CVE-2015-2859

McAfee ePolicy Orchestrator (ePO) is affected by CVE-2015-2859 due to improper validation of SSL/TLS server certificates (CN/SAN/CA). A MITM attacker can spoof servers and access sensitive data. Affected versions are 4.x up to 4.6.9 and 5.x up to 5.1.2. Remediation: upgrade to the fixed releases ...

CVE-2015-2859

Intel McAfee ePolicy Orchestrator ePO 4.x through 4.6.9 and 5.x through 5.1.2 does not validate server names and Certification Authority names in X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certifica...

McAfee ePolicy Orchestrator Product Configuration Feature Cross-Site Scripting Vulnerability

McAfee ePolicy Orchestrator is an industry-leading systems security management solution that helps organizations effectively defend against a wide range of malicious threats and attacks. A cross-site scripting vulnerability exists in the Product Configuration feature of the McAfee ePolicy...

CVE-2015-4559

Cross-site scripting XSS vulnerability in the product deployment feature in the Java core web services in Intel McAfee ePolicy Orchestrator ePO before 5.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the product deployment feature in the Java core web services in Intel McAfee ePolicy Orchestrator ePO before 5.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4559

McAfee ePolicy Orchestrator (ePO) – CVE-2015-4559: Cross-site scripting vulnerability in the Java core web services’ deployment feature. The issue allows injection of arbitrary web script/HTML via unspecified vectors in ePO before version 5.1.2. Connected sources (OpenVAS entry) corroborate an XS...

CVE-2015-4559

Cross-site scripting XSS vulnerability in the product deployment feature in the Java core web services in Intel McAfee ePolicy Orchestrator ePO before 5.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

McAfee Agent Unsupported Version Detection

According to its self-reported version number, the installation of McAfee Agent formerly known as McAfee Common Management Agent on the remote host is no longer supported. McAfee Agent is a component of the McAfee's ePolicy Orchestrator ePO system security management solution. Lack of support...

McAfee ePolicy Orchestrator Security Bypass Vulnerability

McAfee ePolicy Orchestrator is an industry-leading systems security management solution that helps organizations effectively defend against a wide range of malicious threats and attacks. A security bypass vulnerability exists in McAfee ePolicy Orchestrator due to the program failing to properly...

McAfee ePolicy Orchestrator fails to properly validate SSL/TLS certificates

Overview McAfee ePolicy Orchestrator versions 4.6.8 and earlier and 5.1.1 and earlier fail to properly validate SSL/TLS certificates. Description CWE-295: Improper Certificate Validation - CVE-2015-2859McAfee ePolicy Orchestrator ePO supports integration with external registered servers for a...

McAfee Agent 4.6.x < 4.8.0.1938 / 5.0.x < 5.0.1 Log View Clickjacking (SB10094)

According to its self-reported version, the McAfee Agent MA running on the remote host is 4.6.x prior to 4.8.0.1938 or 5.0.x prior to 5.0.1. It is, therefore, affected by a clickjacking vulnerability in the log viewing feature due to improper validation of user-supplied input. A remote attacker c...

McAfee Managed Agent 4.6.x < 4.8.0.1938 / 5.0.x < 5.0.1 Log View Clickjacking (SB10094) (credentialed check)

According to its self-reported version number, the remote host has a version of McAfee Agent MA installed that is 4.6.x prior to 4.8.0.1938 or 5.0.x prior to 5.0.1. It is, therefore, affected by a clickjacking vulnerability in the log viewing feature due to improper validation of user-supplied...

McAfee Firewall Enterprise IGMP Packet Integer Overflow DoS (SB10107)

The remote host has a version of McAfee Firewall Enterprise installed that is affected by an integer overflow condition. An unauthenticated, remote attacker, by sending a specially crafted IGMP packet, can cause the application to crash due to allocation of insufficient memory. An incomplete fix...

McAfee ePO Deep Command Local Elevation of Privilege Vulnerability

McAfee ePO Deep Command is an extension of McAfee's primary endpoint security management product. A security vulnerability in Client Management and Gateway handling of windows search paths in McAfee ePO Deep Command allows local users to exploit the vulnerability to elevate privileges...

SA95 : VENOM Vulnerability in Virtualization Platforms

SUMMARY The VENOM vulnerability allows a local guest user in affected virtualized platforms to escape from the virtual environment and execute code on the host. An attacker can use this vulnerability to gain complete access to the host and to the host's local network and adjacent systems. AFFECTE...

CVE-2015-3987

Multiple unquoted Windows search path vulnerabilities in the 1 Client Management and 2 Gateway in McAfee ePO Deep Command 2.1 and 2.2 before HF 1058831 allow local users to gain privileges via unspecified vectors...

Design/Logic Flaw

Multiple unquoted Windows search path vulnerabilities in the 1 Client Management and 2 Gateway in McAfee ePO Deep Command 2.1 and 2.2 before HF 1058831 allow local users to gain privileges via unspecified vectors...

CVE-2015-3987

Multiple unquoted Windows search path vulnerabilities in the 1 Client Management and 2 Gateway in McAfee ePO Deep Command 2.1 and 2.2 before HF 1058831 allow local users to gain privileges via unspecified vectors...

CVE-2015-3987

McAfee ePO Deep Command (Client Management and Gateway) 2.1/2.2 are affected by CVE-2015-3987 due to unquoted Windows search paths leading to local privilege elevation. The issue is rooted in unquoted path handling, enabling local users to gain privileges via unspecified vectors. A patched releas...

McAfee ePolicy Orchestrator Deep Command Path Handling Local Elevation of Privilege Vulnerability

McAfee ePolicy Orchestrator is an industry-leading systems security management solution that helps organizations effectively defend against malicious threats and attacks. McAfee ePolicy Orchestrator Deep Command fails to properly handle paths and directories, allowing local attackers to exploit...