Vulnerabilities > Mcafee > Agent

DATE CVE VULNERABILITY TITLE RISK
2022-07-27 CVE-2022-2313 Uncontrolled Search Path Element vulnerability in Mcafee Agent
A DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL into the folder from where the Smart installer is being executed.
local
low complexity
mcafee CWE-427
7.3
2022-04-14 CVE-2022-1256 Link Following vulnerability in Mcafee Agent
A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged user to gain system privileges through running the repair functionality.
local
low complexity
mcafee CWE-59
7.8
2022-04-14 CVE-2022-1257 Insecure Storage of Sensitive Information vulnerability in Mcafee Agent
Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain access to sensitive information through storage in ma.db.
local
low complexity
mcafee CWE-922
5.5
2022-04-14 CVE-2022-1258 SQL Injection vulnerability in Mcafee Agent
A blind SQL injection vulnerability in the ePolicy Orchestrator (ePO) extension of MA prior to 5.7.6 can be exploited by an authenticated administrator on ePO to perform arbitrary SQL queries in the back-end database, potentially leading to command execution on the server.
network
low complexity
mcafee CWE-89
7.2
2022-01-19 CVE-2021-31854 OS Command Injection vulnerability in Mcafee Agent
A command Injection Vulnerability in McAfee Agent (MA) for Windows prior to 5.7.5 allows local users to inject arbitrary shell code into the file cleanup.exe.
local
low complexity
mcafee CWE-78
7.8
2022-01-19 CVE-2022-0166 Uncontrolled Search Path Element vulnerability in Mcafee Agent
A privilege escalation vulnerability in the McAfee Agent prior to 5.7.5.
local
low complexity
mcafee CWE-427
7.8
2021-09-22 CVE-2021-31847 Uncontrolled Search Path Element vulnerability in Mcafee Agent
Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a local attacker to perform a DLL preloading attack using unsigned DLLs.
local
low complexity
mcafee CWE-427
7.8
2021-06-10 CVE-2021-31839 Unspecified vulnerability in Mcafee Agent
Improper privilege management vulnerability in McAfee Agent for Windows prior to 5.7.3 allows a local user to modify event information in the MA event folder.
local
low complexity
mcafee
3.3
2021-01-20 CVE-2021-1257 Cross-Site Request Forgery (CSRF) vulnerability in multiple products
A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack to manipulate an authenticated user into executing malicious actions without their awareness or consent.
network
cisco mcafee CWE-352
6.8
2021-01-18 CVE-2020-7343 Missing Authorization vulnerability in Mcafee Agent
Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files.
local
low complexity
mcafee CWE-862
5.5