CVE-2018-6755

True Key (TK) Windows Client - Weak Directory Permission Vulnerability

Weak Directory Permission Vulnerability in Microsoft Windows client in McAfee True Key (TK) 5.1.230.7 and earlier allows local users to execute arbitrary code via specially crafted malware.

CVSS 3.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Mcafee Microsoft

Products

True Key Windows

CVE-2018-6707

McAfee Agent Insecure usage of temporary files vulnerability

Denial of Service through Resource Depletion vulnerability in the agent in non-Windows McAfee Agent (MA) 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows local users to cause DoS, unexpected behavior, or potentially unauthorized code execution via knowledge of the internal trust mechanism.

CVSS 3.0 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Agent

CVE-2018-6706

McAfee Agent (MA) non-Windows versions incorrect use of temporary file vulnerability

Insecure handling of temporary files in non-Windows McAfee Agent 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows an Unprivileged User to introduce custom paths during agent installation in Linux via unspecified vectors.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Agent

CVE-2018-6705

McAfee Agent (MA) for Linux Privilege Escalation vulnerability

Privilege escalation vulnerability in McAfee Agent (MA) for Linux 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows local users to perform arbitrary command execution via specific conditions.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Agent

CVE-2018-6704

McAfee Agent for Linux Privilege Escalation vulnerability

Privilege escalation vulnerability in McAfee Agent (MA) for Linux 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows local users to perform arbitrary command execution via specific conditions.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Agent

CVE-2018-6703

Remote Logging functionality had a use after free vulnerability in McAfee Agent

Use After Free in Remote logging (which is disabled by default) in McAfee McAfee Agent (MA) 5.x prior to 5.6.0 allows remote unauthenticated attackers to cause a Denial of Service and potentially a remote code execution via a specially crafted HTTP header sent to the logging service.

CVSS 3.1 · 9.8 Critical EPSS 3.2% KEV · Not listed

Vendors

Mcafee

Products

Agent

CVE-2018-6700

True Key (TK) - DLL Search Order Hijacking vulnerability

DLL Search Order Hijacking vulnerability in Microsoft Windows Client in McAfee True Key (TK) before 5.1.165 allows local users to execute arbitrary code via specially crafted malware.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

True Key

CVE-2018-6695

Threat Intelligence Exchange Server (TIE Server) SSH host keys generation vulnerability

SSH host keys generation vulnerability in the server in McAfee Threat Intelligence Exchange Server (TIE Server) 1.3.0, 2.0.x, 2.1.x, 2.2.0 allows man-in-the-middle attackers to spoof servers via acquiring keys from another environment.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Threat Intelligence Exchange Server

CVE-2018-6693

Endpoint Security for Linux Threat Prevention (ENSLTP) privilege escalation vulnerability

An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escalation to delete arbitrary files.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Mcafee

Products

Linux Kernel Endpoint Security For Linux Threat Prevention Endpoint Security Linux Threat Prevention

CVE-2018-6690

McAfee Application Control (MAC) - Whitelist bypass using a hard drive solidified by MACC

Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mcafee Microsoft

Products

Application Change Control Windows

CVE-2018-6689

Data Loss Prevention Endpoint (DLPe) - Authentication Bypass vulnerability

Authentication Bypass vulnerability in McAfee Data Loss Prevention Endpoint (DLPe) 10.0.x earlier than 10.0.510, and 11.0.x earlier than 11.0.600 allows attackers to bypass local security protection via specific conditions.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Data Loss Prevention Endpoint

CVE-2018-6687

GetSusp (a free McAfee tool) update fixes an infinite loop vulnerability (CVE-2018-6687)

Loop with Unreachable Exit Condition ('Infinite Loop') in McAfee GetSusp (GetSusp) 3.0.0.461 and earlier allows attackers to DoS a manual GetSusp scan via while scanning a specifically crafted file . GetSusp is a free standalone McAfee tool that runs on several versions of Microsoft Windows.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee Microsoft

Products

Getsusp Windows

CVE-2018-6686

Drive Encryption (MDE) - Authentication Bypass vulnerability

Authentication Bypass vulnerability in TPM autoboot in McAfee Drive Encryption (MDE) 7.1.0 and above allows physically proximate attackers to bypass local security protection via specific set of circumstances.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Drive Encryption

CVE-2018-6683

- Data Loss Prevention (DLP) for Windows - Exploiting Incorrectly Configured Access Control Security Levels vulnerability

Exploiting Incorrectly Configured Access Control Security Levels vulnerability in McAfee Data Loss Prevention (DLP) for Windows versions prior to 10.0.505 and 11.0.405 allows local users to bypass DLP policy via editing of local policy files when offline.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Mcafee Microsoft

Products

Data Loss Prevention Endpoint Windows

CVE-2018-6682

True Key (TK) - Cross Site Scripting Exposure

Cross Site Scripting Exposure in McAfee True Key (TK) 4.0.0.0 and earlier allows local users to expose confidential data via a crafted web site.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

True Key

CVE-2018-6681

SB10244 - Network Security Management (NSM) - Abuse of Functionality vulnerability

Abuse of Functionality vulnerability in the web interface in McAfee Network Security Management (NSM) 9.1.7.11 and earlier allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via appliance web interface.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Network Security Manager

CVE-2018-6678

McAfee Web Gateway (MWG) - Configuration/Environment manipulation vulnerability

Configuration/Environment manipulation vulnerability in the administrative interface in McAfee Web Gateway (MWG) MWG 7.8.1.x allows authenticated administrator users to execute arbitrary commands via unspecified vectors.

CVSS 3.1 · 9.1 Critical EPSS 1.2% KEV · Not listed

Vendors

Mcafee

Products

Mcafee Web Gateway

CVE-2018-6677

McAfee Web Gateway (MWG) - Directory Traversal vulnerability

Directory Traversal vulnerability in the administrative user interface in McAfee Web Gateway (MWG) MWG 7.8.1.x allows authenticated administrator users to gain elevated privileges via unspecified vectors.

CVSS 3.1 · 9.1 Critical EPSS 2.1% KEV · Not listed

Vendors

Mcafee

Products

Mcafee Web Gateway

CVE-2018-6674

Privilege escalation vulnerability in McAfee VSE when McTray run with elevated privileges

Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 13 allows local users to spawn unrelated processes with elevated privileges via the system administrator granting McTray.exe elevated privileges (by default it runs with the current user's privileges).

CVSS 3.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee Microsoft

Products

Virusscan Enterprise Windows

CVE-2018-6672

SB10240 - ePolicy Orchestrator (ePO) - Information disclosure vulnerablity

Information disclosure vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows authenticated users to view sensitive information in plain text format via unspecified vectors.

CVSS 3.0 · 5.7 Medium EPSS 1.2% KEV · Not listed

Vendors

Mcafee

Products

Epolicy Orchestrator