Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 606

Export CSV
CVE-2021-23878

Clear text storage of sensitive Information in ENS

Clear text storage of sensitive Information in memory vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows a local user to view ENS settings and credentials via accessing process memory after the ENS administrator has performed specific actions. To exploit this, the local user has to access the relevant memory location immediately after an ENS administrator has made a configuration change through the console on their machine

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2021-23877

McAfee Total Protection (MTP) - Privilege Escalation vulnerability

Privilege escalation vulnerability in the Windows trial installer of McAfee Total Protection (MTP) prior to 16.0.34_x may allow a local user to run arbitrary code as the admin user by replacing a specific temporary file created during the installation of the trial version of MTP.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Total Protection
CVE-2021-23876

McAfee Total Protection (MTP) Bypass Remote Procedure call vulnerability

Bypass Remote Procedure call in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and perform arbitrary file modification as the SYSTEM user potentially causing Denial of Service via executing carefully constructed malware.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Total Protection
CVE-2021-23873

McAfee Total Protection (MTP) privilege escalation vulnerability

Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and perform arbitrary file deletion as the SYSTEM user potentially causing Denial of Service via manipulating Junction link, after enumerating certain files, at a specific time.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Total Protection
CVE-2021-23872

Privilege Escalation vulnerability in McAfee Total Protection (MTP)

Privilege Escalation vulnerability in the File Lock component of McAfee Total Protection (MTP) prior to 16.0.32 allows a local user to gain elevated privileges by manipulating a symbolic link in the IOCTL interface.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Total Protection
CVE-2021-1258

Cisco AnyConnect Secure Mobility Client Arbitrary File Read Vulnerability

A vulnerability in the upgrade component of Cisco AnyConnect Secure Mobility Client could allow an authenticated, local attacker with low privileges to read arbitrary files on the underlying operating system (OS) of an affected device. The vulnerability is due to insufficient file permission restrictions. An attacker could exploit this vulnerability by sending a crafted command from the local CLI to the application. A successful exploit could allow the attacker to read arbitrary files on the underlying OS of the affected device. The attacker would need to have valid user credentials to exploit this vulnerability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Cisco Mcafee Microsoft
Products
Anyconnect Secure Mobility Client Agent Epolicy Orchestrator Extension Windows
CVE-2020-7343

Improper Authorization vulnerability in MA

Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Agent
CVE-2020-7339

Database Security(DBS)-Use of a Broken or Risky Cryptographic Algorithm

Use of a Broken or Risky Cryptographic Algorithm vulnerability in McAfee Database Security Server and Sensor prior to 4.8.0 in the form of a SHA1 signed certificate that would allow an attacker on the same local network to potentially intercept communication between the Server and Sensors.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Database Security
CVE-2020-7337

Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource vulnerability in McAfee VirusScan Enterprise (VSE) prior to 8.8 Patch 16 allows local administrators to bypass local security protection through VSE not correctly integrating with Windows Defender Application Control via careful manipulation of the Code Integrity checks.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Virusscan Enterprise
CVE-2020-7336

Network Security Management (NSM) - Cross Site Request Forgery vulnerability

Cross Site Request Forgery vulnerability in McAfee Network Security Management (NSM) prior to 10.1.7.35 and NSM 9.x prior to 9.2.9.55 may allow an attacker to change the configuration of the Network Security Manager via a carefully crafted HTTP request.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Network Security Management
CVE-2020-7335

Privilege Escalation vulnerability in McAfee Total Protection (MTP)

Privilege Escalation vulnerability in Microsoft Windows client McAfee Total Protection (MTP) prior to 16.0.29 allows local users to gain elevated privileges via careful manipulation of a folder by creating a junction link. This exploits a lack of protection through a timing issue and is only exploitable in a small time window.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Total Protection
CVE-2020-7334

Improper privilege assignment vulnerability in the installer component of MACC

Improper privilege assignment vulnerability in the installer McAfee Application and Change Control (MACC) prior to 8.3.2 allows local administrators to change or update the configuration settings via a carefully constructed MSI configured to mimic the genuine installer. This version adds further controls for installation/uninstallation of software.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Application And Change Control
CVE-2020-7333

Cross-site Scripting (XSS) in firewall ePO extension of McAfee Endpoint Security (ENS)

Cross site scripting vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows administrators to inject arbitrary web script or HTML via the configuration wizard.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7332

Cross-Site Request Forgery (CSRF) in firewall ePO extension of McAfee Endpoint Security (ENS)

Cross Site Request Forgery vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows an attacker to execute arbitrary HTML code due to incorrect security configuration.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7331

Unquoted service executable path in McAfee Endpoint Security (ENS)

Unquoted service executable path in McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows local users to cause a denial of service and malicious file execution via carefully crafted and named executable files.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7330

Privilege Escalation vulnerability in McAfee Total Protection (MTP) trial

Privilege Escalation vulnerability in McAfee Total Protection (MTP) trial prior to 4.0.176.1 allows local users to schedule tasks which call malicious software to execute with elevated privileges via editing of environment variables

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Total Protection
CVE-2020-7329

Server-Side Request Forgery (SSRF) in MVISION Endpoint ePO extension

Server-side request forgery vulnerability in the ePO extension in McAfee MVISION Endpoint prior to 20.11 allows remote attackers trigger server-side DNS requests to arbitrary domains via carefully constructed XML files loaded by an ePO administrator.

CVSS 3.1 · 7.2 High EPSS 1.7% KEV · Not listed
Vendors
Mcafee
Products
Mvision Endpoint
CVE-2020-7328

Server-Side Request Forgery (SSRF) in MVISION Endpoint ePO extension

External entity attack vulnerability in the ePO extension in McAfee MVISION Endpoint prior to 20.11 allows remote attackers to gain control of a resource or trigger arbitrary code execution via improper input validation of an HTTP request, where the content for the attack has been loaded into ePO by an ePO administrator.

CVSS 3.1 · 7.2 High EPSS 2.2% KEV · Not listed
Vendors
Mcafee
Products
Mvision Endpoint
CVE-2020-7327

McAfee MVEDR - Improperly implemented security check

Improperly implemented security check in McAfee MVISION Endpoint Detection and Response Client (MVEDR) prior to 3.2.0 may allow local administrators to execute malicious code via stopping a core Windows service leaving McAfee core trust component in an inconsistent state resulting in MVEDR failing open rather than closed

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Mvision Endpoint Detection And Response
CVE-2020-7326

McAfee MAR - Improperly implemented security check

Improperly implemented security check in McAfee Active Response (MAR) prior to 2.4.4 may allow local administrators to execute malicious code via stopping a core Windows service leaving McAfee core trust component in an inconsistent state resulting in MAR failing open rather than closed

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Active Response