Mcafee, LLC vulnerabilities, page 3

87 vulnerabilities

Known vulnerabilities in Mcafee, LLC products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 37 products.

8.2CVE-2020-7250mcafee, llcmcafee endpoint security (ens)+1
EPSS score
0.39%
Symbolic link manipulation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows authenticated local user to potentially gain an escalation of privileges by pointing the link to files which the user which not normally have permission to alter via carefully creating symbolic links from the ENS log file directory.7.4CVE-2020-7278mcafee, llcmcafee endpoint security (ens)+1
EPSS score
0.64%
Exploiting incorrectly configured access control security levels vulnerability in ENS Firewall in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 April 2020 and 10.6.1 April 2020 updates allows remote attackers and local users to allow or block unauthorized traffic via pre-existing rules not being handled correctly when updating to the February 2020 updates.7.8CVE-2020-7279mcafee, llcmcafee host intrusion prevention system (host ips) for windows+1
EPSS score
0.42%
DLL Search Order Hijacking Vulnerability in the installer component of McAfee Host Intrusion Prevention System (Host IPS) for Windows prior to 8.0.0 Patch 15 Update allows attackers with local access to execute arbitrary code via execution from a compromised folder.6.1CVE-2020-7261mcafee, llcmcafee endpoint security (ens)+1
EPSS score
0.26%
Buffer Overflow via Environment Variables vulnerability in AMSI component in McAfee Endpoint Security (ENS) Prior to 10.7.0 February 2020 Update allows local users to disable Endpoint Security via a carefully crafted user input.7.8CVE-2020-7331mcafee, llcmcafee endpoint security (ens)+1
EPSS score
0.42%
Unquoted service executable path in McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows local users to cause a denial of service and malicious file execution via carefully crafted and named executable files.4.4CVE-2020-7255mcafee, llcmcafee endpoint security (ens)+1
EPSS score
0.23%
Privilege escalation vulnerability in the administrative user interface in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows local users to gain elevated privileges via ENS not checking user permissions when editing configuration in the ENS client interface. Administrators can lock the ENS client interface through ePO to prevent users being able to edit the configuration.5.5CVE-2020-7343mcafee, llcmcafee agent+1
EPSS score
0.36%
Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files.6.7CVE-2019-3637mcafee, llcmcafee frp+1
EPSS score
0.28%
Privilege Escalation vulnerability in McAfee FRP 5.x prior to 5.1.0.209 allows local users to gain elevated privileges via running McAfee Tray with elevated privileges.6.5CVE-2019-3595mcafee, llcdlp endpoint epo extension+1
EPSS score
0.71%
Improper Neutralization of Special Elements used in a Command ('Command Injection') in ePO extension in McAfee Data Loss Prevention (DLP) 11.x prior to 11.3.0 allows Authenticated Adminstrator to execute arbitrary code with their local machine privileges via a specially crafted DLP policy, which is exported and opened on the their machine. In our checks, the user must explicitly allow the code to execute.5.5CVE-2019-3634mcafee, llcdata loss prevention (dlpe) for windows+1
EPSS score
0.25%
Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via an encrypted message sent to DLPe which when decrypted results in DLPe reading unallocated memory.6.5CVE-2019-3666mcafee, llcmcafee web advisor (wa)+1
EPSS score
1.52%
API Abuse/Misuse vulnerability in the web interface in McAfee Web Advisor (WA) prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to navigate to restricted websites via a carefully crafted web site.6.8CVE-2019-3621mcafee, llcdata loss prevention (dlpe) for windows+1
EPSS score
0.35%
Authentication protection bypass vulnerability in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows physical local user to bypass the Windows lock screen via DLPe processes being killed just prior to the screen being locked or when the screen is locked. The attacker requires physical access to the machine.7.5CVE-2019-3593mcafee, llctotal protection (mtp)+1
EPSS score
0.35%
Exploitation of Privilege/Trust vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Prior to 16.0.R18 allows local users to bypass product self-protection, tamper with policies and product files, and uninstall McAfee software without permission via specially crafted malware.8CVE-2019-3631mcafee, llcmcafee enterprise security manager (esm)+1
EPSS score
2.01%
Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary code via specially crafted parameters.7.2CVE-2019-3592mcafee, llcmcafee agent (ma)+1
EPSS score
0.32%
Privilege escalation vulnerability in McAfee Agent (MA) before 5.6.1 HF3, allows local administrator users to potentially disable some McAfee processes by manipulating the MA directory control and placing a carefully constructed file in the MA directory.5.5CVE-2019-3633mcafee, llcdata loss prevention (dlpe) for windows+1
EPSS score
0.25%
Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via a carefully constructed message sent to DLPe which bypasses DLPe internal checks and results in DLPe reading unallocated memory.8.8CVE-2019-3604mcafee, llcepolicy orchestrator cloud
EPSS score
0.44%
Cross-Site Request Forgery (CSRF) vulnerability in McAfee ePO (legacy) Cloud allows unauthenticated users to perform unintended ePO actions using an authenticated user's session via unspecified vectors.8CVE-2019-3630mcafee, llcmcafee enterprise security manager (esm)+1
EPSS score
2.01%
Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary code via specially crafted parameters.8.2CVE-2019-3622mcafee, llcdata loss prevention (dlpe) for windows+1
EPSS score
0.33%
Files or Directories Accessible to External Parties in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows authenticated user to redirect DLPe log files to arbitrary locations via incorrect access control applied to the DLPe log folder allowing privileged users to create symbolic links.7.5CVE-2019-3643mcafee, llcmcafee web gateway (mwg)+4
EPSS score
2.39%
McAfee Web Gateway (MWG) earlier than 7.8.2.13 is vulnerable to a remote attacker exploiting CVE-2019-9511, potentially leading to a denial of service. This affects the scanning proxies.