Cross site scripting

Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator ePO prior to 5.10 Update 10 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized...

CVE-2021-23890

CVE-2021-23890 (McAfee ePolicy Orchestrator) : An information-disclosure flaw in the ePO Agent Handler allows an unauthenticated attacker in a DMZ-enabled setup to download McAfee Agent packages from the ePO repository and obtain policy details from the ePO server. Affected: McAfee ePO prior to 5...

CVE-2021-23890 McAfee ePO Information Leak vulnerability

Information leak vulnerability in the Agent Handler of McAfee ePolicy Orchestrator ePO prior to 5.10 Update 10 allows an unauthenticated user to download McAfee product packages specifically McAfee Agent available in ePO repository and install them on their own machines to have it managed and the...

CVE-2021-23888 McAfee ePO unvalidated URL redirect vulnerability

Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator ePO prior to 5.10 Update 10 could cause an authenticated ePO user to load an untrusted site in an ePO iframe which could steal information from the authenticated user...

CVE-2021-23888

CVE-2021-23888 affects McAfee ePolicy Orchestrator (ePO) and is an unvalidated client-side URL redirect vulnerability in ePO prior to 5.10 Update 10. An authenticated ePO user could load an untrusted site inside an ePO iframe, potentially enabling information theft. Connected sources confirm the ...

CVE-2021-23889 McAfee ePO Cross-site Scripting vulnerability

Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator ePO prior to 5.10 Update 10 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized...

CVE-2021-23889

CVE-2021-23889 affects McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10. The vulnerability is a Cross-Site Scripting (XSS) issue where administrator entries are not properly sanitized, allowing injected web script or HTML via multiple parameters. Exploitation would involve a malicious in...

McAfee ePolicy Orchistrator 信息泄露漏洞

McAfee ePolicy Orchistrator ePO is a suite of scalable security management software from McAfee. The software enables centralized, streamlined management of endpoint, network, content security and compliance solutions. An information disclosure vulnerability exists in McAfee ePolicy Orchestrator...

Mcafee McAfee ePolicy Orchistrator 跨站脚本漏洞

McAfee ePolicy Orchistrator ePO is a suite of scalable security management software from McAfee. The software enables centralized, streamlined management of endpoint, network, content security and compliance solutions. A cross-site scripting vulnerability exists in McAfee ePolicy Orchestrator ePO...

PT-2021-15590 · Mcafee · Mcafee Epolicy Orchestrator

Name of the Vulnerable Software and Affected Versions: McAfee ePolicy Orchestrator versions prior to 5.10 Update 10 Description: The issue is related to an unvalidated client-side URL redirect, which could allow an authenticated user to load an untrusted site in an ePO iframe, potentially leading...

CVE-2020-7346

Privilege Escalation vulnerability in McAfee Data Loss Prevention DLP for Windows prior to 11.6.100 allows a local, low privileged, attacker through the use of junctions to cause the product to load DLLs of the attacker's choosing. This requires the creation and removal of junctions by the attack...

CVE-2020-7346

Privilege Escalation vulnerability in McAfee Data Loss Prevention DLP for Windows prior to 11.6.100 allows a local, low privileged, attacker through the use of junctions to cause the product to load DLLs of the attacker's choosing. This requires the creation and removal of junctions by the attack...

Privilege escalation

Privilege Escalation vulnerability in McAfee Data Loss Prevention DLP for Windows prior to 11.6.100 allows a local, low privileged, attacker through the use of junctions to cause the product to load DLLs of the attacker's choosing. This requires the creation and removal of junctions by the attack...

CVE-2020-7346

Summary of CVE-2020-7346 (McAfee DLP for Windows) : A local privilege-escalation vulnerability in McAfee Data Loss Prevention (DLP) for Windows prior to 11.6.100 allows a low-privileged attacker to load DLLs of their choosing by abusing junctions, requiring creation/removal of junctions and timin...

CVE-2020-7346 Privilege escalation in McAfee DLP Endpoint for Windows

Privilege Escalation vulnerability in McAfee Data Loss Prevention DLP for Windows prior to 11.6.100 allows a local, low privileged, attacker through the use of junctions to cause the product to load DLLs of the attacker's choosing. This requires the creation and removal of junctions by the attack...

PT-2021-2460 · Mcafee · Mcafee Data Loss Prevention

Name of the Vulnerable Software and Affected Versions: McAfee Data Loss Prevention DLP for Windows versions prior to 11.6.100 Description: The issue is related to a privilege escalation vulnerability that allows a local, low-privileged attacker to load DLLs of their choice by using junctions and...

Popular Netop Remote Learning Software Found Vulnerable to Hacking

Cybersecurity researchers on Sunday disclosed multiple critical vulnerabilities in remote student monitoring software Netop Vision Pro that a malicious attacker could abuse to execute arbitrary code and take over Windows computers. "These findings allow for elevation of privileges and ultimately...

Netop Vision Pro - Distance Learning Software is 20/20 in Hindsight

ARCHIVED STORY Netop Vision Pro – Distance Learning Software is 20/20 in Hindsight By Sam Quinn · MAR 21, 2021 · 27 MIN READ The McAfee Labs Advanced Threat Research team is committed to uncovering security issues in both software and hardware to help developers provide safer products for...

Operation Dianxun Cyberespionage Campaign Targeting Telecommunication Companies

ARCHIVED STORY Operation Diànxùn: Cyberespionage Campaign Targeting Telecommunication Companies By Thomas Roccia · MAR 16, 2021 In this report the McAfee Advanced Threat Research ATR Strategic Intelligence team details an espionage campaign, targeting telecommunication companies, dubbed Operation...

CVE-2021-23879

Unquoted service path vulnerability in McAfee Endpoint Product Removal EPR Tool prior to 21.2 allows local administrators to execute arbitrary code, with higher-level privileges, via execution from a compromised folder. The tool did not enforce and protect the execution path. Local admin privileg...