 2018-09-18 2018-12-07
4.6
None Local Low Not required Partial Partial Partial
Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility.
13 CVE-2017-3899 89 Sql +Info 2017-03-14 2017-03-23
4.0
None Remote Low Single system Partial None None
SQL injection vulnerability in Intel Security Advanced Threat Defense (ATD) Linux 3.6.0 and earlier allows remote authenticated users to obtain product information via a crafted HTTP request parameter.
14 CVE-2017-3898 284 2017-09-01 2017-09-06
4.3
None Remote Medium Not required None Partial None
A man-in-the-middle attack vulnerability in the non-certificate-based authentication mechanism in McAfee LiveSafe (MLS) versions prior to 16.0.3 allows network attackers to modify the Windows registry value associated with the McAfee update via the HTTP backend-response.
15 CVE-2017-3896 20 2017-02-13 2017-07-25
4.3
None Remote Medium Not required None None Partial
Unvalidated parameter vulnerability in the remote log viewing capability in Intel Security McAfee Agent 5.0.x versions prior to 5.0.4.449 allows remote attackers to pass unexpected input parameters via a URL that was not completely validated.
16 CVE-2016-8032 284 Bypass 2017-03-31 2017-07-11
4.4
None Local Medium Not required Partial Partial Partial
Software Integrity Attacks vulnerability in Intel Security Anti-Virus Engine (AVE) 5200 through 5800 allows local attackers to bypass local security protection via a crafted input file.
17 CVE-2016-8031 264 Bypass 2017-03-28 2017-07-11
4.4
None Local Medium Not required Partial Partial Partial
Software Integrity Attacks vulnerability in Intel Security Anti-Virus Engine (AVE) 5200 through 5800 allows local users to bypass local security protection via a crafted input file.
18 CVE-2016-8030 119 DoS Overflow Mem. Corr. 2017-04-25 2017-05-08
4.3
None Remote Medium Not required None None Partial
A memory corruption vulnerability in Scriptscan COM Object in McAfee VirusScan Enterprise 8.8 Patch 8 and earlier allows remote attackers to create a Denial of Service on the active Internet Explorer tab via a crafted HTML link.
19 CVE-2016-8026 264 Exec Code +Priv 2017-03-14 2017-05-01
4.6
None Local Low Not required Partial Partial Partial
Arbitrary command execution vulnerability in Intel Security McAfee Security Scan Plus (SSP) 3.11.469 and earlier allows authenticated users to gain elevated privileges via unspecified vectors.
20 CVE-2016-8019 79 XSS 2017-03-14 2017-09-02
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in attributes in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows unauthenticated remote attackers to inject arbitrary web script or HTML via a crafted user input.
21 CVE-2016-8017 20 2017-03-14 2017-09-02
4.0
None Remote Low Single system Partial None None
Special element injection vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows authenticated remote attackers to read files on the webserver via a crafted user input.
22 CVE-2016-8012 264 2017-03-14 2017-03-31
4.6
None Local Low Not required Partial Partial Partial
Access control vulnerability in Intel Security Data Loss Prevention Endpoint (DLPe) 9.4.200 and 9.3.600 allows authenticated users with Read-Write-Execute permissions to inject hook DLLs into other processes via pages in the target process memory get.
23 CVE-2016-8010 284 Bypass 2017-03-14 2017-03-30
4.6
None Local Low Not required Partial Partial Partial
Application protections bypass vulnerability in Intel Security McAfee Application Control (MAC) 7.0 and earlier and Endpoint Security (ENS) 10.2 and earlier allows local users to bypass local security protection via a command-line utility.
24 CVE-2016-8009 264 Exec Code 2017-03-14 2017-03-27
4.6
None Local Low Not required Partial Partial Partial
Privilege escalation vulnerability in Intel Security McAfee Application Control (MAC) 7.0 and 6.x versions allows attackers to cause DoS, unexpected behavior, or potentially unauthorized code execution via an unauthorized use of IOCTL call.
