Mcafee
358 CVEs across 184 Mcafee products. Browse Mcafee vulnerabilities, severities, and proof-of-concept exploits.
Mcafee products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-20050 | Medium | 6.2 | 2026-04-04 | NetSchedScan 1.0 contains a buffer overflow vulnerability in the scan Hostname/IP field that allows local attackers to crash the application by supplying an ov… |
CVE-2024-25254 | Critical | 9.8 | 2024-11-11 | SuperScan v4.1 was discovered to contain a buffer overflow via the Hostname/IP parameter. |
CVE-2023-5445 | Medium | 5.4 | 2023-11-17 | An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL parameter for the p… |
CVE-2023-5444 | High | 8.0 | 2023-11-17 | A Cross Site Request Forgery vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2 allows a remote low privilege user to successfully add a new u… |
CVE-2023-40352 | High | 7.2 | 2023-08-21 | McAfee Safe Connect before 2.16.1.126 may allow an adversary with system privileges to achieve privilege escalation by loading arbitrary DLLs. |
CVE-2023-3946 | Medium | 5.4 | 2023-07-26 | A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to… |
CVE-2023-25134 | Medium | 6.7 | 2023-03-21 | McAfee Total Protection prior to 16.0.50 may allow an adversary (with full administrative access) to modify a McAfee specific Component Object Model (COM) in t… |
CVE-2023-0978 | Medium | 6.4 | 2023-03-13 | A command injection vulnerability in Trellix Intelligent Sandbox CLI for version 5.2 and earlier, allows a local user to inject and execute arbitrary operatin… |
CVE-2023-24579 | Medium | 5.5 | 2023-03-13 | McAfee Total Protection prior to 16.0.51 allows attackers to trick a victim into uninstalling the application via the command prompt. |
CVE-2023-24578 | Medium | 5.5 | 2023-03-13 | McAfee Total Protection prior to 16.0.49 allows attackers to elevate user privileges due to DLL sideloading. This could enable a user with lower privileges to… |
CVE-2023-24577 | Medium | 5.5 | 2023-03-13 | McAfee Total Protection prior to 16.0.50 allows attackers to elevate user privileges due to Improper Link Resolution via registry keys. This could enable a use… |
CVE-2023-0221 | Medium | 4.4 | 2023-01-13 | Product security bypass vulnerability in ACC prior to version 8.3.4 allows a locally logged-in attacker with administrator privileges to bypass the execution c… |
CVE-2022-43751 | High | 7.8 | 2022-11-23 | McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable pointing to a subdirec… |
CVE-2022-2188 | Medium | 6.5 | 2022-11-07 | Privilege escalation vulnerability in DXL Broker for Windows prior to 6.0.0.280 allows local users to gain elevated privileges by exploiting weak directory con… |
CVE-2022-3339 | Medium | 5.4 | 2022-10-18 | A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 Update 14 allows a remote unauthenticated attacker to potentially obtain access to an… |
CVE-2022-3338 | Medium | 5.4 | 2022-10-18 | An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side R… |
CVE-2022-2330 | Medium | 6.5 | 2022-08-30 | Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 allows a remote attacker to cause the DLP Age… |
CVE-2022-37025 | High | 7.8 | 2022-08-18 | An improper privilege management vulnerability in McAfee Security Scan Plus (MSS+) before 4.1.262.1 could allow a local user to modify a configuration file and… |
CVE-2022-2313 | High | 8.2 | 2022-07-27 | A DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, which allows local users to execute arbitrary code and obtain higher privil… |
CVE-2022-1824 | High | 7.9 | 2022-06-20 | An uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local attacker to perform a sideloadi… |
CVE-2022-1823 | High | 7.9 | 2022-06-20 | Improper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local user to modify a configuratio… |
CVE-2022-1254 | Medium | 6.1 | 2022-04-20 | A URL redirection vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.9, 9.x prior to 9.2.20, 8.x prior to 8.2.27, and 7.x prior to 7.8.2.31, and… |
CVE-2022-1258 | High | 8.4 | 2022-04-14 | A blind SQL injection vulnerability in the ePolicy Orchestrator (ePO) extension of MA prior to 5.7.6 can be exploited by an authenticated administrator on ePO… |
