McAfee ePolicy Orchestrator security vulnerability

Few vulnerabilities are used in-the-wild to compromise corporate networks...

TA13-193A: Exploit Tool Targets Vulnerabilities in McAfee ePolicy Orchestrator (ePO)

US Computer Emergency Readiness Team banner graphic National Cyber Awareness System: TA13-193A: Exploit Tool Targets Vulnerabilities in McAfee ePolicy Orchestrator ePO 07/12/2013 02:19 PM EDT Original release date: July 12, 2013 Systems Affected McAfee ePolicy Orchestrator ePO Overview A new...

McAfee ePolicy Orchestrator Installed (credentialed check)

McAfee ePolicy Orchestrator, a centralized security management application, is installed on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid67119; scriptversion"1.15"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/10/10";...

Trellix ePolicy Orchestrator Application Server Detection

ePolicy Orchestrator ePO Application Server, a web interface for ePO, was detected on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid66318; scriptversion"1.11"; scriptsetattributeattribute:"pluginmodificationdate", value:"2024/03/14";...

McAfee ePolicy Orchestrator 4.6.x Multiple Vulnerabilities (SB10042)

According to its self-reported version, the version of McAfee ePolicy Orchestrator running on the remote host has the following vulnerabilities : - An unspecified SQL injection vulnerability exists in the Agent-Handler component. A remote, unauthenticated attacker could exploit this to execute...

CVE-2013-0140

SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator ePO before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel...

CVE-2013-0141

Directory traversal vulnerability in McAfee ePolicy Orchestrator ePO before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to upload arbitrary files via a crafted request over the Agent-Server communication channel, as demonstrated by writing to the Software/ directory...

Sql injection

SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator ePO before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel...

CVE-2013-0141

Directory traversal vulnerability in McAfee ePolicy Orchestrator ePO before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to upload arbitrary files via a crafted request over the Agent-Server communication channel, as demonstrated by writing to the Software/ directory...

CVE-2013-0140

SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator ePO before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel...

Directory traversal

Directory traversal vulnerability in McAfee ePolicy Orchestrator ePO before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to upload arbitrary files via a crafted request over the Agent-Server communication channel, as demonstrated by writing to the Software/ directory...

CVE-2013-0141

Directory traversal vulnerability in McAfee ePolicy Orchestrator ePO before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to upload arbitrary files via a crafted request over the Agent-Server communication channel, as demonstrated by writing to the Software/ directory...

CVE-2013-0141

Summary (CVE-2013-0141): A directory traversal vulnerability in McAfee ePolicy Orchestrator (ePO) allows a remote attacker to upload arbitrary files via a crafted request over the Agent-Server communication channel, demonstrated by writing to the Software/ directory. It affects ePO versions prior...

CVE-2013-0140

SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator ePO before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel...

McAfee ePolicy Orchestrator 4.6.4 and earlier pre-authenticated SQL injection and directory path traversal vulnerabilities

Overview McAfee ePolicy Orchestrator 4.6.4 and earlier contains a pre-authenticated sql injection and directory path traversal vulnerability which could allow an attacker to inject malicious code into the system. Description McAfee ePolicy Orchestrator 4.6.4 and earlier contains a pre-authenticat...

McAfee ePolicy Orchestrator Framework Services HTTP Code Injection (CVE-2008-1855)

A buffer overflow vulnerability exists in McAfee Framework Services used in McAfee ePolicy Orchestrator and other products...

McAfee Virtual Technician ActiveX Control GetObject() Method Remote Command Execution (SB10028)

The remote Windows host has a version of the McAfee Virtual Technician / ePolicy Orchestrator ActiveX control that allows execution of arbitrary code. The 'GetObject' method can be used to load any class on the underlying operating system. For example, by loading the 'WScript.Shell' class,...

CVE-2012-4594

McAfee ePolicy Orchestrator ePO 4.6.1 and earlier allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information from arbitrary reporting panels, via a modified ID value in a console URL...

CVE-2012-4594

McAfee ePolicy Orchestrator ePO 4.6.1 and earlier allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information from arbitrary reporting panels, via a modified ID value in a console URL...

mcafee-epo-agent NSE Script

Check if ePO agent is running on port 8081 or port identified as ePO Agent port. Script Arguments slaxml.debug See the documentation for the slaxml library. http.host, http.max-body-size, http.max-cache-size, http.max-pipeline, http.pipeline, http.truncated-ok, http.useragent See the documentatio...