Mcafee, LLC vulnerabilities, page 4
87 vulnerabilities
Known vulnerabilities in Mcafee, LLC products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 37 products.
CVE-2019-3665mcafee, llcmcafee web advisor (wa)+1
EPSS score0.94%
Code Injection vulnerability in the web interface in McAfee Web Advisor (WA) prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to render a website which Web Advisor would normally have blocked via a carefully crafted web site.CVE-2019-3582mcafee, llcmcafee endpoint security (ens)+1EPSS score0.38%
Privilege Escalation vulnerability in Microsoft Windows client in McAfee Endpoint Security (ENS) 10.6.1 and earlier allows local users to gain elevated privileges via a specific set of circumstances.CVE-2019-3652mcafee, llcmcafee endpoint security (ens)+1EPSS score0.33%
Code Injection vulnerability in EPSetup.exe in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to get their malicious code installed by the ENS installer via code injection into EPSetup.exe by an attacker with access to the installer.CVE-2019-3612mcafee, llcdata exchange layer (dxl) platform+3EPSS score0.24%
Information Disclosure vulnerability in McAfee DXL Platform and TIE Server in DXL prior to 5.0.1 HF2 and TIE prior to 2.3.1 HF1 allows Authenticated users to view sensitive information in plain text via the GUI or command line.CVE-2019-3646mcafee, llcmcafee total protection - free antivirus trial+1EPSS score1.48%
DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Free Antivirus Trial 16.0.R18 and earlier allows local users to execute arbitrary code via execution from a compromised folder placed by an attacker with administrator rights.CVE-2019-3606mcafee, llcmcafee network security manager (nsm)+1EPSS score0.21%
Data Leakage Attacks vulnerability in the web portal component when in an MDR pair in McAfee Network Security Management (NSM) 9.1 < 9.1.7.75 (Update 4) and 9.2 < 9.2.7.31 Update2 allows administrators to view configuration information in plain text format via the GUI or GUI terminal commands.CVE-2019-3597mcafee, llcmcafee network security manager (nsm)+1EPSS score1.12%
Authentication Bypass vulnerability in McAfee Network Security Manager (NSM) 9.1 < 9.1.7.75.2 and 9.2 < 9.2.7.31 (9.2 Update 2) allows unauthenticated users to gain administrator rights via incorrect handling of expired GUI sessions.CVE-2019-3635mcafee, llcmcafee web gateway (mwg)+1EPSS score1.18%
Exfiltration of Data in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows attackers to obtain sensitive data via crafting a complex webpage that will trigger the Web Gateway to block the user accessing an iframe.CVE-2019-3619mcafee, llcmcafee epolicy orchestrator (epo)+1EPSS score1.12%
Information Disclosure vulnerability in the Agent Handler in McAfee ePolicy Orchestrator (ePO) 5.9.x and 5.10.0 prior to 5.10.0 update 4 allows remote unauthenticated attacker to view sensitive information in plain text via sniffing the traffic between the Agent Handler and the SQL server.CVE-2019-3599mcafee, llcmcafee agent (ma)+1EPSS score1.82%
Information Disclosure vulnerability in Remote logging (which is disabled by default) in McAfee Agent (MA) 5.x allows remote unauthenticated users to access sensitive information via remote logging when it is enabled.CVE-2019-3617mcafee, llctotal protection (tops) for mac os+1EPSS score0.32%
Privilege escalation vulnerability in McAfee Total Protection (ToPS) for Mac OS prior to 4.6 allows local users to gain root privileges via incorrect protection of temporary files.CVE-2019-3610mcafee, llctrue key (tk)+1EPSS score0.30%
Data Leakage Attacks vulnerability in Microsoft Windows client in McAfee True Key (TK) 3.1.9211.0 and earlier allows local users to expose confidential data via specially crafted malware.CVE-2019-3639mcafee, llcmcafee web gateway (mwg)+1EPSS score1.24%
Clickjack vulnerability in Adminstrator web console in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows remote attackers to conduct clickjacking attacks via a crafted web page that contains an iframe via does not send an X-Frame-Options HTTP header.CVE-2019-3586mcafee, llcmcafee endpoint security (ens)+1EPSS score0.76%
Protection Mechanism Failure in the Firewall in McAfee Endpoint Security (ENS) 10.x prior to 10.6.1 May 2019 update allows context-dependent attackers to circumvent ENS protection where GTI flagged IP addresses are not blocked by the ENS Firewall via specially crafted malicious sites where the GTI reputation is carefully manipulated and does not correctly trigger the ENS Firewall to block the connection.CVE-2019-3602mcafee, llcmcafee network security manager (nsm)+1EPSS score0.62%
Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) Prior to 9.1 Update 5 allows an authenticated administrator to embed an XSS in the administrator interface via a specially crafted custom rule containing HTML.CVE-2019-3670mcafee, llcweb advisor (wa)+1EPSS score1.16%
Remote Code Execution vulnerability in the web interface in McAfee Web Advisor (WA) 8.0.34745 and earlier allows remote unauthenticated attacker to execute arbitrary code via a cross site scripting attack.CVE-2019-3653mcafee, llcmcafee endpoint security (ens)+1EPSS score0.23%
Improper access control vulnerability in Configuration tool in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to gain access to security configuration via unauthorized use of the configuration tool.CVE-2019-3591mcafee, llcdata loss prevention epo extension+1EPSS score0.83%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ePO extension in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted upload to a remote website which is correctly blocked by DLPe Web Protection. This would then render as an XSS when the DLP Admin viewed the event in the ePO UI.CVE-2019-3644mcafee, llcmcafee web gateway (mwg)+4EPSS score2.39%
McAfee Web Gateway (MWG) earlier than 7.8.2.13 is vulnerable to a remote attacker exploiting CVE-2019-9517, potentially leading to a denial of service. This affects the scanning proxies.CVE-2019-3613mcafee, llcmcafee agent (ma)+1EPSS score0.38%
DLL Search Order Hijacking vulnerability in McAfee Agent (MA) prior to 5.6.4 allows attackers with local access to execute arbitrary code via execution from a compromised folder.