Trellix vulnerabilities, page 2
56 vulnerabilities
Known vulnerabilities in Trellix products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 45 products.
CVE-2024-0310trellixendpoint_security_web_control+1
EPSS score0.42%
A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy configuration.CVE-2024-0213trellixagent+1EPSS score0.17%
A buffer overflow vulnerability in TA for Linux and TA for MacOS prior to 5.8.1 allows a local user to gain elevated permissions, or cause a Denial of Service (DoS), through exploiting a memory corruption issue in the TA service, which runs as root. This may also result in the disabling of event reporting to ePO, caused by failure to validate input from the file correctly.CVE-2024-0206trellixanti-malware_engineEPSS score0.18%
A symbolic link manipulation vulnerability in Trellix Anti-Malware Engine prior to the January 2024 release allows an authenticated local user to potentially gain an escalation of privileges. This was achieved by adding an entry to the registry under the Trellix ENS registry folder with a symbolic link to files that the user wouldn't normally have permission to. After a scan, the Engine would follow the links and remove the filesCVE-2024-9679trellixdlp extensionEPSS score0.37%
A Hardcoded Cryptographic key vulnerability existed in DLP Extension 11.11.1.3 which allowed the decryption of previously encrypted user credentials.CVE-2024-9678trellixdlp extensionEPSS score0.75%
An SQL Injection vulnerability existed in DLP Extension 11.11.1.3. The vulnerability allowed an attacker to perform arbitrary SQL queries potentially leading to command execution.CVE-2024-4844trellixepolicy orchestratorEPSS score0.23%
Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privileges on the ePO server to read the contents of the orion.keystore file, allowing them to access the ePO database encryption key. This was possible through using a hard coded password for the keystore. Access Control restrictions on the file mean this would not be exploitable unless the user is the system admin for the server that ePO is running on.CVE-2024-4843trellixepolicy orchestratorEPSS score0.27%
ePO doesn't allow a regular privileged user to delete tasks or assignments. Insecure direct object references that allow a least privileged user to manipulate the client task and client task assignments, hence escalating his/her privilege.CVE-2024-4176trellixtrellix edr ui (xconsole)+1EPSS score0.31%
An Cross site scripting vulnerability in the EDR XConsole before this release allowed an attacker to potentially leverage an XSS/HTML-Injection using command line variables. A malicious threat actor could execute commands on the victim's browser for sending carefully crafted malicious links to the EDR XConsole end user.CVE-2024-7608trellixtrellix nx, ex, ax, fx, cms and ivxEPSS score0.29%
An authenticated user can access the restricted files from NX, EX, FX, AX, IVX and CMS using path traversal.CVE-2024-5731trellixintrusion prevention system (ips) managerEPSS score0.27%
A vulnerability in the IPS Manager, Central Manager, and Local Manager communication workflow allows an attacker to control the destination of a request by manipulating the parameter, thereby leveraging sensitive information.CVE-2024-5671trellixintrusion prevention system (ips) managerEPSS score0.93%
Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vulnerable Trellix IPS Manager.CVE-2024-5956trellixintrusion prevention system (ips) manager+1EPSS score0.39%
This vulnerability allows unauthenticated remote attackers to bypass authentication and gain partial data access to the vulnerable Trellix IPS Manager with garbage data in response mostlyCVE-2024-5957trellixintrusion prevention system (ips) manager+1EPSS score0.38%
This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager.CVE-2024-5955trellixepo onprem sp1 update4EPSS score0.37%
Cross-site scripting vulnerability in Trellix ePolicy Orchestrator prior to ePO 5.10 Service Pack 1 Update 3 allows a remote authenticated attacker to craft requests causing arbitrary content to be injected into the response when accessing the epolicy Orchestrator.CVE-2026-12588trellixtrellix hx consoleEPSS score0.33%
An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection would then trigger decompression of a large file that consumes an excessive amount of system resources thus causing a Denial of Service.CVE-2023-1388trellixagent+1EPSS score0.57%
A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the macmnsvc process memory block, resulting in the service becoming unavailable.CVE-2023-0214skyhigh securitysecure web gateway (swg)+1EPSS score1.89%
A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party website, causing arbitrary content to be injected into the response when accessed through SWG.CVE-2023-0976trellixagent+1EPSS score0.62%
A command Injection Vulnerability in TA for mac-OS prior to version 5.7.9 allows local users to place an arbitrary file into the /Library/Trellix/Agent/bin/ folder. The malicious file is executed by running the TA deployment feature located in the System Tree.CVE-2023-0977trellixagent+1EPSS score0.64%
A heap-based overflow vulnerability in Trellix Agent (Windows and Linux) version 5.7.8 and earlier, allows a remote user to alter the page heap in the macmnsvc process memory block resulting in the service becoming unavailable.CVE-2023-0221mcafeeapplication_and_change_control+1EPSS score0.18%
Product security bypass vulnerability in ACC prior to version 8.3.4 allows a locally logged-in attacker with administrator privileges to bypass the execution controls provided by ACC using the utilman program.