CVE-2020-7259

The CVE-2020-7259 entry concerns McAfee Endpoint Security (ENS) for Windows and describes a privilege/trust bypass via a crafted input file in ENS prior to 10.7.0 February 2020 Update. Connected docs indicate related issues in the same ENS release family and list fixes in 10.7.0 (April 2020 Updat...

CVE-2020-7261 Buffer overwrite in ENS allowed to bypass AMSI protection

Buffer Overflow via Environment Variables vulnerability in AMSI component in McAfee Endpoint Security ENS Prior to 10.7.0 February 2020 Update allows local users to disable Endpoint Security via a carefully crafted user input...

CVE-2020-7261

CVE-2020-7261 affects McAfee Endpoint Security (ENS) in the AMSI component. A buffer overflow via environment variables in ENS prior to 10.7.0 (February 2020 Update) can allow a local attacker to disable Endpoint Security by supplying crafted input. The vulnerability is limited to local access (a...

CVE-2020-7273 Autorun registry bypass

Accessing functionality not properly constrained by ACLs vulnerability in the autorun start-up protection in McAfee Endpoint Security ENS for Windows Prior to 10.7.0 April 2020 Update allows local users to delete or rename programs in the autorun key via manipulation of some parameters...

CVE-2020-7273

CVE-2020-7273 concerns McAfee Endpoint Security (ENS) for Windows, where the autorun start-up protection occasionally fails to constrain access via ACLs in the autorun key. The vulnerability allows a local user to delete or rename programs in the autorun key by manipulating parameters, as describ...

CVE-2020-7275 Unquoted service paths for some McAfee ENS files

Accessing, modifying or executing executable files vulnerability in the uninstaller in McAfee Endpoint Security ENS for Windows Prior to 10.7.0 April 2020 Update allows local users to execute arbitrary code via a carefully crafted input file...

CVE-2020-7275

CVE-2020-7275 affects McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 April 2020 Update. The vulnerability resides in the ENS uninstaller, where an input file can be crafted by a local attacker to access, modify, or execute arbitrary code. Impact is local: code execution with the attac...

CVE-2020-7274 ENS elevated permissions vulnerability

Privilege escalation vulnerability in McTray.exe in McAfee Endpoint Security ENS for Windows Prior to 10.7.0 April 2020 Update allows local users to spawn unrelated processes with elevated privileges via the system administrator granting McTray.exe elevated privileges by default it runs with the...

CVE-2020-7274

CVE-2020-7274 affects McAfee Endpoint Security for Windows, specifically the McTray.exe component. The vulnerability exists in versions prior to 10.7.0 (April 2020 Update) where local users can request elevated privileges for McTray.exe and, if granted by an administrator, spawn unrelated process...

CVE-2020-7277

CVE-2020-7277 (McAfee Endpoint Security for Windows) is a local-privilege issue in ENS prior to the 10.7.0 April 2020 Update. The vulnerability is a protection mechanism failure that allows local users to stop certain ENS processes, reducing protection. Connected sources (SB10309) confirm affecte...

CVE-2020-7277 McAfee processes not protected

Protection mechanism failure in all processes in McAfee Endpoint Security ENS for Windows prior to 10.7.0 April 2020 Update allows local users to stop certain McAfee ENS processes, reducing the protection offered...

CVE-2020-7276

CVE-2020-7276 affects McAfee Endpoint Security (ENS) for Windows before 10.7.0 April 2020 Update. The vulnerability is an authentication bypass in the MfeUpgradeTool that lets administrator users access policy settings by running the tool. Impact is exposure/ modification of policy settings by pr...

CVE-2020-7276 Unrestricted Policy Management using MfeUpgradeTool.exe

Authentication bypass vulnerability in MfeUpgradeTool in McAfee Endpoint Security ENS for Windows prior to 10.7.0 April 2020 Update allows administrator users to access policy settings via running this tool...

CVE-2020-7278

Exploiting incorrectly configured access control security levels vulnerability in ENS Firewall in McAfee Endpoint Security ENS for Windows prior to 10.7.0 April 2020 and 10.6.1 April 2020 updates allows remote attackers and local users to allow or block unauthorized traffic via pre-existing rules...

CVE-2020-7278

Exploiting incorrectly configured access control security levels vulnerability in ENS Firewall in McAfee Endpoint Security ENS for Windows prior to 10.7.0 April 2020 and 10.6.1 April 2020 updates allows remote attackers and local users to allow or block unauthorized traffic via pre-existing rules...

Security feature bypass

Exploiting incorrectly configured access control security levels vulnerability in ENS Firewall in McAfee Endpoint Security ENS for Windows prior to 10.7.0 April 2020 and 10.6.1 April 2020 updates allows remote attackers and local users to allow or block unauthorized traffic via pre-existing rules...

CVE-2020-7278 McAfee firewall rules not enforced correctly

Exploiting incorrectly configured access control security levels vulnerability in ENS Firewall in McAfee Endpoint Security ENS for Windows prior to 10.7.0 April 2020 and 10.6.1 April 2020 updates allows remote attackers and local users to allow or block unauthorized traffic via pre-existing rules...

CVE-2020-7278

McAfee Endpoint Security (ENS) Firewall for Windows is affected by CVE-2020-7278 due to an access-control rule handling flaw. The issue arises in ENS versions prior to 10.7.0 (Feb 2020/April 2020 updates) and 10.6.1 (April 2020 update), where pre-existing firewall rules are not properly enforced ...

PT-2020-19503

Name of the Vulnerable Software and Affected Versions McAfee Endpoint Security ENS for Windows versions prior to 10.7.0 February 2020 Update Description A privilege escalation issue exists in the administrative user interface of McAfee Endpoint Security ENS for Windows, where the system fails to...

PT-2020-19519

Name of the Vulnerable Software and Affected Versions McAfee Endpoint Security ENS for Windows versions prior to 10.7.0 April 2020 Update Description The issue is related to a protection mechanism failure in McAfee Endpoint Security ENS for Windows, which allows local users to stop certain...