Search vulnerabilities

Expected end of text, found '/' (at char 25), (line:1, col:26)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,850

CVE-2019-3648

Implicit loading of DLLs

A Privilege Escalation vulnerability in the Microsoft Windows client in McAfee Total Protection 16.0.R22 and earlier allows administrators to execute arbitrary code via carefully placing malicious files in specific locations protected by administrator permission.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Anti-virus Plus Internet Security Total Protection
CVE-2019-3646

McAfee Total Protection - Free Antivirus Trial: DLL Search Order Hijacking vulnerability

DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Free Antivirus Trial 16.0.R18 and earlier allows local users to execute arbitrary code via execution from a compromised folder placed by an attacker with administrator rights.

CVSS 3.1 · 6.9 Medium EPSS 1.5% KEV · Not listed
Vendors
Mcafee
Products
Total Protection
CVE-2019-3641

Exploitation of Authorization in TIE Server

Abuse of Authorization vulnerability in APIs exposed by TIE server in McAfee Threat Intelligence Exchange Server (TIE Server) 3.0.0 allows remote authenticated users to modify stored reputation data via specially crafted messages.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Threat Intelligence Exchange Server
CVE-2019-3640

Data Loss Prevention - Unprotected Transport of Credentials

Unprotected Transport of Credentials in ePO extension in McAfee Data Loss Prevention 11.x prior to 11.4.0 allows remote attackers with access to the network to collect login details to the LDAP server via the ePO extension not using a secure connection when testing LDAP connectivity.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Data Loss Prevention
CVE-2019-3639

MWG UI: Cross-Frame Scripting vulnerability

Clickjack vulnerability in Adminstrator web console in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows remote attackers to conduct clickjacking attacks via a crafted web page that contains an iframe via does not send an X-Frame-Options HTTP header.

CVSS 3.0 · 7.1 High EPSS 1.2% KEV · Not listed
Vendors
Mcafee
Products
Web Gateway
CVE-2019-3638

Web Gateway (MWG) - Reflected Cross Site Scripting vulnerability

Reflected Cross Site Scripting vulnerability in Administrators web console in McAfee Web Gateway (MWG) 7.8.x prior to 7.8.2.13 allows remote attackers to collect sensitive information or execute commands with the MWG administrator's credentials via tricking the administrator to click on a carefully constructed malicious link.

CVSS 3.1 · 8.1 High EPSS 1.9% KEV · Not listed
Vendors
Mcafee
Products
Web Gateway
CVE-2019-3637

Privilege Escalation vulnerability in FRP 5.x earlier than 5.1.0.209

Privilege Escalation vulnerability in McAfee FRP 5.x prior to 5.1.0.209 allows local users to gain elevated privileges via running McAfee Tray with elevated privileges.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
File And Removable Media Protection
CVE-2019-3636

File masquerade attack vulnerability in McAfee Total Protection

A File Masquerade vulnerability in McAfee Total Protection (MTP) version 16.0.R21 and earlier in Windows client allowed an attacker to read the plaintext list of AV-Scan exclusion files from the Windows registry, and to possibly replace excluded files with potential malware without being detected.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mcafee Microsoft
Products
Total Protection Windows
CVE-2019-3635

MWG Proxy: Cross-Frame Scripting vulnerability

Exfiltration of Data in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows attackers to obtain sensitive data via crafting a complex webpage that will trigger the Web Gateway to block the user accessing an iframe.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Mcafee
Products
Web Gateway
CVE-2019-3634

Buffer overflow in DLP Endpoint for Windows

Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via an encrypted message sent to DLPe which when decrypted results in DLPe reading unallocated memory.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee Microsoft
Products
Data Loss Prevention Endpoint Windows
CVE-2019-3633

Buffer overflow in DLP Endpoint for Windows

Buffer overflow in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.2.8 allows local user to cause the Windows operating system to "blue screen" via a carefully constructed message sent to DLPe which bypasses DLPe internal checks and results in DLPe reading unallocated memory.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee Microsoft
Products
Data Loss Prevention Endpoint Windows
CVE-2019-3632

Directory Traversal vulnerability could lead to elevated privileges

Directory Traversal vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to gain elevated privileges via specially crafted input.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed
Vendors
Mcafee
Products
Enterprise Security Manager
CVE-2019-3631

Command Injection could allow authenticated users to execute arbitrary code

Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary code via specially crafted parameters.

CVSS 3.1 · 7.2 High EPSS 2.0% KEV · Not listed
Vendors
Mcafee
Products
Enterprise Security Manager
CVE-2019-3630

Command Injection could allow authenticated users to execute arbitrary code

Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary code via specially crafted parameters.

CVSS 3.1 · 7.2 High EPSS 2.0% KEV · Not listed
Vendors
Mcafee
Products
Enterprise Security Manager
CVE-2019-3629

Application protections bypass vulnerability could allow unauthenticated user to impersonate system users

Application protection bypass vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows unauthenticated user to impersonate system users via specially crafted parameters.

CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Mcafee
Products
Enterprise Security Manager
CVE-2019-3628

Privilege escalation could allow authenticated user to gain access to a core system

Privilege escalation in McAfee Enterprise Security Manager (ESM) 11.x prior to 11.2.0 allows authenticated user to gain access to a core system component via incorrect access control.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mcafee
Products
Enterprise Security Manager
CVE-2019-3622

DLP Endpoint log file redirection to arbitrary locations

Files or Directories Accessible to External Parties in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows authenticated user to redirect DLPe log files to arbitrary locations via incorrect access control applied to the DLPe log folder allowing privileged users to create symbolic links.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Mcafee Microsoft
Products
Data Loss Prevention Endpoint Windows
CVE-2019-3621

DLP Endpoint Windows lock screen bypass with physical access

Authentication protection bypass vulnerability in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows physical local user to bypass the Windows lock screen via DLPe processes being killed just prior to the screen being locked or when the screen is locked. The attacker requires physical access to the machine.

CVSS 3.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mcafee Microsoft
Products
Data Loss Prevention Endpoint Windows