Mcafee, LLC Mcafee Endpoint Security (Ens) vulnerabilities
17 vulnerabilities
Known vulnerabilities in Mcafee, LLC Mcafee Endpoint Security (Ens), newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2020-7257mcafee, llcmcafee endpoint security (ens)+1
EPSS score0.25%
Privilege escalation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows local users to cause the deletion and creation of files they would not normally have permission to through altering the target of symbolic links whilst an anti-virus scan was in progress. This is timing dependent.CVE-2020-7259mcafee, llcmcafee endpoint security (ens)+1EPSS score0.25%
Exploitation of Privilege/Trust vulnerability in file in McAfee Endpoint Security (ENS) Prior to 10.7.0 February 2020 Update allows local users to bypass local security protection via a carefully crafted input fileCVE-2020-7276mcafee, llcmcafee endpoint security (ens)+1EPSS score0.28%
Authentication bypass vulnerability in MfeUpgradeTool in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 April 2020 Update allows administrator users to access policy settings via running this tool.CVE-2020-7251mcafee, llcmcafee endpoint security (ens)+1EPSS score0.21%
Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS.CVE-2020-7273mcafee, llcmcafee endpoint security (ens)+1EPSS score0.25%
Accessing functionality not properly constrained by ACLs vulnerability in the autorun start-up protection in McAfee Endpoint Security (ENS) for Windows Prior to 10.7.0 April 2020 Update allows local users to delete or rename programs in the autorun key via manipulation of some parameters.CVE-2020-7275mcafee, llcmcafee endpoint security (ens)+1EPSS score0.31%
Accessing, modifying or executing executable files vulnerability in the uninstaller in McAfee Endpoint Security (ENS) for Windows Prior to 10.7.0 April 2020 Update allows local users to execute arbitrary code via a carefully crafted input file.CVE-2020-7277mcafee, llcmcafee endpoint security (ens)+1EPSS score0.27%
Protection mechanism failure in all processes in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 April 2020 Update allows local users to stop certain McAfee ENS processes, reducing the protection offered.CVE-2020-7274mcafee, llcmcafee endpoint security (ens)+1EPSS score0.23%
Privilege escalation vulnerability in McTray.exe in McAfee Endpoint Security (ENS) for Windows Prior to 10.7.0 April 2020 Update allows local users to spawn unrelated processes with elevated privileges via the system administrator granting McTray.exe elevated privileges (by default it runs with the current user's privileges).CVE-2020-7250mcafee, llcmcafee endpoint security (ens)+1EPSS score0.39%
Symbolic link manipulation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows authenticated local user to potentially gain an escalation of privileges by pointing the link to files which the user which not normally have permission to alter via carefully creating symbolic links from the ENS log file directory.CVE-2020-7278mcafee, llcmcafee endpoint security (ens)+1EPSS score0.64%
Exploiting incorrectly configured access control security levels vulnerability in ENS Firewall in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 April 2020 and 10.6.1 April 2020 updates allows remote attackers and local users to allow or block unauthorized traffic via pre-existing rules not being handled correctly when updating to the February 2020 updates.CVE-2020-7261mcafee, llcmcafee endpoint security (ens)+1EPSS score0.26%
Buffer Overflow via Environment Variables vulnerability in AMSI component in McAfee Endpoint Security (ENS) Prior to 10.7.0 February 2020 Update allows local users to disable Endpoint Security via a carefully crafted user input.CVE-2020-7331mcafee, llcmcafee endpoint security (ens)+1EPSS score0.42%
Unquoted service executable path in McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows local users to cause a denial of service and malicious file execution via carefully crafted and named executable files.CVE-2020-7255mcafee, llcmcafee endpoint security (ens)+1EPSS score0.23%
Privilege escalation vulnerability in the administrative user interface in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows local users to gain elevated privileges via ENS not checking user permissions when editing configuration in the ENS client interface. Administrators can lock the ENS client interface through ePO to prevent users being able to edit the configuration.CVE-2019-3582mcafee, llcmcafee endpoint security (ens)+1EPSS score0.38%
Privilege Escalation vulnerability in Microsoft Windows client in McAfee Endpoint Security (ENS) 10.6.1 and earlier allows local users to gain elevated privileges via a specific set of circumstances.CVE-2019-3652mcafee, llcmcafee endpoint security (ens)+1EPSS score0.33%
Code Injection vulnerability in EPSetup.exe in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to get their malicious code installed by the ENS installer via code injection into EPSetup.exe by an attacker with access to the installer.CVE-2019-3586mcafee, llcmcafee endpoint security (ens)+1EPSS score0.76%
Protection Mechanism Failure in the Firewall in McAfee Endpoint Security (ENS) 10.x prior to 10.6.1 May 2019 update allows context-dependent attackers to circumvent ENS protection where GTI flagged IP addresses are not blocked by the ENS Firewall via specially crafted malicious sites where the GTI reputation is carefully manipulated and does not correctly trigger the ENS Firewall to block the connection.CVE-2019-3653mcafee, llcmcafee endpoint security (ens)+1EPSS score0.23%
Improper access control vulnerability in Configuration tool in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to gain access to security configuration via unauthorized use of the configuration tool.