Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 39

Export CSV
CVE-2021-23886

Local Denial of Service in McAfee DLP Endpoint for Windows

Denial of Service vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to cause a BSoD through suspending a process, modifying the processes memory and restarting it. This is triggered by the hdlphook driver reading invalid memory.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Data Loss Prevention Endpoint
CVE-2020-7307

DLP for Mac - Unprotected Storage of Credentials

Unprotected Storage of Credentials vulnerability in McAfee Data Loss Prevention (DLP) for Mac prior to 11.5.2 allows local users to gain access to the RiskDB username and password via unprotected log files containing plain text credentials.

CVSS 3.1 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Data Loss Prevention
CVE-2020-7306

DLP for Mac - Unprotected Storage of Credentials

Unprotected Storage of Credentials vulnerability in McAfee Data Loss Prevention (DLP) for Mac prior to 11.5.2 allows local users to gain access to the ADRMS username and password via unprotected log files containing plain text

CVSS 3.1 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Data Loss Prevention
CVE-2020-7305

DLP ePO extension - Privilege escalation

Privilege escalation vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows a low privileged remote attacker to create new rule sets via incorrect validation of user credentials.

CVSS 3.1 · 6.7 Medium EPSS 1.0% KEV · Not listed
Vendors
Mcafee
Products
Data Loss Prevention
CVE-2020-7304

DLP ePO extension - Cross-site request forgery

Cross site request forgery vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated remote attacker to embed a CRSF script via adding a new label.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Data Loss Prevention
CVE-2020-7303

DLP ePO extension - Cross-site scripting

Cross Site scripting vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated remote user to trigger scripts to run in a user's browser via adding a new label.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Data Loss Prevention
CVE-2020-7302

DLP ePO extension - Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated attackers to upload malicious files to the DLP case management section via lack of sanity checking.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Data Loss Prevention
CVE-2020-7301

DLP ePO extension - Cross site scripting

Cross Site scripting vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated attackers to trigger alerts via the file upload tab in the DLP case management section.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Data Loss Prevention
CVE-2020-7300

DLP ePO extension - Improper Authorization

Improper Authorization vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated remote attackers to change the configuration when logged in with view only privileges via carefully constructed HTTP post messages.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Data Loss Prevention
CVE-2019-3640

Data Loss Prevention - Unprotected Transport of Credentials

Unprotected Transport of Credentials in ePO extension in McAfee Data Loss Prevention 11.x prior to 11.4.0 allows remote attackers with access to the network to collect login details to the LDAP server via the ePO extension not using a secure connection when testing LDAP connectivity.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Data Loss Prevention
CVE-2019-3634

Buffer overflow in DLP Endpoint for Windows

Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via an encrypted message sent to DLPe which when decrypted results in DLPe reading unallocated memory.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee Microsoft
Products
Data Loss Prevention Endpoint Windows
CVE-2019-3633

Buffer overflow in DLP Endpoint for Windows

Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via a carefully constructed message sent to DLPe which bypasses DLPe internal checks and results in DLPe reading unallocated memory.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee Microsoft
Products
Data Loss Prevention Endpoint Windows
CVE-2019-3622

DLP Endpoint log file redirection to arbitrary locations

Files or Directories Accessible to External Parties in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows authenticated user to redirect DLPe log files to arbitrary locations via incorrect access control applied to the DLPe log folder allowing privileged users to create symbolic links.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Mcafee Microsoft
Products
Data Loss Prevention Endpoint Windows
CVE-2019-3621

DLP Endpoint Windows lock screen bypass with physical access

Authentication protection bypass vulnerability in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows physical local user to bypass the Windows lock screen via DLPe processes being killed just prior to the screen being locked or when the screen is locked. The attacker requires physical access to the machine.

CVSS 3.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee Microsoft
Products
Data Loss Prevention Endpoint Windows
CVE-2019-3595

DLP Endpoint ePO extension not sanitizing CSV exports

Improper Neutralization of Special Elements used in a Command ('Command Injection') in ePO extension in McAfee Data Loss Prevention (DLP) 11.x prior to 11.3.0 allows Authenticated Adminstrator to execute arbitrary code with their local machine privileges via a specially crafted DLP policy, which is exported and opened on the their machine. In our checks, the user must explicitly allow the code to execute.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Data Loss Prevention Endpoint
CVE-2019-3591

DLP Endpoint ePO extension vulnerable to XSS

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ePO extension in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted upload to a remote website which is correctly blocked by DLPe Web Protection. This would then render as an XSS when the DLP Admin viewed the event in the ePO UI.

CVSS 3.0 · 3.9 Low EPSS < 1% KEV · Not listed
Vendors
Mcafee Microsoft
Products
Data Loss Prevention Endpoint Windows
CVE-2018-6689

Data Loss Prevention Endpoint (DLPe) - Authentication Bypass vulnerability

Authentication Bypass vulnerability in McAfee Data Loss Prevention Endpoint (DLPe) 10.0.x earlier than 10.0.510, and 11.0.x earlier than 11.0.600 allows attackers to bypass local security protection via specific conditions.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Data Loss Prevention Endpoint
CVE-2018-6683

- Data Loss Prevention (DLP) for Windows - Exploiting Incorrectly Configured Access Control Security Levels vulnerability

Exploiting Incorrectly Configured Access Control Security Levels vulnerability in McAfee Data Loss Prevention (DLP) for Windows versions prior to 10.0.505 and 11.0.405 allows local users to bypass DLP policy via editing of local policy files when offline.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Mcafee Microsoft
Products
Data Loss Prevention Endpoint Windows
CVE-2018-6664

SB10233 - Data Loss Prevention (DLP) Endpoint before 10.0.500 and DLP Endpoint before 11.0.400 - Application Protections Bypass vulnerability

Application Protections Bypass vulnerability in Microsoft Windows in McAfee Data Loss Prevention (DLP) Endpoint before 10.0.500 and DLP Endpoint before 11.0.400 allows authenticated users to bypass the product block action via a command-line utility.

CVSS 3.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee Microsoft
Products
Data Loss Prevention Endpoint Windows