Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 606

Export CSV
CVE-2020-7283

Privilege Escalation vulnerability in McAfee Total Protection (MTP)

Privilege Escalation vulnerability in McAfee Total Protection (MTP) before 16.0.R26 allows local users to create and edit files via symbolic link manipulation in a location they would otherwise not have access to. This is achieved through running a malicious script or program on the target machine.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Total Protection
CVE-2020-7282

Privilege Escalation vulnerability in McAfee Total Protection (MTP)

Privilege Escalation vulnerability in McAfee Total Protection (MTP) before 16.0.R26 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Total Protection
CVE-2020-7281

Privilege Escalation vulnerability in McAfee Total Protection (MTP)

Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.R26 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Total Protection
CVE-2020-7280

Symbolic Link vulnerability during DAT update

Privilege Escalation vulnerability during daily DAT updates when using McAfee Virus Scan Enterprise (VSE) prior to 8.8 Patch 15 allows local users to cause the deletion and creation of files they would not normally have permission to through altering the target of symbolic links. This is timing dependent.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Virusscan Enterprise
CVE-2020-7279

DLL search order hijacking in Host IPS

DLL Search Order Hijacking Vulnerability in the installer component of McAfee Host Intrusion Prevention System (Host IPS) for Windows prior to 8.0.0 Patch 15 Update allows attackers with local access to execute arbitrary code via execution from a compromised folder.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Host Intrusion Prevention
CVE-2020-7278

McAfee firewall rules not enforced correctly

Exploiting incorrectly configured access control security levels vulnerability in ENS Firewall in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 April 2020 and 10.6.1 April 2020 updates allows remote attackers and local users to allow or block unauthorized traffic via pre-existing rules not being handled correctly when updating to the February 2020 updates.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7277

McAfee processes not protected

Protection mechanism failure in all processes in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 April 2020 Update allows local users to stop certain McAfee ENS processes, reducing the protection offered.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7276

Unrestricted Policy Management using MfeUpgradeTool.exe

Authentication bypass vulnerability in MfeUpgradeTool in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 April 2020 Update allows administrator users to access policy settings via running this tool.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7275

Unquoted service paths for some McAfee ENS files

Accessing, modifying or executing executable files vulnerability in the uninstaller in McAfee Endpoint Security (ENS) for Windows Prior to 10.7.0 April 2020 Update allows local users to execute arbitrary code via a carefully crafted input file.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7274

ENS elevated permissions vulnerability

Privilege escalation vulnerability in McTray.exe in McAfee Endpoint Security (ENS) for Windows Prior to 10.7.0 April 2020 Update allows local users to spawn unrelated processes with elevated privileges via the system administrator granting McTray.exe elevated privileges (by default it runs with the current user's privileges).

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7273

Autorun registry bypass

Accessing functionality not properly constrained by ACLs vulnerability in the autorun start-up protection in McAfee Endpoint Security (ENS) for Windows Prior to 10.7.0 April 2020 Update allows local users to delete or rename programs in the autorun key via manipulation of some parameters.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7270

Sensitive Information Exposure in McAfee ATD

Exposure of Sensitive Information in the web interface in McAfee Advanced Threat Defense (ATD) prior to 4.12.2 allows remote authenticated users to view sensitive unencrypted information via a carefully crafted HTTP request parameter. The risk is partially mitigated if your ATD instances are deployed as recommended with no direct access from the Internet to them.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Advanced Threat Defense
CVE-2020-7269

Sensitive Information Exposure in McAfee ATD

Exposure of Sensitive Information in the web interface in McAfee Advanced Threat Defense (ATD) prior to 4.12.2 allows remote authenticated users to view sensitive unencrypted information via a carefully crafted HTTP request parameter. The risk is partially mitigated if your ATD instances are deployed as recommended with no direct access from the Internet to them.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Advanced Threat Defense
CVE-2020-7268

McAfee Email Gateway (MEG) - Path Traversal vulnerability

Path Traversal vulnerability in McAfee McAfee Email Gateway (MEG) prior to 7.6.406 allows remote attackers to traverse the file system to access files or directories that are outside of the restricted directory via external input to construct a path name that should be within a restricted directory.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Email Gateway
CVE-2020-7267

Privilege Escalation vulnerability through symbolic links in VSEL

Privilege Escalation vulnerability in McAfee VirusScan Enterprise (VSE) for Linux prior to 2.0.3 Hotfix 2635000 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Virusscan Enterprise
CVE-2020-7266

Privilege Escalation vulnerability through symbolic links in VSE for Windows

Privilege Escalation vulnerability in McAfee VirusScan Enterprise (VSE) for Windows prior to 8.8 Patch 14 Hotfix 116778 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Virusscan Enterprise
CVE-2020-7265

Privilege Escalation vulnerability through symbolic links in ENSM

Privilege Escalation vulnerability in McAfee Endpoint Security (ENS) for Mac prior to 10.6.9 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7264

Privilege Escalation vulnerability through symbolic links in ENS for Windows

Privilege Escalation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 Hotfix 199847 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7263

ENS configuration can be edited by attacker with local administrator permissions

Improper access control vulnerability in ESconfigTool.exe in McAfee Endpoint Security (ENS) for Windows all current versions allows local administrator to alter ENS configuration up to and including disabling all protection offered by ENS via insecurely implemented encryption of configuration for export and import.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Endpoint Security
CVE-2020-7262

Improper Access Control vulnerability in ATD

Improper Access Control vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.10.0 allows local users to view sensitive files via a carefully crafted HTTP request parameter.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Advanced Threat Defense