CVE-2015-2053

The log viewer in McAfee Agent MA before 4.8.0 Patch 3 and 5.0.0, when the "Accept connections only from the ePO server" option is disabled, allows remote attackers to conduct clickjacking attacks via a crafted web page, aka an "http-generic-click-jacking" vulnerability...

KLA10484 Interface spoofing vulnerability in McAfee Agent

An unspecified vulnerability was found in McAfee Agent. By exploiting this vulnerability malicious users conduct clicjacking attack. This vulnerability can be exploited remotely via a specially designed web page. Original advisories McAfee bulletin Exploitation Related products McAfee-Agent CVE...

CVE-2015-2053: Improper Input Validation

The log viewer in McAfee Agent MA before 4.8.0 Patch 3 and 5.0.0, when the "Accept connections only from the ePO server" option is disabled, allows remote attackers to conduct clickjacking attacks via a crafted web page, aka an "http-generic-click-jacking" vulnerability...

PT-2015-5570

Name of the Vulnerable Software and Affected Versions McAfee Agent versions prior to 4.8.0 Patch 3 McAfee Agent versions prior to 5.0.0 Description The issue allows remote attackers to conduct clickjacking attacks via a crafted web page when the "Accept connections only from the ePO server" optio...

KLA10259 DoS vulnerability in McAfee Agent

An unspecified vulnerability was found in McAfee Agent. By exploiting this vulnerability malicious users can cuase denial of service. This vulnerability can be exploited remotely via a specially designed HTTP request. Original advisories - Exploitation Related products McAfee-Agent CVE list...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePO Extension for the McAfee Agent MA 4.5 through 4.6, allow remote attackers to inject arbitrary web script or HTML via the 1 instanceId parameter core/loadDisplayType.do; 2 instanceId or ...

PT-2013-5259

Name of the Vulnerable Software and Affected Versions McAfee ePolicy Orchestrator versions 4.6.6 and earlier McAfee Agent MA versions 4.5 and 4.6 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the uid parameter to specific API...

CVE-2013-4883: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePO Extension for the McAfee Agent MA 4.5 through 4.6, allow remote attackers to inject arbitrary web script or HTML via the 1 instanceId parameter core/loadDisplayType.do; 2 instanceId or ...

PT-2013-5260

Name of the Vulnerable Software and Affected Versions McAfee ePolicy Orchestrator versions 4.6.6 and earlier McAfee ePO Extension for the McAfee Agent versions 4.5 through 4.6 Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters, including...

CVE-2009-5115: Undefined Security Weakness

McAfee Common Management Agent CMA 3.5.5 through 3.5.5.588 and 3.6.0 through 3.6.0.608, and McAfee Agent 4.0 before Patch 3, allows remote authenticated users to overwrite arbitrary files by accessing a report-writing ActiveX control COM object...

PT-2012-1280

Name of the Vulnerable Software and Affected Versions McAfee Common Management Agent CMA versions 3.5.5 through 3.5.5.588 McAfee Common Management Agent CMA versions 3.6.0 through 3.6.0.608 McAfee Agent versions prior to 4.0 Patch 3 Description The issue allows remote authenticated users to...

NAePolicy.txt

Summary: Privilege escalation in Network Associates ePolicy Orchestrator Agent 3.5.0 patch 3 http://www.nai.com/ Details: The ePolicy Orchestrator Agent web server which runs on TCP port 8081 by default and serves the McAfee Agent Activity Log can be used to view files that exist on the same...