McAfee ePolicy Orchestrator Cross Site Scripting Vulnerability (Jun 2015)

McAfee ePolicy Orchestrator is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Code injection

Intel McAfee ePolicy Orchestrator ePO 4.x through 4.6.9 and 5.x through 5.1.2 does not validate server names and Certification Authority names in X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certifica...

CVE-2015-2859

Intel McAfee ePolicy Orchestrator ePO 4.x through 4.6.9 and 5.x through 5.1.2 does not validate server names and Certification Authority names in X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certifica...

CVE-2015-2859

McAfee ePolicy Orchestrator (ePO) is affected by CVE-2015-2859 due to improper validation of SSL/TLS server certificates (CN/SAN/CA). A MITM attacker can spoof servers and access sensitive data. Affected versions are 4.x up to 4.6.9 and 5.x up to 5.1.2. Remediation: upgrade to the fixed releases ...

CVE-2015-2859

Intel McAfee ePolicy Orchestrator ePO 4.x through 4.6.9 and 5.x through 5.1.2 does not validate server names and Certification Authority names in X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certifica...

McAfee ePolicy Orchestrator Product Configuration Feature Cross-Site Scripting Vulnerability

McAfee ePolicy Orchestrator is an industry-leading systems security management solution that helps organizations effectively defend against a wide range of malicious threats and attacks. A cross-site scripting vulnerability exists in the Product Configuration feature of the McAfee ePolicy...

CVE-2015-4559

Cross-site scripting XSS vulnerability in the product deployment feature in the Java core web services in Intel McAfee ePolicy Orchestrator ePO before 5.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4559

Cross-site scripting XSS vulnerability in the product deployment feature in the Java core web services in Intel McAfee ePolicy Orchestrator ePO before 5.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

McAfee ePolicy Orchestrator Deep Command Path Handling Local Elevation of Privilege Vulnerability

McAfee ePolicy Orchestrator is an industry-leading systems security management solution that helps organizations effectively defend against malicious threats and attacks. McAfee ePolicy Orchestrator Deep Command fails to properly handle paths and directories, allowing local attackers to exploit...

McAfee Data Loss Prevention Endpoint Cross-Site Scripting Vulnerability

McAfee Data Loss Prevention Endpoint is an integrated endpoint data protection solution from McAfee. The solution prevents theft and accidental disclosure of confidential data and provides security policies for file handling and transfer, shared endpoint data flow control and data encryption. A...

McAfee ePolicy Orchestrator XML Entity Injection (CVE-2015-0921)

An XML External Entity vulnerability has been reported in McAfee ePolicy Orchestrator ePO. The vulnerability is due to an input validation error in the ePO-web application. A remote attacker can exploit this vulnerability by sending a maliciously crafted XML dashboard definition...

McAfee ePolicy Orchestrator 4.x < 4.6.9 / 5.x < 5.1.2 Multiple Vulnerabilities (SB10095)

The version of McAfee ePolicy Orchestrator ePO installed on the remote Windows host is 4.x prior to 4.6.9 or 5.x prior to 5.1.2. It is, therefore, affected by multiple vulnerabilities : - An XXE XML External Entity injection vulnerability exists in the Server Task Log due to an incorrectly...

McAfee ePolicy Orchestrator Authenticated XXE Credentials Exposure Exploit

This module will exploit an authenticated XXE vulnerability to read the keystore.properties off of the filesystem. This properties file contains an encrypted password that is set during installation. What is interesting about this password is that it is set as the same password as the database 's...

McAfee ePolicy Orchestrator Information Disclosure Vulnerability (CNVD-2015-00419)

McAfee ePolicy Orchestrator is a set of scalable security management software from the U.S. company McAfee McAfee. An information disclosure vulnerability exists in McAfee ePolicy Orchestrator versions prior to 4.6.9, and 5.x versions prior to 5.1.2, which allows an attacker to obtain the...

McAfee ePolicy Orchestrator XML External Entity Vulnerability

McAfee ePolicy Orchestrator is a set of scalable security management software from the U.S. company McAfee McAfee. An XML external entity vulnerability exists in McAfee ePolicy Orchestrator versions prior to 4.6.9, and 5.x versions prior to 5.1.2, which could allow an authenticated, remote attack...

McAfee ePolicy Orchestrator Authenticated XXE Credentials Exposure

This module will exploit an authenticated XXE vulnerability to read the keystore.properties off of the filesystem. This properties file contains an encrypted password that is set during installation. What is interesting about this password is that it is set as the same password as the database 's...

McAfee ePolicy Orchestrator Multiple Vulnerabilities (Jan 2015)

McAfee ePolicy Orchestrator is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2015-0922

McAfee ePolicy Orchestrator ePO before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password...

CVE-2015-0921

XML external entity XXE vulnerability in the Server Task Log in McAfee ePolicy Orchestrator ePO before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do...

Default credentials

McAfee ePolicy Orchestrator ePO before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password...