25 CVE-2016-8005 264 2017-03-14 2017-03-30
4.0
None Remote Low Single system None Partial None
File extension filtering vulnerability in Intel Security McAfee Email Gateway (MEG) before 7.6.404h1128596 allows attackers to fail to identify the file name properly via scanning an email with a forged attached filename that uses a null byte within the filename extension.
26 CVE-2016-3969 79 XSS 2016-04-06 2016-05-19
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in McAfee Email Gateway (MEG) 7.6.x before 7.6.404, when File Filtering is enabled with the action set to ESERVICES:REPLACE, allows remote attackers to inject arbitrary web script or HTML via an attachment in a blocked email.
27 CVE-2015-8989 310 2017-03-14 2017-03-22
4.0
None Remote Low Single system Partial None None
Unsalted password vulnerability in the Enterprise Manager (web portal) component in Intel Security McAfee Vulnerability Manager (MVM) 7.5.8 and earlier allows attackers to more easily decrypt user passwords via brute force attacks against the database.
28 CVE-2015-8986 254 Bypass 2017-03-14 2017-03-23
4.3
None Remote Medium Not required None Partial None
Sandbox detection evasion vulnerability in hardware appliances in McAfee (now Intel Security) Advanced Threat Defense (MATD) 3.4.2.32 and earlier allows attackers to detect the sandbox environment, then bypass proper malware detection resulting in failure to detect a malware file (false-negative) via specially crafted malware.
29 CVE-2015-4559 79 XSS 2015-06-15 2016-11-28
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the product deployment feature in the Java core web services in Intel McAfee ePolicy Orchestrator (ePO) before 5.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
30 CVE-2015-3030 200 +Info 2015-04-08 2015-04-09
4.0
None Remote Low Single system Partial None None
The web interface in McAfee Advanced Threat Defense (MATD) before 3.4.4.63 allows remote authenticated users to obtain sensitive configuration information via unspecified vectors.
31 CVE-2015-3029 264 +Info 2015-04-08 2015-04-09
4.0
None Remote Low Single system Partial None None
The web interface in McAfee Advanced Threat Defense (MATD) before 3.4.4.63 does not properly restrict access, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
32 CVE-2015-2757 399 DoS 2015-03-27 2016-12-02
4.0
None Remote Low Single system None None Partial
The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated users to cause a denial of service (database lock or license corruption) via unspecified vectors.
33 CVE-2015-2053 20 2015-02-23 2016-11-29
4.3
None Remote Medium Not required None Partial None
The log viewer in McAfee Agent (MA) before 4.8.0 Patch 3 and 5.0.0, when the "Accept connections only from the ePO server" option is disabled, allows remote attackers to conduct clickjacking attacks via a crafted web page, aka an "http-generic-click-jacking" vulnerability.
34 CVE-2015-1618 200 +Info 2015-02-17 2015-02-18
4.0
None Remote Low Single system Partial None None
The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated users to obtain sensitive password information via a crafted URL.
35 CVE-2015-0921 2015-01-09 2017-09-07
4.0
None Remote Low Single system Partial None None
XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do.
36 CVE-2014-9920 284 2017-03-14 2017-03-29
4.3
None Remote Medium Not required None Partial None
Unauthorized execution of binary vulnerability in McAfee (now Intel Security) McAfee Application Control (MAC) 6.0.0 before hotfix 9726, 6.0.1 before hotfix 9068, 6.1.0 before hotfix 692, 6.1.1 before hotfix 399, 6.1.2 before hotfix 426, and 6.1.3 before hotfix 357 and earlier allows attackers to create a malformed Windows binary that is considered non-executable and is not protected through the whitelisting protection feature via a specific set of circumstances.
37 CVE-2014-8535 Bypass 2014-10-29 2014-10-30
4.6
None Local Low Not required Partial Partial Partial
McAfee Network Data Loss Prevention (NDLP) before 9.2.2 allows local users to bypass intended restriction on unspecified functionality via unknown vectors.
38 CVE-2014-6064 200 +Info 2014-09-02 2017-09-07
4.0
None Remote Low Single system Partial None None
The Accounts tab in the administrative user interface in McAfee Web Gateway (MWG) before 7.3.2.9 and 7.4.x before 7.4.2 allows remote authenticated users to obtain the hashed user passwords via unspecified vectors.