CVE-2022-1257 | Medium | 6.1 | 2022-04-14 | Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain access to sensitive info… |
CVE-2022-1256 | High | 7.8 | 2022-04-14 | A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged user to gain system privileges through running the re… |
CVE-2022-0862 | Low | 3.1 | 2022-03-23 | A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote… |
CVE-2022-0861 | Low | 3.5 | 2022-03-23 | A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a… |
CVE-2022-0859 | Medium | 6.5 | 2022-03-23 | McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the resto… |
CVE-2022-0858 | Medium | 4.3 | 2022-03-23 | A cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obta… |
CVE-2022-0857 | Medium | 5.4 | 2022-03-23 | A reflected cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potent… |
CVE-2022-0842 | Medium | 5.4 | 2022-03-23 | A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote authenticated attacker to potential… |
CVE-2022-0815 | Medium | 6.5 | 2022-03-10 | Improper access control vulnerability in McAfee WebAdvisor Chrome and Edge browser extensions up to 8.1.0.1895 allows a remote attacker to gain access to McAfe… |
CVE-2022-0280 | High | 7.5 | 2022-03-10 | A race condition vulnerability exists in the QuickClean feature of McAfee Total Protection for Windows prior to 16.0.43 that allows a local user to gain privil… |
CVE-2021-4088 | High | 8.4 | 2022-01-24 | SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authen… |
CVE-2022-0166 | High | 7.8 | 2022-01-19 | A privilege escalation vulnerability in the McAfee Agent prior to 5.7.5. McAfee Agent uses openssl.cnf during the build process to specify the OPENSSLDIR varia… |
CVE-2021-31854 | High | 7.7 | 2022-01-19 | A command Injection Vulnerability in McAfee Agent (MA) for Windows prior to 5.7.5 allows local users to inject arbitrary shell code into the file cleanup.exe… |
CVE-2022-0129 | High | 7.4 | 2022-01-11 | Uncontrolled search path element vulnerability in McAfee TechCheck prior to 4.0.0.2 allows a local administrator to load their own Dynamic Link Library (DLL) g… |
CVE-2021-31833 | High | 7.1 | 2022-01-04 | Potential product security bypass vulnerability in McAfee Application and Change Control (MACC) prior to version 8.3.4 allows a locally logged in attacker to c… |
CVE-2021-4038 | Medium | 4.8 | 2021-12-09 | Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) prior to 10.1 Minor 7 allows a remote authenticated administrator to embed a… |
CVE-2021-31850 | Medium | 6.1 | 2021-12-08 | A denial-of-service vulnerability in Database Security (DBS) prior to 4.8.4 allows a remote authenticated administrator to trigger a denial-of-service attack a… |
CVE-2021-31852 | Medium | 6.1 | 2021-11-23 | A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script… |
CVE-2021-31851 | Medium | 6.1 | 2021-11-23 | A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script… |
CVE-2021-31853 | High | 7.8 | 2021-11-10 | DLL Search Order Hijacking Vulnerability in McAfee Drive Encryption (MDE) prior to 7.3.0 HF2 (7.3.0.183) allows local users to execute arbitrary code and escal… |
CVE-2021-31849 | High | 8.4 | 2021-11-01 | SQL injection vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.7.100 allows a remote attacker logged into ePO as an administrator t… |
CVE-2021-31848 | High | 8.4 | 2021-11-01 | Cross site scripting (XSS) vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.7.100 allows a remote attacker to highjack an active DL… |
CVE-2021-23877 | Medium | 6.7 | 2021-10-26 | Privilege escalation vulnerability in the Windows trial installer of McAfee Total Protection (MTP) prior to 16.0.34_x may allow a local user to run arbitrary c… |
CVE-2021-31835 | Medium | 4.8 | 2021-10-22 | Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script or HTM… |
CVE-2021-31834 | Medium | 5.4 | 2021-10-22 | Stored Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script… |
CVE-2021-23893 | High | 8.8 | 2021-10-01 | Privilege Escalation vulnerability in a Windows system driver of McAfee Drive Encryption (DE) prior to 7.3.0 could allow a local non-admin user to gain elevate… |
