Multiple vulnerabilities fixed in McAfee ePolicy Orchestrator

McAfee has fixed multiple vulnerabilities in McAfee ePolicy Orchestrator. The vulnerabilities allow a malicious party whether or not unauthenticated malicious person may be able to launch attacks execute attacks that result in the following categories of damage: Cross-Site Scripting XSS...

CVE-2020-7317

Cross-Site Scripting vulnerability in McAfee ePolicy Orchistrator ePO prior to 5.10.9 Update 9 allows administrators to inject arbitrary web script or HTML via parameter values for "syncPointList" not being correctly sanitsed...

CVE-2020-7318

Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator ePO prior to 5.10.9 Update 9 allows administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized...

CVE-2020-7318

Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator ePO prior to 5.10.9 Update 9 allows administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized...

Cross site scripting

Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator ePO prior to 5.10.9 Update 9 allows administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized...

CVE-2020-7317

CVE-2020-7317 affects McAfee ePolicy Orchestrator (ePO) prior to 5.10.9 Update 9, enabling cross-site scripting via the syncPointList parameter due to insufficient sanitization. Related notes from Red Hat and Nessus entries align with an XSS issue in ePO; NCSC advisories indicate fixes in 5.9.1 a...

CVE-2020-7318 ePolicy Orchistrator (ePO) - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator ePO prior to 5.10.9 Update 9 allows administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized...

CVE-2020-7318

McAfee ePolicy Orchestrator (ePO) before version 5.10.9 Update 9 is affected by CVE-2020-7318, a cross-site scripting (XSS) vulnerability. The issue arises from multiple parameters not being properly sanitized, allowing an attacker with adjacent access to inject arbitrary web script or HTML in th...

Security Bulletin: Multiple vulnerabilites in IBM Db2 affect IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise

Summary IBM Db2 is shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. Vulnerabilities have been identified in IBM Db2 and the information about their fixes are published in security bulletins. Vulnerability Details Refer to the security bulletins listed in the...

The vulnerability of the VeloCloud Orchestrator component of the VMware SD-WAN programmable network management platform lies in the lack of security measures for the SQL query structure. This allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the VeloCloud Orchestrator component of the VMware SD-WAN programmable network management platform relates to the lack of security measures for the SQL query structure. Exploiting this vulnerability could allow attackers to compromise the confidentiality, integrity, and...

Security Bulletin: Multiple vulnerabilities in IBM® SDK, Java™ Technology Edition may affect IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise

Summary A vulnerability in IBM® SDK Java™ Technology Edition, Version 8.0.5.40 used by IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. The CVE-2020-2590 and CVE-2020-2601 were disclosed as part of the Oracle January 2020 Critical Patch Update. Vulnerability Details CVEID:...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. These issues were disclosed as part of Java SE issues disclosed in the Oracle July 2020 Critical Patch Update plus CVE-2019-17639...

Security Bulletin: Vulnerabilities in WebSphere Application Server affect IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise

Summary WebSphere Application Server is shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. Vulnerabilities have been identified in WebSphere Application Server and the information about their fixes are published in security bulletins. Vulnerability Details CVEID:...

Microsoft Windows Update Orchestrator Unchecked ScheduleWork Call Exploit

This Metasploit module exploit uses access to the UniversalOrchestrator ScheduleWork API call which does not verify the caller's token before scheduling a job to be run as SYSTEM. You cannot schedule something in a given time, so the payload will execute as system sometime in the next 24 hours...

Microsoft Windows Update Orchestrator Unchecked ScheduleWork Call

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/post/common' require 'msf/core/post/file' require 'msf/core/post/windows/priv' require 'msf/core/exploit/exe' require 'msf/core/post/windows/registry'...

Security Bulletin: Vulnerabilities in WebSphere Application Server affect IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise

Summary WebSphere Application Server is shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. Vulnerabilities have been identified in WebSphere Application Server and the information about their fixes are published in security bulletins. Vulnerability Details CVEID:...

McAfee Agent Code Injection Vulnerability

McAfee Agent MA is a set of client components from McAfee, Inc. that provides secure communications between ePolicy Orchestrator antivirus management platform and managed products. A code injection vulnerability exists in McAfee Agent prior to version 5.6.6. The vulnerability stems from a failure...

Security Bulletin: Vulnerability in IBM Java SDK affect IBM Cloud Orchestrator (CVE-2020-2654)

Summary A vulnerability in IBM® SDK Java™ Technology Edition, Version 8.0.5.40 used by IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. The issue is disclosed as a part of the IBM Java SDK updates in January 2020. Vulnerability Details CVEID: CVE-2020-2654 DESCRIPTION: An unspecified...

Security Bulletin: Vulnerabilities in IBM HTTP Server affects IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise

Summary There are vulnerabilities in IBM HTTP Server used by IBM WebSphere Application Server. IBM WebSphere Application Server is shipped with IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. These issues were addressed by IBM WebSphere Application Server. Vulnerability Details CVEI...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is used by IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise. These issues were disclosed as part of the IBM SDK, Java Technology Edition Quarterly CPU - Jan 2020 - Includes Oracle Jan 2020 CPU minus...