Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 39

Export CSV
CVE-2020-7276

Unrestricted Policy Management using MfeUpgradeTool.exe

Authentication bypass vulnerability in MfeUpgradeTool in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 April 2020 Update allows administrator users to access policy settings via running this tool.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7275

Unquoted service paths for some McAfee ENS files

Accessing, modifying or executing executable files vulnerability in the uninstaller in McAfee Endpoint Security (ENS) for Windows Prior to 10.7.0 April 2020 Update allows local users to execute arbitrary code via a carefully crafted input file.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7274

ENS elevated permissions vulnerability

Privilege escalation vulnerability in McTray.exe in McAfee Endpoint Security (ENS) for Windows Prior to 10.7.0 April 2020 Update allows local users to spawn unrelated processes with elevated privileges via the system administrator granting McTray.exe elevated privileges (by default it runs with the current user's privileges).

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7273

Autorun registry bypass

Accessing functionality not properly constrained by ACLs vulnerability in the autorun start-up protection in McAfee Endpoint Security (ENS) for Windows Prior to 10.7.0 April 2020 Update allows local users to delete or rename programs in the autorun key via manipulation of some parameters.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7265

Privilege Escalation vulnerability through symbolic links in ENSM

Privilege Escalation vulnerability in McAfee Endpoint Security (ENS) for Mac prior to 10.6.9 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7264

Privilege Escalation vulnerability through symbolic links in ENS for Windows

Privilege Escalation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 Hotfix 199847 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7263

ENS configuration can be edited by attacker with local administrator permissions

Improper access control vulnerability in ESconfigTool.exe in McAfee Endpoint Security (ENS) for Windows all current versions allows local administrator to alter ENS configuration up to and including disabling all protection offered by ENS via insecurely implemented encryption of configuration for export and import.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7261

Buffer overwrite in ENS allowed to bypass AMSI protection

Buffer Overflow via Environment Variables vulnerability in AMSI component in McAfee Endpoint Security (ENS) Prior to 10.7.0 February 2020 Update allows local users to disable Endpoint Security via a carefully crafted user input.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7259

Unsigned executable vulnerability in ENS can be used to bypass intended self-protection rules

Exploitation of Privilege/Trust vulnerability in file in McAfee Endpoint Security (ENS) Prior to 10.7.0 February 2020 Update allows local users to bypass local security protection via a carefully crafted input file

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7257

Privilege Escalation vulnerability through Symbolic links in ENS

Privilege escalation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows local users to cause the deletion and creation of files they would not normally have permission to through altering the target of symbolic links whilst an anti-virus scan was in progress. This is timing dependent.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7255

Privilege Escalation vulnerability  in ENS

Privilege escalation vulnerability in the administrative user interface in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows local users to gain elevated privileges via ENS not checking user permissions when editing configuration in the ENS client interface. Administrators can lock the ENS client interface through ePO to prevent users being able to edit the configuration.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7251

ESConfig Tool able to edit configuration for newer version

Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7250

ENS symbolic link log file manipulation vulnerability

Symbolic link manipulation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows authenticated local user to potentially gain an escalation of privileges by pointing the link to files which the user which not normally have permission to alter via carefully creating symbolic links from the ENS log file directory.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2019-3653

ESConfig Tool access not controlled

Improper access control vulnerability in Configuration tool in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to gain access to security configuration via unauthorized use of the configuration tool.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2019-3652

ENS code injection in EPSetup.exe

Code Injection vulnerability in EPSetup.exe in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to get their malicious code installed by the ENS installer via code injection into EPSetup.exe by an attacker with access to the installer.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee Microsoft
Products
Endpoint Security Windows
CVE-2019-3586

McAfee Endpoint Security firewall not always acting on GTI lookup results

Protection Mechanism Failure in the Firewall in McAfee Endpoint Security (ENS) 10.x prior to 10.6.1 May 2019 update allows context-dependent attackers to circumvent ENS protection where GTI flagged IP addresses are not blocked by the ENS Firewall via specially crafted malicious sites where the GTI reputation is carefully manipulated and does not correctly trigger the ENS Firewall to block the connection.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2019-3582

McAfee Endpoint Security updates fix a privilege escalation vulnerability

Privilege Escalation vulnerability in Microsoft Windows client in McAfee Endpoint Security (ENS) 10.6.1 and earlier allows local users to gain elevated privileges via a specific set of circumstances.

CVSS 3.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2018-6693

Endpoint Security for Linux Threat Prevention (ENSLTP) privilege escalation vulnerability

An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escalation to delete arbitrary files.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Mcafee
Products
Linux Kernel Endpoint Security For Linux Threat Prevention Endpoint Security Linux Threat Prevention
CVE-2017-4028

SB10193 - consumer and corporate products - Maliciously misconfigured registry vulnerability

Maliciously misconfigured registry vulnerability in all Microsoft Windows products in McAfee consumer and corporate products allows an administrator to inject arbitrary code into a debugged McAfee process via manipulation of registry parameters.

CVSS 3.0 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee Microsoft
Products
Anti-virus Plus Endpoint Security Host Intrusion Prevention and 4 more