CVE-2021-31847 | High | 8.2 | 2021-09-22 | Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a local attacker to perform a DLL preloadin… |
CVE-2021-31841 | High | 8.2 | 2021-09-22 | A DLL sideloading vulnerability in McAfee Agent for Windows prior to 5.7.4 could allow a local user to perform a DLL sideloading attack with an unsigned DLL wi… |
CVE-2021-31836 | Medium | 5.6 | 2021-09-22 | Improper privilege management vulnerability in maconfig for McAfee Agent for Windows prior to 5.7.4 allows a local user to gain access to sensitive information… |
CVE-2021-31845 | High | 8.4 | 2021-09-17 | A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Discover prior to 11.6.100 allows an attacker in the same network as the DLP Discover to e… |
CVE-2021-31844 | High | 8.2 | 2021-09-17 | A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a local attacker to execute arbitrary code w… |
CVE-2021-31843 | High | 7.3 | 2021-09-17 | Improper privileges management vulnerability in McAfee Endpoint Security (ENS) Windows prior to 10.7.0 September 2021 Update allows local users to access files… |
CVE-2021-31842 | Medium | 5.0 | 2021-09-17 | XML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2021 Update allows a local user to initiat… |
CVE-2021-3712 | High | 7.4 | 2021-08-24 | ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buf… |
CVE-2021-2432 | Low | 3.7 | 2021-07-21 | Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version that is affected is Java SE: 7u301. Difficult to exploit vulner… |
CVE-2021-33037 | Medium | 5.3 | 2021-07-12 | Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstanc… |
CVE-2021-30639 | High | 7.5 | 2021-07-12 | A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling… |
CVE-2021-31838 | High | 8.4 | 2021-06-29 | A command injection vulnerability in MVISION EDR (MVEDR) prior to 3.4.0 allows an authenticated MVEDR administrator to trigger the EDR client to execute arbitr… |
CVE-2021-31840 | High | 7.3 | 2021-06-10 | A vulnerability in the preloading mechanism of specific dynamic link libraries in McAfee Agent for Windows prior to 5.7.3 could allow an authenticated, local a… |
CVE-2021-31839 | Medium | 4.8 | 2021-06-10 | Improper privilege management vulnerability in McAfee Agent for Windows prior to 5.7.3 allows a local user to modify event information in the MA event folder… |
CVE-2020-13938 | Medium | 5.5 | 2021-06-10 | Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows |
CVE-2021-31837 | High | 8.8 | 2021-06-09 | Memory corruption vulnerability in the driver file component in McAfee GetSusp prior to 4.0.0 could allow a program being investigated on the local machine to… |
CVE-2021-31832 | Medium | 5.2 | 2021-06-09 | Improper Neutralization of Input in the ePO administrator extension for McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a remot… |
CVE-2021-31830 | Medium | 5.9 | 2021-06-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows an… |
CVE-2021-31831 | Medium | 4.9 | 2021-06-03 | Incorrect access to deleted scripts vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authenticated attacker to gain access to s… |
CVE-2021-23896 | Low | 3.2 | 2021-06-02 | Cleartext Transmission of Sensitive Information vulnerability in the administrator interface of McAfee Database Security (DBSec) prior to 4.8.2 allows an admin… |
CVE-2021-23895 | Critical | 9.0 | 2021-06-02 | Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authenticated attacker to create a reverse s… |
CVE-2021-23894 | Critical | 9.6 | 2021-06-02 | Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote unauthenticated attacker to create a reverse… |
CVE-2021-23892 | High | 8.2 | 2021-05-12 | By exploiting a time of check to time of use (TOCTOU) race condition during the Endpoint Security for Linux Threat Prevention and Firewall (ENSL TP/FW) install… |
CVE-2021-23891 | High | 7.8 | 2021-05-12 | Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.32 allows a local user to gain elevated privileges by impersonating a client… |
CVE-2021-23872 | High | 7.8 | 2021-05-12 | Privilege Escalation vulnerability in the File Lock component of McAfee Total Protection (MTP) prior to 16.0.32 allows a local user to gain elevated privileges… |
