PT-2014-8597

Name of the Vulnerable Software and Affected Versions McAfee Network Data Loss Prevention NDLP versions prior to 9.2.2 Description The issue is related to an unspecified vulnerability in the login form. It allows local users to cause a denial of service by providing a crafted value in the domain...

CVE-2014-8525: Exposure of Sensitive Information to an Unauthorized Actor

McAfee Network Data Loss Prevention NDLP before 9.3 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2014-8524: Exposure of Sensitive Information to an Unauthorized Actor

McAfee Network Data Loss Prevention NDLP before 9.3 does not disable the autocomplete setting for the password and other fields, which allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2014-8535: Undefined Security Weakness

McAfee Network Data Loss Prevention NDLP before 9.2.2 allows local users to bypass intended restriction on unspecified functionality via unknown vectors...

PT-2014-8589

Name of the Vulnerable Software and Affected Versions McAfee Network Data Loss Prevention NDLP versions prior to 9.3 Description The issue allows local users to obtain sensitive information by reading a Java stack trace. Recommendations For versions prior to 9.3, update to version 9.3 or later to...

CVE-2014-8534: Undefined Security Weakness

Unspecified vulnerability in the login form in McAfee Network Data Loss Prevention NDLP before 9.2.2 allows local users to cause a denial of service via a crafted value in the domain field...

CVE-2014-8527: Undefined Security Weakness

McAfee Network Data Loss Prevention NDLP before 9.3 allows local users to obtain sensitive information and affect integrity via vectors related to a "plain text password."...

CVE-2014-8537: Exposure of Sensitive Information to an Unauthorized Actor

McAfee Network Data Loss Prevention NDLP before 9.2.2 allows local users to obtain sensitive information by reading the logs...

CVE-2014-8536: Exposure of Sensitive Information to an Unauthorized Actor

McAfee Network Data Loss Prevention NDLP before 9.2.2 allows local users to obtain sensitive information by reading unspecified error messages...

PT-2014-8586

Name of the Vulnerable Software and Affected Versions McAfee Network Data Loss Prevention versions prior to 9.3 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of victims. The exact vectors used for the attack are not specified. Recommendations...

CVE-2014-8533: Undefined Security Weakness

McAfee Network Data Loss Prevention NDLP before 9.3 allows remote attackers to execute arbitrary code via vectors related to ICMP redirection...

PT-2014-8593

Name of the Vulnerable Software and Affected Versions McAfee Network Data Loss Prevention NDLP versions prior to 9.3 Description The issue allows remote attackers to obtain sensitive information, affect integrity, or cause a denial of service. This is related to simultaneous logins, but the exact...

PT-2014-8596

Name of the Vulnerable Software and Affected Versions McAfee Network Data Loss Prevention NDLP versions prior to 9.3 Description The issue allows remote attackers to execute arbitrary code via vectors related to ICMP redirection. Recommendations For versions prior to 9.3, update to version 9.3 or...

CVE-2014-8522: Improper Authentication

The MySQL database in McAfee Network Data Loss Prevention NDLP before 9.3 does not require a password, which makes it easier for remote attackers to obtain access...

CVE-2014-8523: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in McAfee Network Data Loss Prevention NDLP before 9.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

PT-2014-8588

Name of the Vulnerable Software and Affected Versions McAfee Network Data Loss Prevention NDLP versions prior to 9.3 Description The issue makes it easier for remote attackers to obtain potentially sensitive information via script access to the session cookie, as the HTTPOnly flag is not included...

CVE-2014-8528: Exposure of Sensitive Information to an Unauthorized Actor

McAfee Network Data Loss Prevention NDLP before 9.3 logs session IDs, which allows local users to obtain sensitive information by reading the audit log...

CVE-2014-8530: Undefined Security Weakness

Unspecified vulnerability in McAfee Network Data Loss Prevention NDLP before 9.3 allows remote attackers to obtain sensitive information, affect integrity, or cause a denial of service via unknown vectors, related to simultaneous logins...

CVE-2014-8526: Exposure of Sensitive Information to an Unauthorized Actor

McAfee Network Data Loss Prevention NDLP before 9.3 allows local users to obtain sensitive information by reading a Java stack trace...

Elasticsearch vulnerability CVE-2014-6439

Summary: Elasticsearch versions 1.3.x and prior have a default configuration for CORS that allows an attacker to craft links that could cause a user’s browser to send requests to Elasticsearch instances on their local network. These requests could cause data loss or compromise. We have been...