Improper access control

Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security ENS Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS...

CVE-2020-7251 ESConfig Tool able to edit configuration for newer version

Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security ENS Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS...

CVE-2020-7251

The CVE-2020-7251 issue affects McAfee Endpoint Security (ENS) for Windows specifically its Configuration Tool. The root cause is improper access control in the Configuration Tool prior to ENS 10.6.1 (February 2020 Update), enabling local users to disable security features via unauthorized use of...

The vulnerability of the McAfee Client Proxy software lies in its ability to bypass authentication by using a user-controlled password. This allows attackers to circumvent web traffic scanning and gain access to blocked websites.

The vulnerability of the McAfee Client Proxy software relates to the bypassing of authentication procedures by using a key controlled by the user. Exploiting this vulnerability allows an attacker to bypass web traffic scanning and gain access to blocked websites for a short period of time. This i...

Iran Cyber Threat Update

ARCHIVED STORY Iran Cyber Threat Update By Trellix · January 08, 2020 Recent political tensions in the Middle East region have led to significant speculation of increased cyber-related activities. McAfee is on a heightened state of alert to monitor the evolving threats and rapidly implement...

The vulnerability of the McAfee Total Protection antivirus protection lies in the lack of protection for service data, allowing attackers to gain unauthorized access to the list of excluded files and modify it.

The vulnerability of the McAfee Total Protection antivirus protection lies in the lack of protection for service data. Exploiting this vulnerability can allow an intruder to gain unauthorized access to the list of excluded files and modify it...

Iran Cyber Threat Update

ARCHIVED STORY Iran Cyber Threat Update By Trellix · January 08, 2020 Recent political tensions in the Middle East region have led to significant speculation of increased cyber-related activities. McAfee is on a heightened state of alert to monitor the evolving threats and rapidly implement...

The vulnerability of the EPSetup.exe executable file of the McAfee Endpoint Security security tool allows a perpetrator to execute arbitrary code.

The vulnerability of the EPSetup.exe executable file of the McAfee Endpoint Security security tool is related to incorrect code generation. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of the ePolicy Orchestrator extension of the McAfee Data Loss Prevention software allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the ePolicy Orchestrator extension of the McAfee Data Loss Prevention software lies in the insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the McAfee Advanced Threat Defense software arises from insufficient validation of input data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the McAfee Advanced Threat Defense security tool exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information through specially crafted POST requests...

The vulnerability of the McAfee Advanced Threat Defense software arises from insufficient validation of input data, allowing a perpetrator to gain unauthorized access to the atduser account information.

The vulnerability of the McAfee Advanced Threat Defense security tool exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain unauthorized access to the atduser account through specially crafted GET requests...

The vulnerability of the “/absolute/pathname/here” component of the McAfee Advanced Threat Defense security tool, which allows a perpetrator to gain access to files in the local file system.

The vulnerability of the “/absolute/pathname/here” component of the McAfee Advanced Threat Defense security tool exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to...

The vulnerability of the McAfee Advanced Threat Defense software lies in the lack of protection for the SQL query structure, allowing attackers to execute arbitrary commands.

The vulnerability of the McAfee Advanced Threat Defense security tool is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability in the Administrator web console of the McAfee Web Gateway web server allows a perpetrator to carry out a clickjacking attack.

The vulnerability of the Administrator web console of the McAfee Web Gateway lies in insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to carry out a clickjacking attack using a specially crafted web page...

The vulnerability of the McAfee Advanced Threat Defense software’s database storage mechanism allows a malicious actor to gain unauthorized access to the root password.

The vulnerability of the McAfee Advanced Threat Defense software’s database storage component is related to insufficient protection for registration data. Exploiting this vulnerability could allow an attacker to obtain unauthorized access to the root password...

The vulnerability of the McAfee Advanced Threat Defense software lies in the lack of protection for operational data, which allows attackers to gain unauthorized access to protected information.

The vulnerability of the McAfee Advanced Threat Defense security tool lies in the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the protected information...

CVE-2019-3667

DLL Search Order Hijacking vulnerability in the Microsoft Windows client in McAfee Tech Check 3.0.0.17 and earlier allows local users to execute arbitrary code via the local folder placed there by an attacker...

CVE-2019-3667

DLL Search Order Hijacking vulnerability in the Microsoft Windows client in McAfee Tech Check 3.0.0.17 and earlier allows local users to execute arbitrary code via the local folder placed there by an attacker...

Spoofing

DLL Search Order Hijacking vulnerability in the Microsoft Windows client in McAfee Tech Check 3.0.0.17 and earlier allows local users to execute arbitrary code via the local folder placed there by an attacker...

CVE-2019-3667

CVE-2019-3667 affects McAfee TechCheck (Windows client) up to version 3.0.0.17, where a DLL search order hijacking vulnerability allows a local attacker to execute arbitrary code by placing a malicious DLL in a local folder. The affected component is McAfee TechCheck’s Windows client; root cause ...