CVE-2015-0921: mcafee epolicy_orchestrator

EPSS trend

Probability

17.36%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

0.00 pp

From 17.36% on 18-09-2026

18-09-202618-10-2026

EPSS score

17.36%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
MetasploitremoteUnverified
McAfee ePolicy Orchestrator Authenticated XXE Credentials Exposure
auxiliary/gather/mcafee_epo_xxe
Maturity: poc

References

8 links

secunia.com/advisories/61922Third Party AdvisoryX Refsource SECUNIA
seclists.org/fulldisclosure/2015/Jan/37Mailing ListX Refsource FULLDISCThird Party Advisory
kc.mcafee.com/corporate/index?page=content&id=SB10095X Refsource CONFIRMPatchVendor Advisory
packetstormsecurity.com/files/…X Refsource MISCExploitThird Party AdvisoryVDB Entry
seclists.org/fulldisclosure/2015/Jan/8Mailing ListX Refsource FULLDISCThird Party Advisory
www.securitytracker.com/id/1031519VDB EntryX Refsource SECTRACK
exchange.xforce.ibmcloud.com/vulnerabilities/99950VDB EntryX Refsource XF
gist.github.com/brandonprry/692e553975bf29aeaf2cX Refsource MISC

Related vulnerabilities

CVE-2018-6660mcafeeepolicy_orchestrator+11.65%8y ago02-04-2018 13:00Directory Traversal vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows administrators to use Windows alternate data streams, which could be used to bypass the file extensions, via not properly validating the path when exporting a particular XML file.CVE-2018-6659mcafeeepolicy_orchestrator+11.02%8y ago02-04-2018 17:00Reflected Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows remote authenticated users to exploit an XSS issue via not sanitizing the user input.CVE-2003-0616mcafeeepolicy_orchestrator3.04%23y ago01-08-2003 04:00Format string vulnerability in ePO service for McAfee ePolicy Orchestrator 2.0, 2.5, and 2.5.1 allows remote attackers to execute arbitrary code via a POST request with format strings in the computerlist parameter, which are used when logging a failed name resolution.CVE-2003-0148mcafeeepolicy_orchestrator0.56%23y ago01-08-2003 04:00The default installation of MSDE via McAfee ePolicy Orchestrator 2.0 through 3.0 allows attackers to execute arbitrary code via a series of steps that (1) obtain the database administrator username and encrypted password in a configuration file from the ePO server using a certain request, (2) crack the password due to weak cryptography, and (3) use the password to pass commands through xp_cmdshell.CVE-2003-0149mcafeeepolicy_orchestrator3.74%23y ago01-08-2003 04:00Heap-based buffer overflow in ePO agent for McAfee ePolicy Orchestrator 2.0, 2.5, and 2.5.1 allows remote attackers to execute arbitrary code via a POST request containing long parameters.CVE-2003-0610mcafeeepolicy_orchestrator2.37%23y ago01-08-2003 04:00Directory traversal vulnerability in ePO agent for McAfee ePolicy Orchestrator 3.0 allows remote attackers to read arbitrary files via a certain HTTP request.

All vulnerabilities inepolicy_orchestrator

CVE-2015-0921: mcafee epolicy_orchestrator

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References