Mcafee vulnerabilities
596 vulnerabilities
Known vulnerabilities in Mcafee products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 173 products.
Products
50 of 173- Epolicy Orchestrator85 vulnerabilities
- Web Gateway42 vulnerabilities
- Endpoint Security37 vulnerabilities
- Network Data Loss Prevention31 vulnerabilities
- Virusscan Enterprise29 vulnerabilities
- Advanced Threat Defense26 vulnerabilities
- Data Loss Prevention Endpoint26 vulnerabilities
- Total Protection26 vulnerabilities
- Agent25 vulnerabilities
- Email Gateway19 vulnerabilities
- Network Security Manager19 vulnerabilities
- Network Security Management (Nsm)16 vulnerabilities
- Gateway13 vulnerabilities
- Advanced Threat Defense (Atd)12 vulnerabilities
- Data Loss Prevention12 vulnerabilities
- Scan Engine12 vulnerabilities
- Email And Web Security10 vulnerabilities
- Mcafee Agent10 vulnerabilities
- Antivirus Engine9 vulnerabilities
- Enterprise Security Manager9 vulnerabilities
- Policy Auditor9 vulnerabilities
- Application And Change Control8 vulnerabilities
- Database Security8 vulnerabilities
- Mcafee Web Gateway (Mwg)8 vulnerabilities
- Network Data Loss Prevention (Ndlp)8 vulnerabilities
- True Key8 vulnerabilities
- Virusscan8 vulnerabilities
- Active Response7 vulnerabilities
- Application Control7 vulnerabilities
- Security Scan Plus7 vulnerabilities
- Threat Intelligence Exchange Server7 vulnerabilities
- DLP Epo Extension6 vulnerabilities
- E Business Server6 vulnerabilities
- Enterprise Mobility Manager6 vulnerabilities
- Epolicy Orchestrator (Epo)6 vulnerabilities
- Mvision Endpoint6 vulnerabilities
- Protectionpilot6 vulnerabilities
- Vulnerability Manager6 vulnerabilities
- Common Management Agent5 vulnerabilities
- Data Exchange Layer5 vulnerabilities
- Internet Security Suite4 vulnerabilities
- Mcafee Web Gateway4 vulnerabilities
- Application Change Control3 vulnerabilities
- Change Control3 vulnerabilities
- Cloud Av3 vulnerabilities
- Drive Encryption3 vulnerabilities
- Endpoint Detection And Response3 vulnerabilities
- Epolicy Orchestrator Agent3 vulnerabilities
- File And Removable Media Protection3 vulnerabilities
- Host Intrusion Prevention3 vulnerabilities
CVE-2018-18311alpineperl+57
EPSS score11.68%
Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.CVE-2018-10381mcafeetunnelbearEPSS score3.77%
TunnelBear 3.2.0.6 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "TunnelBearMaintenance" service. This service establishes a NetNamedPipe endpoint that allows arbitrary installed applications to connect and call publicly exposed methods. The "OpenVPNConnect" method accepts a server list argument that provides attacker control of the OpenVPN command line. An attacker can specify a dynamic library plugin that should run for every new VPN connection attempt. This plugin will execute code in the context of the SYSTEM user.CVE-2018-6660mcafeeepolicy_orchestrator+1EPSS score1.65%
Directory Traversal vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows administrators to use Windows alternate data streams, which could be used to bypass the file extensions, via not properly validating the path when exporting a particular XML file.CVE-2018-6677mcafeemcafee_web_gateway+1EPSS score2.14%
Directory Traversal vulnerability in the administrative user interface in McAfee Web Gateway (MWG) MWG 7.8.1.x allows authenticated administrator users to gain elevated privileges via unspecified vectors.CVE-2018-6674mcafee, llcvirusscan enterprise (vse)+1EPSS score0.18%
Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 13 allows local users to spawn unrelated processes with elevated privileges via the system administrator granting McTray.exe elevated privileges (by default it runs with the current user's privileges).CVE-2018-6672mcafeeepolicy_orchestrator+1EPSS score1.20%
