CVE-2015-0922

CVE-2015-0922 affects McAfee ePolicy Orchestrator (ePO) versions before 4.6.9 and 5.x before 5.1.2. The issue is an information disclosure: the product uses the same secret key to encrypt password data across different customer installations, allowing an attacker with knowledge of the encrypted p...

CVE-2015-0921

XML external entity XXE vulnerability in the Server Task Log in McAfee ePolicy Orchestrator ePO before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do...

McAfee ePolicy Orchestrator 'conditionXML' Parameter XML External Entity Injection Vulnerability

McAfee ePolicy Orchestrator ePO is an industry-leading systems security management solution that helps organizations effectively defend against a wide range of malicious threats and attacks. An XML external entity injection vulnerability exists in the McAfee ePolicy Orchestrator 'conditionXML'...

McAfee ePolicy Orchestrator Authenticated XXE Credential Exposure Exploit

This Metasploit module will exploit an authenticated XXE vulnerability to read the keystore.properties off of the filesystem. This properties file contains an encrypted password that is set during installation. What is interesting about this password is that it is set as the same password as the...

McAfee ePolicy Orchestrator Authenticated XXE Credentials Exposure

This module will exploit an authenticated XXE vulnerability to read the keystore.properties off of the filesystem. This properties file contains an encrypted password that is set during installation. What is interesting about this password is that it is set as the same password as the database 's...

Microsoft Windows SMB Registry : McAfee EPO GUID

By reading the registry key HKLM\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent, it was possible to determine that the remote Windows system is managed by McAfee EPO. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid77477; scriptversion"1.7";...

McAfee ePolicy Orchestrator / ProtectionPilot Overflow

No description provided by source. $Id: mcafeeepolicysource.rb 10394 2010-09-20 08:06:27Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and term...

McAfee ePolicy Orchestrator 1.x/2.x/3.0 Agent HTTP POST Buffer Mismanagement Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9476/info The McAfee ePolicy Orchestrator agent has been reported to a buffer management vulnerability that may be exploited to crash the affected agent. Although unconfirmed, it has been reported that the issue may also...

McAfee ePolicy Orchestrator 4.6.0-4.6.5 (ePowner) - Multiple Vulnerabilities

No description provided by source. Exploit Title: McAfee ePolicy Orchestrator 4.6.0-4.6.5 ePowner - Multiple vulnerabilities Date: 20 November 2012 Exploit Author: [email protected] a.k.a. [email protected] Vendor Homepage: http://www.mcafee.com/uk/products/epolicy-orchestrator.aspx Version...

McAfee Framework ePolicy 3.x - Orchestrator '_naimcomn_Log' Remote Format String Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/28228/info McAfee Framework is prone to a remote format-string vulnerability. Exploiting this issue will allow attackers to execute arbitrary code with the permissions of the framework or of an application that uses the...

McAfee ePolicy Orchestrator Remote Code Execution (CVE-2013-0140; CVE-2013-0141)

A remote code execution vulnerability has been reported in McAfee ePolicy Orchestrator ePO. The vulnerability is due to an error in the ePO server that fails to properly sanitize user supplied data. A remote attacker can exploit this weakness to execute arbitrary code via a specially crafted http...

McAfee ePolicy Orchestrator Multiple OpenSSL Vulnerabilities (SB10075)

The remote host is running a version of McAfee ePolicy Orchestrator that is affected by multiple vulnerabilities due to flaws in the OpenSSL library : - An error exists in the function 'ssl3readbytes' that could allow data to be injected into other sessions or allow denial of service attacks. Not...

McAfee ePolicy Orchestrator OpenSSL Information Disclosure (SB10071) (Heartbleed)

The remote host is running a version of McAfee ePolicy Orchestrator that is affected by an information disclosure due to a flaw in the OpenSSL library, commonly known as the Heartbleed bug. An attacker could potentially exploit this vulnerability repeatedly to read up to 64KB of memory from the...

McAfee ePolicy Orchestrator 4.6.0-4.6.5 (ePowner) - Multiple Vulnerabilities

McAfee ePolicy Owner ePowner version 0.1 is an exploit that can add an administrative user to McAfee ePolicy Orchestrator as well as execute arbitrary commands on versions 4.6.0 through 4.6.5. Exploit Title: McAfee ePolicy Orchestrator 4.6.0-4.6.5 ePowner - Multiple vulnerabilities Date: 20...

McAfee ePolicy Orchestrator 4.6.0 4.6.5 - ePowner Multiple Vulnerabilities

McAfee ePolicy Orchestrator 4.6.0 4.6.5 - ePowner Multiple Vulnerabilities Exploit Title: McAfee ePolicy Orchestrator 4.6.0-4.6.5 ePowner - Multiple vulnerabilities Date: 20 November 2012 Exploit Author: [email protected] a.k.a. [email protected] Vendor Homepage:...

McAfee ePolicy Orchestrator 4.6.0 < 4.6.5 - 'ePowner' Multiple Vulnerabilities

Exploit Title: McAfee ePolicy Orchestrator 4.6.0-4.6.5 ePowner - Multiple vulnerabilities Date: 20 November 2012 Exploit Author: [email protected] a.k.a. [email protected] Vendor Homepage: http://www.mcafee.com/uk/products/epolicy-orchestrator.aspx Version: 4.6.0 - 4.6.5 Tested on: Windows...

McAfee ePolicy Orchestrator XML External Entity (CVE-2014-2205)

An XML External Entity XXE vulnerability has been reported in McAfee ePolicy Orchestrator ePO. The vulnerability is due to a design weakness in the ePO Web Console component. A remote attacker can exploit this vulnerability by sending a maliciously crafted XML dashboard definition...

McAfee ePolicy Orchestrator < 4.6.7 Hotfix 940148 XXE Vulnerability

McAfee ePolicy Orchestrator is prone to an XML external entity XXE vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

McAfee ePolicy Orchestrator information leakage

Information leakage via XML include...

McAfee ePolicy Orchestrator XML外部实体漏洞

Bugtraq ID:65771 McAfee ePolicy Orchestrator是一款业界领先的系统安全管理解决方案，能够帮助企业有效抵御各种恶意威胁和攻击。 McAfee ePolicy Orchestrator在解析XML实体时存在错误，允许攻击者通过特制的包含外部实体引用的XML文档，获取本地文件内容信息。 要成功利用漏洞需要有编辑dashboards, queries, reports或server任务的权限。 0 McAfee ePolicy Orchestrator 4.6.7 厂商补丁： McAfee ----- 用户可参考如下厂商提供的安全补丁以修复该漏洞：...