Xxe

Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 allows a remote attacker to cause the DLP Agent to access a local service that the attacker wouldn't usually have access to via a carefully constructed XML file, which the DLP Agent...

CVE-2022-2330 XXE vulnerability in DLP Endpoint for Windows

Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 allows a remote attacker to cause the DLP Agent to access a local service that the attacker wouldn't usually have access to via a carefully constructed XML file, which the DLP Agent...

CVE-2022-2330

CVE-2022-2330 affects McAfee DLP Endpoint for Windows (versions prior to 11.9.100 and 11.6.600). The issue is an improper restriction of XML External Entity references (XXE), allowing a remote attacker to cause the DLP Agent to access a local service the attacker wouldn’t normally access via a sp...

CVE-2022-2330: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 allows a remote attacker to cause the DLP Agent to access a local service that the attacker wouldn't usually have access to via a carefully constructed XML file, which the DLP Agent...

PT-2022-15920 · Unknown · Dlp Endpoint For Windows

Name of the Vulnerable Software and Affected Versions: DLP Endpoint for Windows versions prior to 11.9.100 DLP Endpoint for Windows version 11.6.600 Description: The issue is related to an Improper Restriction of XML External Entity Reference, allowing a remote attacker to cause the DLP Agent to...

Ubuntu: Security Advisory (USN-4280-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-4088

SQL injection vulnerability in Data Loss Protection DLP ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database. This could lead to remote code execution on the ePO server...

CVE-2021-4088 Blind SQL injection in DLP ePO extension

SQL injection vulnerability in Data Loss Protection DLP ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database. This could lead to remote code execution on the ePO server...

CVE-2021-4088

CVE-2021-4088 describes a SQL injection in McAfee Data Loss Prevention (DLP) ePO extension. The vulnerability affects DLP ePO extension versions 11.6.401 and 11.7.x up to 11.7.100, and 11.8.x prior to 11.8.100, allowing a remote authenticated attacker to inject unfiltered SQL into the DLP portion...

CVE-2021-4088: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Data Loss Protection DLP ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database. This could lead to remote code execution on the ePO server...

Vulnerability fixed in McAfee Data Loss Prevention

A vulnerability has been fixed in McAfee Data Loss Prevention DLP. The vulnerability potentially allows a malicious party to execute code on the ePolicy Orchestrator-sever ePO. The malicious party must have access to the DLP database on the ePO server. Through a blind-SQL injection, it is possibl...

Impact of Log4j Vulnerabilities CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832

Apache Log4j Java library is vulnerable to a remote code execution vulnerability CVE-2021-44228, known as Log4Shell, and related vulnerabilities CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832. Log4Shell allows remote unauthenticated attackers with the ability to inject text into log messages ...

McAfee Data Loss Prevention ePO extension Multiple Vulnerabilities (SB10371)

The remote host is running a version of McAfee ePolicy Orchestrator that is affected by multiple vulnerabilities, as follows: - Cross site scripting XSS vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.7.100 allows a remote attacker to highjack an active DLP ePO...

Why you need to rethink your data security strategy and go beyond DLP

The increasing frequency and scale of data breaches has highlighted the need for organizations to rethink their approach to data security. Data Loss Prevention DLP technologies have been around for decades and formed a large part of many organizations’ data protection strategies. However, there i...

CVE-2021-31848

CVE-2021-31848 is an XSS vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to version 11.7.100. The issue allows an attacker to hijack an active DLP ePO administrator session by convincing a logged-in admin to click a crafted link in the case-management portion of the extensi...

CVE-2021-31848 Data Loss Prevention (DLP) ePO extension - Cross site scripting (XSS)

Cross site scripting XSS vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.7.100 allows a remote attacker to highjack an active DLP ePO administrator session by convincing the logged in administrator to click on a carefully crafted link in the case management part of the...

CVE-2021-31849 Data Loss Prevention (DLP) ePO extension - SQL injection

SQL injection vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.7.100 allows a remote attacker logged into ePO as an administrator to inject arbitrary SQL into the ePO database through the user management section of the DLP ePO extension...

CVE-2021-31849

CVE-2021-31849 describes a SQL injection in the McAfee Data Loss Prevention (DLP) ePO extension (prior to 11.7.100). An administrator logged into ePO can inject arbitrary SQL into the ePO database via the DLP extension’s user management section. Affected product: McAfee DLP ePO extension before 1...

CVE-2021-31849: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.7.100 allows a remote attacker logged into ePO as an administrator to inject arbitrary SQL into the ePO database through the user management section of the DLP ePO extension...

CVE-2021-31848: Improper Neutralization of Input During Web Page Generation

Cross site scripting XSS vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.7.100 allows a remote attacker to highjack an active DLP ePO administrator session by convincing the logged in administrator to click on a carefully crafted link in the case management part of the...