Information disclosure vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows authenticated users to view sensitive information in plain text format via unspecified vectors.CVE-2018-6689mcafeedata_loss_prevention_endpoint+1EPSS score0.36%
Authentication Bypass vulnerability in McAfee Data Loss Prevention Endpoint (DLPe) 10.0.x earlier than 10.0.510, and 11.0.x earlier than 11.0.600 allows attackers to bypass local security protection via specific conditions.CVE-2018-6706mcafeeagent+1EPSS score0.62%
Insecure handling of temporary files in non-Windows McAfee Agent 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows an Unprivileged User to introduce custom paths during agent installation in Linux via unspecified vectors.CVE-2018-6686mcafeedrive_encryption+1EPSS score0.24%
Authentication Bypass vulnerability in TPM autoboot in McAfee Drive Encryption (MDE) 7.1.0 and above allows physically proximate attackers to bypass local security protection via specific set of circumstances.CVE-2018-6668mcafeeapplication_and_change_control+1EPSS score0.43%
A whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and before allows execution bypass, for example, with simple DLL through interpreters such as PowerShell.CVE-2018-6683mcafeedata loss prevention (dlp) for windows+1EPSS score0.30%
Exploiting Incorrectly Configured Access Control Security Levels vulnerability in McAfee Data Loss Prevention (DLP) for Windows versions prior to 10.0.505 and 11.0.405 allows local users to bypass DLP policy via editing of local policy files when offline.CVE-2018-6681mcafeenetwork security management (nsm)+1EPSS score0.50%
Abuse of Functionality vulnerability in the web interface in McAfee Network Security Management (NSM) 9.1.7.11 and earlier allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via appliance web interface.CVE-2018-6667mcafeemcafee_web_gateway+1EPSS score3.52%
Authentication Bypass vulnerability in the administrative user interface in McAfee Web Gateway 7.8.1.0 through 7.8.1.5 allows remote attackers to execute arbitrary code via Java management extensions (JMX).CVE-2018-6707mcafeeagent+1EPSS score0.33%
Denial of Service through Resource Depletion vulnerability in the agent in non-Windows McAfee Agent (MA) 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows local users to cause DoS, unexpected behavior, or potentially unauthorized code execution via knowledge of the internal trust mechanism.CVE-2018-6756mcafeetrue_keyEPSS score1.03%
Authentication Abuse vulnerability in Microsoft Windows client in McAfee True Key (TK) 5.1.230.7 and earlier allows local users to execute unauthorized commands via specially crafted malware.CVE-2018-6704mcafeeagent+1EPSS score0.37%
Privilege escalation vulnerability in McAfee Agent (MA) for Linux 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows local users to perform arbitrary command execution via specific conditions.CVE-2018-6670mcafeecommon_catalog+1EPSS score0.97%
External Entity Attack vulnerability in the ePO extension in McAfee Common UI (CUI) 2.0.2 allows remote authenticated users to view confidential information via a crafted HTTP request parameter.CVE-2018-6703mcafee, llcmcafee agent+1EPSS score3.23%
Use After Free in Remote logging (which is disabled by default) in McAfee McAfee Agent (MA) 5.x prior to 5.6.0 allows remote unauthenticated attackers to cause a Denial of Service and potentially a remote code execution via a specially crafted HTTP header sent to the logging service.CVE-2018-6690mcafeeapplication_change_control+1EPSS score0.26%
Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.CVE-2018-6695mcafeethreat_intelligence_exchange_server+1EPSS score0.70%
SSH host keys generation vulnerability in the server in McAfee Threat Intelligence Exchange Server (TIE Server) 1.3.0, 2.0.x, 2.1.x, 2.2.0 allows man-in-the-middle attackers to spoof servers via acquiring keys from another environment.