CVE-2021-2161 | Medium | 5.9 | 2021-04-22 | Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are… |
CVE-2021-23887 | High | 7.8 | 2021-04-15 | Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to writ… |
CVE-2021-23886 | Medium | 5.5 | 2021-04-15 | Denial of Service vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to cause a… |
CVE-2021-23884 | Medium | 4.3 | 2021-04-15 | Cleartext Transmission of Sensitive Information vulnerability in the ePO Extension of McAfee Content Security Reporter (CSR) prior to 2.8.0 allows an ePO admin… |
CVE-2020-7308 | Medium | 4.8 | 2021-04-15 | Cleartext Transmission of Sensitive Information between McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update and McAfee Global Threa… |
CVE-2020-7270 | Medium | 4.9 | 2021-04-15 | Exposure of Sensitive Information in the web interface in McAfee Advanced Threat Defense (ATD) prior to 4.12.2 allows remote authenticated users to view sensit… |
CVE-2020-7269 | Medium | 4.9 | 2021-04-15 | Exposure of Sensitive Information in the web interface in McAfee Advanced Threat Defense (ATD) prior to 4.12.2 allows remote authenticated users to view sensit… |
CVE-2021-23890 | Medium | 6.5 | 2021-03-26 | Information leak vulnerability in the Agent Handler of McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows an unauthenticated user to download McA… |
CVE-2021-23889 | Low | 3.5 | 2021-03-26 | Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows ePO administrators to inject arbitrary web script or HTM… |
CVE-2021-23888 | Medium | 6.3 | 2021-03-26 | Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 could cause an authenticated ePO user to load a… |
CVE-2021-3450 | High | 7.4 | 2021-03-25 | The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from… |
CVE-2021-3449 | Medium | 5.9 | 2021-03-25 | An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the… |
CVE-2020-7346 | High | 7.8 | 2021-03-23 | Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) for Windows prior to 11.6.100 allows a local, low privileged, attacker through the use… |
CVE-2021-23879 | Medium | 6.7 | 2021-03-15 | Unquoted service path vulnerability in McAfee Endpoint Product Removal (EPR) Tool prior to 21.2 allows local administrators to execute arbitrary code, with hig… |
CVE-2021-23885 | Critical | 9.0 | 2021-02-17 | Privilege escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.8 allows an authenticated user to gain elevated privileges through the User Interfa… |
CVE-2021-23840 | High | 7.5 | 2021-02-16 | Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the… |
CVE-2021-23881 | Medium | 4.8 | 2021-02-10 | A stored cross site scripting vulnerability in ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 February 2021 Update allows an ENS ePO administr… |
CVE-2021-23876 | High | 7.8 | 2021-02-10 | Bypass Remote Procedure call in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and perform arbitrary file modif… |
CVE-2021-23874 | High | 8.2 | 2021-02-10 | Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitra… |
CVE-2021-23873 | High | 7.8 | 2021-02-10 | Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and perform arbitrary file… |
CVE-2021-23883 | Medium | 4.0 | 2021-02-10 | A Null Pointer Dereference vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows a local administrator to cau… |
CVE-2021-23882 | High | 8.2 | 2021-02-10 | Improper Access Control vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows local administrators to prevent… |
CVE-2021-23880 | Medium | 6.7 | 2021-02-10 | Improper Access Control in attribute in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows authenticated local administrato… |
CVE-2021-23878 | High | 7.3 | 2021-02-10 | Clear text storage of sensitive Information in memory vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows a… |
CVE-2021-3156 | High | 7.8 | 2021-01-26 | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" a… |
CVE-2021-1257 | High | 8.8 | 2021-01-20 | A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthenticated, remote attacker to conduct a cross-site requ… |