39 CVE-2014-2588 22 1 Dir. Trav. 2014-03-24 2017-08-28
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in servlet/downloadReport in McAfee Asset Manager 6.6 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the reportFileName parameter.
40 CVE-2014-2586 79 1 XSS 2014-03-24 2014-03-24
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in the login audit form in McAfee Cloud Single Sign On (SSO) allows remote attackers to inject arbitrary web script or HTML via a crafted password.
41 CVE-2014-2536 22 Dir. Trav. 2014-03-18 2014-04-01
4.3
None Remote Medium Not required Partial None None
Directory traversal vulnerability in McAfee Cloud Identity Manager 3.0, 3.1, and 3.5.1, McAfee Cloud Single Sign On (MCSSO) before 4.0.1, and Intel Expressway Cloud Access 360-SSO 2.1 and 2.5 allows remote authenticated users to read an unspecified file containing a hash of the administrator password via unknown vectors.
42 CVE-2014-2535 22 Dir. Trav. 2014-03-18 2017-08-28
4.0
None Remote Low Single system Partial None None
Directory traversal vulnerability in McAfee Web Gateway (MWG) 7.4.x before 7.4.1, 7.3.x before 7.3.2.6, and 7.2.0.9 and earlier allows remote authenticated users to read arbitrary files via a crafted request to the web filtering port.
43 CVE-2014-1472 79 XSS 2014-01-16 2017-08-28
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in the Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.5 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
44 CVE-2013-5094 79 XSS 2014-01-28 2016-12-30
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in index.exp in McAfee Vulnerability Manager 7.5 allows remote attackers to inject arbitrary web script or HTML via the cert_cn cookie parameter.
45 CVE-2013-4884 79 1 XSS 2014-01-21 2017-08-28
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in McAfee SuperScan 4.0 allows remote attackers to inject arbitrary web script or HTML via UTF-7 encoded sequences in a server response, which is not properly handled in the SuperScan HTML report.
46 CVE-2013-4883 79 XSS 2013-07-22 2013-08-22
4.3
None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePO Extension for the McAfee Agent (MA) 4.5 through 4.6, allow remote attackers to inject arbitrary web script or HTML via the (1) instanceId parameter core/loadDisplayType.do; (2) instanceId or (3) monitorUrl parameter to console/createDashboardContainer.do; uid parameter to (4) ComputerMgmt/sysDetPanelBoolPie.do or (5) ComputerMgmt/sysDetPanelSummary.do; (6) uid, (7) orion.user.security.token, or (8) ajaxMode parameter to ComputerMgmt/sysDetPanelQry.do; or (9) uid, (10) orion.user.security.token, or (11) ajaxMode parameter to ComputerMgmt/sysDetPanelSummary.do.
47 CVE-2013-0141 22 Dir. Trav. 2013-05-01 2017-11-15
4.3
None Local Network Medium Not required Partial Partial None
Directory traversal vulnerability in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to upload arbitrary files via a crafted request over the Agent-Server communication channel, as demonstrated by writing to the Software/ directory.
48 CVE-2012-4597 79 XSS 2012-08-22 2017-08-28
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in McAfee Email and Web Security (EWS) 5.5 through Patch 6 and 5.6 through Patch 3, and McAfee Email Gateway (MEG) 7.0.0 and 7.0.1, allows remote attackers to inject arbitrary web script or HTML via vectors related to the McAfee Security Appliance Management Console/Dashboard.
49 CVE-2012-4596 22 Dir. Trav. Bypass 2012-08-22 2013-04-10
4.3
None Remote Medium Not required Partial None None
Directory traversal vulnerability in McAfee Email Gateway (MEG) 7.0.0 and 7.0.1 allows remote authenticated users to bypass intended access restrictions and download arbitrary files via a crafted URL.
50 CVE-2012-4594 264 Bypass +Info 2012-08-22 2017-08-28
4.0
None Remote Low Single system Partial None None
McAfee ePolicy Orchestrator (ePO) 4.6.1 and earlier allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information from arbitrary reporting panels, via a modified ID value in a console URL.
Total number of vulnerabilities : 80   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.