CVE-2019-3595

Improper Neutralization of Special Elements used in a Command 'Command Injection' in ePO extension in McAfee Data Loss Prevention DLP 11.x prior to 11.3.0 allows Authenticated Adminstrator to execute arbitrary code with their local machine privileges via a specially crafted DLP policy, which is...

Command injection

Improper Neutralization of Special Elements used in a Command 'Command Injection' in ePO extension in McAfee Data Loss Prevention DLP 11.x prior to 11.3.0 allows Authenticated Adminstrator to execute arbitrary code with their local machine privileges via a specially crafted DLP policy, which is...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in ePO extension in McAfee Data Loss Prevention DLPe for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted uploa...

CVE-2019-3591

McAfee DLPe (Data Loss Prevention Endpoint) with the ePO extension for Windows has a stored XSS vulnerability (CVE-2019-3591) due to improper input neutralization during web page generation in the ePO UI. A remote, unauthenticated user can trigger JavaScript via a crafted upload to a remote websi...

CVE-2019-3591 DLP Endpoint ePO extension vulnerable to XSS

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in ePO extension in McAfee Data Loss Prevention DLPe for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted uploa...

CVE-2019-3595

CVE-2019-3595 affects McAfee Data Loss Prevention (DLP) Endpoint, specifically the ePO extension in DLP 11.x before 11.3.0. The root cause is improper neutralization of special elements during command construction when a DLP policy is exported and opened on the local machine. An authenticated adm...

CVE-2019-3595 DLP Endpoint ePO extension not sanitizing CSV exports

Improper Neutralization of Special Elements used in a Command 'Command Injection' in ePO extension in McAfee Data Loss Prevention DLP 11.x prior to 11.3.0 allows Authenticated Adminstrator to execute arbitrary code with their local machine privileges via a specially crafted DLP policy, which is...

McAfee Common UI ePO Extension Information Disclosure Vulnerability

McAfee Common UI CUI is a set of user interfaces for managing McAfee products from McAfee, Inc. in the United States. ePO extension is one of the software managers. A security vulnerability exists in the ePO extension in McAfee CUI version 2.0.2. A remote attacker could exploit the vulnerability ...

CVE-2018-6670

External Entity Attack vulnerability in the ePO extension in McAfee Common UI CUI 2.0.2 allows remote authenticated users to view confidential information via a crafted HTTP request parameter...

CVE-2018-6670

External Entity Attack vulnerability in the ePO extension in McAfee Common UI CUI 2.0.2 allows remote authenticated users to view confidential information via a crafted HTTP request parameter...

Xxe

External Entity Attack vulnerability in the ePO extension in McAfee Common UI CUI 2.0.2 allows remote authenticated users to view confidential information via a crafted HTTP request parameter...

CVE-2018-6670

The CVE-2018-6670 entry concerns McAfee Common UI (CUI) 2.0.2, specifically the ePO extension. The vulnerability is an External Entity Attack that allows remote authenticated users to view confidential information by sending a crafted HTTP request parameter. Supported documents confirm the affect...

McAfee Data Loss Prevention Endpoint ePO extension cross-site scripting vulnerability

McAfee Data Loss Prevention Endpoint DLP Endpoint is an integrated endpoint data protection solution from McAfee, Inc. that prevents theft and accidental disclosure of confidential data and provides security policies for file handling and transfer, shared endpoint data flow control, and data...

CVE-2017-3948

Cross Site Scripting XSS in IMG Tags in the ePO extension in McAfee Data Loss Prevention Endpoint DLP Endpoint 10.0.x allows authenticated users to inject arbitrary web script or HTML via injecting malicious JavaScript into a user's browsing session...

CVE-2017-3948

Summary: CVE-2017-3948 is a Cross Site Scripting (XSS) vulnerability in the IMG Tags of the ePO extension for McAfee Data Loss Prevention Endpoint (DLP Endpoint) 10.0.x. The underlying issue is an XSS in IMG Tags that allows an authenticated user to inject arbitrary web script or HTML via malicio...

CVE-2017-3980

A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator ePO 5.9.0, 5.3.2, and 5.1.3 and earlier allows remote authenticated users to execute a command of their choice via an authenticated ePO session...

McAfee Data Loss Prevention Endpoint EPO Extended Cross-Site Scripting Vulnerability

McAfee Data Loss Prevention Endpoint DLPe is an integrated endpoint data protection solution from the U.S. company McAfee McAfee. The McAfee Data Loss Prevention Endpoint DLPe epo extension suffers from a cross-site scripting vulnerability that could be exploited by a remote attacker to inject...

Cross site scripting

Cross-site scripting XSS vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint DLPe before 9.3 Patch 4 Hotfix 16 9.3.416.4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-2760

CVE-2015-2760 is an XSS vulnerability in the McAfee DLPe ePO extension prior to 9.3 Patch 4 Hotfix 16 (9.3.416.4). The issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors in the ePO extension of DLPe. Affected product/version: McAfee Data Loss Pr...

CVE-2015-2758

The CVE-2015-2758 entry affects the McAfee Data Loss Prevention Endpoint (DLPe) ePO extension prior to 9.3 Patch 4 Hotfix 16 (9.3.416.4). The vulnerability allows remote authenticated users to obtain sensitive information, modify the database, or cause other unspecified impact via a crafted URL. ...