CVE-2019-3622 DLP Endpoint log file redirection to arbitrary locations

Files or Directories Accessible to External Parties in McAfee Data Loss Prevention DLPe for Windows 11.x prior to 11.3.0 allows authenticated user to redirect DLPe log files to arbitrary locations via incorrect access control applied to the DLPe log folder allowing privileged users to create...

CVE-2019-3595

Improper Neutralization of Special Elements used in a Command 'Command Injection' in ePO extension in McAfee Data Loss Prevention DLP 11.x prior to 11.3.0 allows Authenticated Adminstrator to execute arbitrary code with their local machine privileges via a specially crafted DLP policy, which is...

CVE-2019-3591

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in ePO extension in McAfee Data Loss Prevention DLPe for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted uploa...

CVE-2019-3595

Improper Neutralization of Special Elements used in a Command 'Command Injection' in ePO extension in McAfee Data Loss Prevention DLP 11.x prior to 11.3.0 allows Authenticated Adminstrator to execute arbitrary code with their local machine privileges via a specially crafted DLP policy, which is...

Command injection

Improper Neutralization of Special Elements used in a Command 'Command Injection' in ePO extension in McAfee Data Loss Prevention DLP 11.x prior to 11.3.0 allows Authenticated Adminstrator to execute arbitrary code with their local machine privileges via a specially crafted DLP policy, which is...

CVE-2019-3591

McAfee DLPe (Data Loss Prevention Endpoint) with the ePO extension for Windows has a stored XSS vulnerability (CVE-2019-3591) due to improper input neutralization during web page generation in the ePO UI. A remote, unauthenticated user can trigger JavaScript via a crafted upload to a remote websi...

CVE-2019-3591 DLP Endpoint ePO extension vulnerable to XSS

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in ePO extension in McAfee Data Loss Prevention DLPe for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted uploa...

CVE-2019-3595

CVE-2019-3595 affects McAfee Data Loss Prevention (DLP) Endpoint, specifically the ePO extension in DLP 11.x before 11.3.0. The root cause is improper neutralization of special elements during command construction when a DLP policy is exported and opened on the local machine. An authenticated adm...

CVE-2019-3595 DLP Endpoint ePO extension not sanitizing CSV exports

Improper Neutralization of Special Elements used in a Command 'Command Injection' in ePO extension in McAfee Data Loss Prevention DLP 11.x prior to 11.3.0 allows Authenticated Adminstrator to execute arbitrary code with their local machine privileges via a specially crafted DLP policy, which is...

McAfee Data Loss Prevention Endpoint Cross-Site Scripting Vulnerability

McAfee Data Loss Prevention Endpoint DLPe is an integrated endpoint data protection solution from McAfee. The solution prevents theft and accidental disclosure of confidential data and provides security policies for file handling and transmission, shared endpoint data flow control and data...

McAfee Agent 5.6.x < 5.6.1 HF3 Privilege Escalation Vulnerability (SB10288)

The version of McAfee Agent, formerly McAfee ePolicy Orchestrator ePO Agent, installed on the remote host is 5.6.x prior to 5.6.1 HF3. It is, therefore, affected by a privilege escalation vulnerability. An authenticated, local administrator can exploit this issue, via carefully constructed file i...

McAfee Agent 5.0.x < 5.0.6 HF1267994 / 5.5.x < 5.5.1 HF1267994 / 5.6.x < 5.6.0 Use-After-Free Vulnerability (SB10258)

The version of McAfee Agent, formerly McAfee ePolicy Orchestrator ePO Agent, installed on the remote host is 5.0.x prior to 5.0.6 HF1267994, 5.5.x prior to 5.5.1 HF1267991, or 5.6.x prior to 5.6.0. It is, therefore, affected by a use-after-free vulnerability with the remote logging feature. An...

CVE-2019-3592

Privilege escalation vulnerability in McAfee Agent MA before 5.6.1 HF3, allows local administrator users to potentially disable some McAfee processes by manipulating the MA directory control and placing a carefully constructed file in the MA directory...

CVE-2019-3592

Privilege escalation vulnerability in McAfee Agent MA before 5.6.1 HF3, allows local administrator users to potentially disable some McAfee processes by manipulating the MA directory control and placing a carefully constructed file in the MA directory...

Privilege escalation

Privilege escalation vulnerability in McAfee Agent MA before 5.6.1 HF3, allows local administrator users to potentially disable some McAfee processes by manipulating the MA directory control and placing a carefully constructed file in the MA directory...

CVE-2019-3592 MA for Windows update addresses weak directory permissions

Privilege escalation vulnerability in McAfee Agent MA before 5.6.1 HF3, allows local administrator users to potentially disable some McAfee processes by manipulating the MA directory control and placing a carefully constructed file in the MA directory...

CVE-2019-3592

CVE-2019-3592 affects McAfee Agent (MA) prior to 5.6.1 HF3. A local administrator can escalate privileges by manipulating MA directory permissions and placing a crafted file in the MA directory to potentially disable some McAfee processes. Affected versions are MA before 5.6.1 HF3 (and related en...

McAfee ATR Aids Police in Arrest of Rubella & Dryad Office Macro Builder

ARCHIVED STORY McAfee ATR Aids Police in Arrest of Rubella & Dryad Office Macro Builder By John Fokker · July 16, 2019 Everyday thousands of people receive emails with malicious attachments in their email inbox. Disguised as a missed payment or an invoice, a cybercriminal sender tries to entice a...

July 16, 2019—KB4507463 (Preview of Monthly Rollup)

None None...

McAfee Agent Elevation of Privilege Vulnerability

McAfee Agent MA is a set of client components from McAfee, Inc. that provides secure communications between ePolicy Orchestrator antivirus management platform and managed products. An elevation of privilege vulnerability exists in McAfee MA versions prior to 5.6.1 HF2. An attacker could exploit t...