Vulnerabilities > Trellix
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-01-10 | CVE-2024-0310 | Cross-site Scripting vulnerability in Trellix Endpoint Security web Control 10.7.0 A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy configuration. | 6.1 |
| 2024-01-09 | CVE-2024-0206 | Link Following vulnerability in Trellix Anti-Malware Engine 6600 A symbolic link manipulation vulnerability in Trellix Anti-Malware Engine prior to the January 2024 release allows an authenticated local user to potentially gain an escalation of privileges. | 7.8 |
| 2024-01-09 | CVE-2024-0213 | Classic Buffer Overflow vulnerability in Trellix Agent A buffer overflow vulnerability in TA for Linux and TA for MacOS prior to 5.8.1 allows a local user to gain elevated permissions, or cause a Denial of Service (DoS), through exploiting a memory corruption issue in the TA service, which runs as root. | 7.8 |
| 2023-11-30 | CVE-2023-6071 | Command Injection vulnerability in Trellix Enterprise Security Manager 11.6.8 An Improper Neutralization of Special Elements used in a command vulnerability in ESM prior to version 11.6.9 allows a remote administrator to execute arbitrary code as root on the ESM. | 7.2 |
| 2023-11-29 | CVE-2023-6070 | Server-Side Request Forgery (SSRF) vulnerability in Trellix Enterprise Security Manager A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially altering configuration. | 4.3 |
| 2023-11-27 | CVE-2023-5607 | Path Traversal vulnerability in Trellix Application and Change Control An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extension, for on-premises ePO servers, prior to version 8.4.0 could lead to an authorised administrator attacker executing arbitrary code through uploading a specially crafted GTI reputation file. | 7.2 |
| 2023-11-16 | CVE-2023-6119 | Improper Privilege Management vulnerability in Trellix Getsusp An Improper Privilege Management vulnerability in Trellix GetSusp prior to version 5.0.0.27 allows a local, low privilege attacker to gain access to files that usually require a higher privilege level. | 7.8 |
| 2023-10-04 | CVE-2023-3665 | Code Injection vulnerability in Trellix Endpoint Security A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment variables, leading to denial of service and or the execution of arbitrary code. | 7.8 |
| 2023-09-14 | CVE-2023-4814 | Incorrect Authorization vulnerability in Trellix Data Loss Prevention 11.10.100.17 A Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which can be abused to delete any file/folder for which the user does not have permission to. | 7.1 |
| 2023-07-03 | CVE-2023-3314 | OS Command Injection vulnerability in Trellix Enterprise Security Manager A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s). | 8.8 |