The vulnerability of the McAfee WebAdvisor antivirus protection plugin for browsers Chrome and Edge, related to access control deficiencies, allows a malicious actor to gain access to the plugin settings and other system information of the user.

The vulnerability of the McAfee WebAdvisor antivirus protection plugin for browsers Chrome and Edge is related to access control deficiencies. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the plugin settings and other system information of the...

The vulnerability of the McAfee Total Protection antivirus protection, related to synchronization errors when using a common resource, allows a hacker to trigger a service failure or gain privileged access.

The vulnerability of the McAfee Total Protection antivirus protection lies in synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to gain privileged access or cause service interruptions...

McAfee Agent SQL Injection Vulnerability

Mcafee McAfee Agent MA is a client component from Mcafee that provides secure communication between ePolicy Orchestrator antivirus management platform and the managed products.A SQL injection vulnerability exists in versions prior to McAfee Agent 5.7.6, which stems from the application Lack of...

Vulnerabilities fixed in McAfee Agent

Vulnerabilities have been fixed in McAfee Agent. The vulnerabilities potentially enable a malicious party to gain elevated privileges or access to sensitive data, or to execute arbitrary code execute arbitrary code with the application's permissions. McAfee has made updates available to address t...

CVE-2022-1257 Improper Verification of Cryptographic Signature by McAfee Agent

Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain access to sensitive information through storage in ma.db. The sensitive information has been moved to encrypted database files...

CVE-2022-1258 SQL injection vulnerability in McAfee Agent's ePO extension

A blind SQL injection vulnerability in the ePolicy Orchestrator ePO extension of MA prior to 5.7.6 can be exploited by an authenticated administrator on ePO to perform arbitrary SQL queries in the back-end database, potentially leading to command execution on the server...

CVE-2022-1256 Improper Privilege Management in McAfee Agent for Windows

A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged user to gain system privileges through running the repair functionality. Temporary file actions were performed on the local user's %TEMP% directory with System privileges through manipulation...

McAfee Agent 后置链接漏洞

Mcafee McAfee Agent MA is a McAfee client component that provides secure communication between ePolicy Orchestrator antivirus management platform and managed products. A security vulnerability previously existed in McAfee Agent for Windows 5.7.6 that allowed a local, low-privileged user to gain...

McAfee Agent 安全漏洞

The Mcafee McAfee Agent MA is a set of client-side components from Mcafee, Inc. that provides secure communication between ePolicy Orchestrator antivirus management platform and managed products. A security vulnerability previously existed in McAfee Agent for Linux, macOS, and Windows 5.7.6 that...

PT-2022-2473

Name of the Vulnerable Software and Affected Versions McAfee Agent versions prior to 5.7.6 Description The issue is related to insecure storage of sensitive information in the ma.db database, allowing a local user to gain access to this information. The sensitive information has been moved to...

McAfee Agent SQL注入漏洞

Mcafee McAfee Agent MA is a client component from Mcafee that provides secure communication between ePolicy Orchestrator antivirus management platform and the managed products.A SQL injection vulnerability exists in versions prior to McAfee Agent 5.7.6, which stems from the application Lack of...

McAfee ePolicy Orchestrator Multiple Vulnerabilities (SB10379)

The instance of McAfee ePolicy Orchestrator installed on the remote host is affected by multiple vulnerabilities, including the following: - McAfee Enterprise ePolicy Orchestrator ePO prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the...

McAfee Enterprise ePolicy Orchestrator SQL Injection Vulnerability

McAfee Epolicy Orchestrator McAfee Epo is a U.S. based solution for managing endpoint, network, data security, and compliance. a SQL injection vulnerability exists in versions of McAfee Enterprise ePolicy Orchestrator prior to 5.10 Update 13. The vulnerability stems from the application's lack of...

Vulnerabilities fixed in McAfee ePolicy Orchestrator

McAfee has fixed vulnerabilities in ePolicy Orchestrator. The vulnerabilities potentially enable a malicious party to launch attacks execute attacks that result in the following categories of damage: Cross-Site Scripting XSS. Remote code execution User Rights SQL Injection Access to sensitive dat...

CVE-2022-0858

A cross-site scripting XSS vulnerability in McAfee Enterprise ePolicy Orchestrator ePO prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to limited abilit...

CVE-2022-0857

A reflected cross-site scripting XSS vulnerability in McAfee Enterprise ePolicy Orchestrator ePO prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to...

CVE-2022-0857

A reflected cross-site scripting XSS vulnerability in McAfee Enterprise ePolicy Orchestrator ePO prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to...

CVE-2022-0861

A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator ePO prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some...

CVE-2022-0861

A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator ePO prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some...

CVE-2022-0862

A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator ePO prior to 5.10 Update 13 allows a remote attacker to change the password of a compromised session without knowing the existing user's password. This functionality was removed from...