Vulnerabilities > Mcafee > Medium

DATE CVE VULNERABILITY TITLE RISK
2018-06-15 CVE-2018-6671 Unspecified vulnerability in Mcafee Epolicy Orchestrator
Application Protection Bypass vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows remote authenticated users to bypass localhost only access security protection for some ePO features via a specially crafted HTTP request.
network
low complexity
mcafee
6.5
2018-06-07 CVE-2018-6670 XXE vulnerability in Mcafee Common Catalog 2.0.0
External Entity Attack vulnerability in the ePO extension in McAfee Common UI (CUI) 2.0.2 allows remote authenticated users to view confidential information via a crafted HTTP request parameter.
network
low complexity
mcafee CWE-611
6.5
2018-05-25 CVE-2017-3961 Cross-site Scripting vulnerability in Mcafee Network Security Manager
Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via crafted user input of attributes.
network
low complexity
mcafee CWE-79
5.4
2018-04-04 CVE-2017-3971 Inadequate Encryption Strength vulnerability in Mcafee Network Security Manager
Cryptanalysis vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to view confidential information via insecure use of RC4 encryption cyphers.
network
low complexity
mcafee CWE-326
6.5
2018-04-04 CVE-2017-3969 Channel and Path Errors vulnerability in Mcafee Network Security Manager
Abuse of communication channels vulnerability in the server in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows man-in-the-middle attackers to decrypt messages via an inadequate implementation of SSL.
network
high complexity
mcafee CWE-417
5.9
2018-04-04 CVE-2017-3967 Code Injection vulnerability in Mcafee Network Security Manager
Target influence via framing vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to inject arbitrary web script or HTML via application pages inability to break out of 3rd party HTML frames.
network
low complexity
mcafee CWE-94
6.1
2018-04-04 CVE-2017-3966 Insufficient Session Expiration vulnerability in Mcafee Network Security Manager
Exploitation of session variables, resource IDs and other trusted credentials vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to exploit or harm a user's browser via reusing the exposed session token in the application URL.
network
low complexity
mcafee CWE-613
6.3
2018-04-04 CVE-2017-3964 Cross-site Scripting vulnerability in Mcafee Network Security Manager
Reflective Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to inject arbitrary web script or HTML via a URL parameter.
network
low complexity
mcafee CWE-79
5.4
2018-04-03 CVE-2017-4028 Injection vulnerability in Mcafee products
Maliciously misconfigured registry vulnerability in all Microsoft Windows products in McAfee consumer and corporate products allows an administrator to inject arbitrary code into a debugged McAfee process via manipulation of registry parameters.
local
low complexity
mcafee CWE-74
4.4
2018-04-02 CVE-2018-6659 Cross-site Scripting vulnerability in Mcafee Epolicy Orchestrator
Reflected Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows remote authenticated users to exploit an XSS issue via not sanitizing the user input.
network
low complexity
mcafee CWE-79
5.4