CVE-2020-7303

DLP ePO extension - Cross-site scripting

Cross Site scripting vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated remote user to trigger scripts to run in a user's browser via adding a new label.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Data Loss Prevention

CVE-2020-7302

DLP ePO extension - Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated attackers to upload malicious files to the DLP case management section via lack of sanity checking.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Data Loss Prevention

CVE-2020-7301

DLP ePO extension - Cross site scripting

Cross Site scripting vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated attackers to trigger alerts via the file upload tab in the DLP case management section.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Data Loss Prevention

CVE-2020-7300

DLP ePO extension - Improper Authorization

Improper Authorization vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated remote attackers to change the configuration when logged in with view only privileges via carefully constructed HTTP post messages.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Data Loss Prevention

CVE-2020-7299

Sensitive Data Exposure vulnerability in McAfee True Key Windows Client

Cleartext Storage of Sensitive Information in Memory vulnerability in Microsoft Windows client in McAfee True Key (TK) prior to 6.2.109.2 allows a local user logged in with administrative privileges to access to another user’s passwords on the same machine via triggering a process dump in specific situations.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

True Key

CVE-2020-7298

Total Protection (MTP) - Unexpected behavior violation

Unexpected behavior violation in McAfee Total Protection (MTP) prior to 16.0.R26 allows local users to turn off real time scanning via a specially crafted object making a specific function call.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Total Protection

CVE-2020-7297

Web Gateway (MWG) - Privilege Escalation vulnerability

Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected dashboard data via improper access control in the user interface.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Web Gateway

CVE-2020-7296

Web Gateway (MWG) - Privilege Escalation vulnerability

Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected configuration files via improper access control in the user interface.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Web Gateway

CVE-2020-7295

Web Gateway (MWG) - Privilege Escalation vulnerability

Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected log data via improper access controls in the user interface.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Web Gateway

CVE-2020-7294

Web Gateway (MWG) - Privilege Escalation vulnerability

Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected files via improper access controls in the REST interface.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Web Gateway

CVE-2020-7293

Web Gateway (MWG) - Privilege Escalation vulnerability

Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user with low permissions to change the system's root password via improper access controls in the user interface.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Web Gateway

CVE-2020-7292

Web Gateway (MWG) - Inappropriate Encoding for output context

Inappropriate Encoding for output context vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows a remote attacker to cause MWG to return an ambiguous redirect response via getting a user to click on a malicious URL.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Web Gateway

CVE-2020-7291

Privilege Escalation vulnerability MAR for Mac

Privilege Escalation vulnerability in McAfee Active Response (MAR) for Mac prior to 2.4.3 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Mcafee

Products

Macos Active Response

CVE-2020-7290

Privilege Escalation vulnerability in MAR for Linux

Privilege Escalation vulnerability in McAfee Active Response (MAR) for Linux prior to 2.4.3 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Mcafee

Products

Linux Kernel Active Response

CVE-2020-7289

Privilege Escalation vulnerability in MAR for Windows

Privilege Escalation vulnerability in McAfee Active Response (MAR) for Windows prior to 2.4.3 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Mcafee Microsoft

Products

Active Response Windows

CVE-2020-7288

Privilege Escalation vulnerability in EDR for Mac

Privilege Escalation vulnerability in McAfee Exploit Detection and Response (EDR) for Mac prior to 3.1.0 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Mcafee

Products

Macos Endpoint Detection And Response

CVE-2020-7287

Privilege Escalation vulnerability in EDR for Linux

Privilege Escalation vulnerability in McAfee Exploit Detection and Response (EDR) for Linux prior to 3.1.0 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Mcafee

Products

Linux Kernel Endpoint Detection And Response

CVE-2020-7286

Privilege Escalation vulnerability in EDR for Windows

Privilege Escalation vulnerability in McAfee Exploit Detection and Response (EDR) for Windows prior to 3.1.0 Hotfix 1 allows a malicious script or program to perform functions that the local executing user has not been granted access to.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Mcafee Microsoft

Products

Endpoint Detection And Response Windows

CVE-2020-7285

Privilege Escalation vulnerability in MVISION Endpoint

Privilege Escalation vulnerability in McAfee MVISION Endpoint prior to 20.5.0.94 allows a malicious script or program to perform functions that the local executing user has not been granted access to.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Mvision Endpoint

CVE-2020-7284

Network Security Management (NSM) - Exposure of Sensitive Information

Exposure of Sensitive Information in McAfee Network Security Management (NSM) prior to 10.1.7.7 allows local users to gain unauthorised access to the root account via execution of carefully crafted commands from the restricted command line interface (CLI).

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Network Security Management