CVE-2021-4088 Blind SQL injection in DLP ePO extension

SQL injection vulnerability in Data Loss Protection DLP ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database. This could lead to remote code execution on the ePO server...

CVE-2021-4088: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Data Loss Protection DLP ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database. This could lead to remote code execution on the ePO server...

CVE-2021-31849: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.7.100 allows a remote attacker logged into ePO as an administrator to inject arbitrary SQL into the ePO database through the user management section of the DLP ePO extension...

CVE-2021-31848: Improper Neutralization of Input During Web Page Generation

Cross site scripting XSS vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.7.100 allows a remote attacker to highjack an active DLP ePO administrator session by convincing the logged in administrator to click on a carefully crafted link in the case management part of the...

CVE-2020-7305

Privilege escalation vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.5.3 allows a low privileged remote attacker to create new rule sets via incorrect validation of user credentials...

CVE-2020-7305 DLP ePO extension - Privilege escalation

Privilege escalation vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.5.3 allows a low privileged remote attacker to create new rule sets via incorrect validation of user credentials...

CVE-2020-7305: Improper Privilege Management

Privilege escalation vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.5.3 allows a low privileged remote attacker to create new rule sets via incorrect validation of user credentials...

CVE-2020-7304: Cross-Site Request Forgery (CSRF)

Cross site request forgery vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.5.3 allows authenticated remote attacker to embed a CRSF script via adding a new label...

CVE-2020-7303: Improper Neutralization of Input During Web Page Generation

Cross Site scripting vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.5.3 allows authenticated remote user to trigger scripts to run in a user's browser via adding a new label...

CVE-2020-7302: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type in McAfee Data Loss Prevention DLP ePO extension prior to 11.5.3 allows authenticated attackers to upload malicious files to the DLP case management section via lack of sanity checking...

PT-2020-19538

Name of the Vulnerable Software and Affected Versions McAfee Data Loss Prevention DLP ePO extension versions prior to 11.5.3 Description A Cross Site scripting issue allows an authenticated remote user to trigger scripts to run in a user's browser by adding a new label. Recommendations For versio...

PT-2020-19539

Name of the Vulnerable Software and Affected Versions McAfee Data Loss Prevention DLP ePO extension versions prior to 11.5.3 Description A cross-site request forgery issue allows an authenticated remote attacker to embed a CSRF script by adding a new label. Recommendations For versions prior to...

PT-2020-19540

Name of the Vulnerable Software and Affected Versions McAfee Data Loss Prevention DLP ePO extension versions prior to 11.5.3 Description A privilege escalation issue exists due to incorrect validation of user credentials, allowing a low-privileged remote attacker to create new rule sets...

CVE-2020-7300: Incorrect Authorization

Improper Authorization vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.5.3 allows authenticated remote attackers to change the configuration when logged in with view only privileges via carefully constructed HTTP post messages...

CVE-2020-7301: Improper Neutralization of Input During Web Page Generation

Cross Site scripting vulnerability in McAfee Data Loss Prevention DLP ePO extension prior to 11.5.3 allows authenticated attackers to trigger alerts via the file upload tab in the DLP case management section...

PT-2020-19536

Name of the Vulnerable Software and Affected Versions McAfee Data Loss Prevention DLP ePO extension versions prior to 11.5.3 Description The issue allows authenticated remote attackers to change the configuration when logged in with view-only privileges via carefully constructed HTTP post message...

PT-2020-19537

Name of the Vulnerable Software and Affected Versions McAfee Data Loss Prevention DLP ePO extension versions prior to 11.5.3 Description A Cross Site scripting issue allows authenticated attackers to trigger alerts via the file upload tab in the DLP case management section. Recommendations For...