Mcafee Network Data Loss Prevention vulnerabilities

31 known vulnerabilities affecting mcafee/network_data_loss_prevention.

Total CVEs

CISA KEV

Public exploits

Exploited in wild

Severity breakdown

CRITICAL1HIGH5MEDIUM15LOW10

Vulnerabilities

Page 1 of 2

CVE-2017-3968CRITICALCVSS 9.1fixed in 9.3.4.1.5≥ 9.3, < 9.3.4.1.5 Hotfix 1201697_478682018-06-13

CVE-2017-3968 [CRITICAL] CWE-384 CVE-2017-3968: Session fixation vulnerability in the web interface in McAfee Network Security Manager (NSM) before Session fixation vulnerability in the web interface in McAfee Network Security Manager (NSM) before 8.2.7.42.2 and McAfee Network Data Loss Prevention (NDLP) before 9.3.4.1.5 allows remote attackers to disclose sensitive information or manipulate the database via a crafted authentication cookie.

nvd

CVE-2017-3935HIGHCVSS 7.5≤ 9.3.0v9.3.X2017-10-31

CVE-2017-3935 [HIGH] CWE-200 CVE-2017-3935: Network Data Loss Prevention is vulnerable to MIME type sniffing which allows older versions of Inte Network Data Loss Prevention is vulnerable to MIME type sniffing which allows older versions of Internet Explorer to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the intended content type.

nvd

CVE-2017-3934MEDIUMCVSS 5.9≤ 9.3.0v9.3.X2017-10-31

CVE-2017-3934 [MEDIUM] CWE-200 CVE-2017-3934: Missing HTTP Strict Transport Security state information vulnerability in the server in McAfee Netwo Missing HTTP Strict Transport Security state information vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows man-in-the-middle attackers to expose confidential data via read files on the webserver.

nvd

CVE-2017-3933MEDIUMCVSS 5.4v9.3.0v9.3.1+4 more2017-10-31

CVE-2017-3933 [MEDIUM] CWE-79 CVE-2017-3933: Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP) 9 Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential information via a cross site request forgery attack.

nvd

CVE-2017-4014HIGHCVSS 8.0≤ 9.3.0v9.3.x2017-05-17

CVE-2017-4014 [HIGH] CWE-384 CVE-2017-4014: Session Side jacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x Session Side jacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view, add, and remove users via modification of the HTTP request.

nvd

CVE-2017-4013MEDIUMCVSS 5.3≤ 9.3.0v9.3.x2017-05-17

CVE-2017-4013 [MEDIUM] CWE-200 CVE-2017-4013: Banner Disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote at Banner Disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to obtain product information via HTTP response header.

nvd

CVE-2017-4017MEDIUMCVSS 5.3≤ 9.3.0v9.3.x2017-05-17

CVE-2017-4017 [MEDIUM] CWE-200 CVE-2017-4017: User Name Disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote User Name Disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to view user information via the appliance web interface.

nvd

CVE-2017-4011MEDIUMCVSS 6.1PoC≤ 9.3.0v9.3.x2017-05-17

CVE-2017-4011 [MEDIUM] CWE-79 CVE-2017-4011: Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Preve Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to get session/cookie information via modification of the HTTP request.

nvd

CVE-2017-4016MEDIUMCVSS 5.3≤ 9.3.0v9.3.x2017-05-17

CVE-2017-4016 [MEDIUM] CWE-200 CVE-2017-4016: Web Server method disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allow Web Server method disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to exploit and find another hole via HTTP response header.

nvd

CVE-2017-4012MEDIUMCVSS 6.5≤ 9.3.0v9.3.x2017-05-17

CVE-2017-4012 [MEDIUM] CVE-2017-4012: Privilege Escalation vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x Privilege Escalation vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential information via modification of the HTTP request.

nvd

CVE-2017-4015MEDIUMCVSS 4.5≤ 9.3.0v9.3.x2017-05-17

CVE-2017-4015 [MEDIUM] CWE-1021 CVE-2017-4015: Clickjacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows Clickjacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to inject arbitrary web script or HTML via HTTP response header.

nvd

CVE-2014-8522HIGHCVSS 7.5≤ 9.2.2v8.6+2 more2014-10-29

CVE-2014-8522 [HIGH] CWE-287 CVE-2014-8522: The MySQL database in McAfee Network Data Loss Prevention (NDLP) before 9.3 does not require a passw The MySQL database in McAfee Network Data Loss Prevention (NDLP) before 9.3 does not require a password, which makes it easier for remote attackers to obtain access.

nvd

CVE-2014-8533HIGHCVSS 7.5≤ 9.2.2v8.6+2 more2014-10-29

CVE-2014-8533 [HIGH] CVE-2014-8533: McAfee Network Data Loss Prevention (NDLP) before 9.3 allows remote attackers to execute arbitrary c McAfee Network Data Loss Prevention (NDLP) before 9.3 allows remote attackers to execute arbitrary code via vectors related to ICMP redirection.

nvd

CVE-2014-8530HIGHCVSS 7.5≤ 9.2.2v8.6+2 more2014-10-29

CVE-2014-8530 [HIGH] CVE-2014-8530: Unspecified vulnerability in McAfee Network Data Loss Prevention (NDLP) before 9.3 allows remote att Unspecified vulnerability in McAfee Network Data Loss Prevention (NDLP) before 9.3 allows remote attackers to obtain sensitive information, affect integrity, or cause a denial of service via unknown vectors, related to simultaneous logins.

nvd

CVE-2014-8524MEDIUMCVSS 5.0≤ 9.2.2v8.6+2 more2014-10-29

CVE-2014-8524 [MEDIUM] CWE-200 CVE-2014-8524: McAfee Network Data Loss Prevention (NDLP) before 9.3 does not disable the autocomplete setting for McAfee Network Data Loss Prevention (NDLP) before 9.3 does not disable the autocomplete setting for the password and other fields, which allows remote attackers to obtain sensitive information via unspecified vectors.

nvd

CVE-2014-8523MEDIUMCVSS 6.8≤ 9.2.2v8.6+2 more2014-10-29

CVE-2014-8523 [MEDIUM] CWE-352 CVE-2014-8523: Cross-site request forgery (CSRF) vulnerability in McAfee Network Data Loss Prevention (NDLP) before Cross-site request forgery (CSRF) vulnerability in McAfee Network Data Loss Prevention (NDLP) before 9.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

nvd

CVE-2014-8520MEDIUMCVSS 5.0≤ 9.2.2v8.6+2 more2014-10-29

CVE-2014-8520 [MEDIUM] CWE-200 CVE-2014-8520: McAfee Network Data Loss Prevention (NDLP) before 9.3 allows remote attackers to obtain sensitive in McAfee Network Data Loss Prevention (NDLP) before 9.3 allows remote attackers to obtain sensitive information via vectors related to open network ports.

nvd

CVE-2014-8535MEDIUMCVSS 4.6≤ 9.2.1v8.6+1 more2014-10-29

CVE-2014-8535 [MEDIUM] CVE-2014-8535: McAfee Network Data Loss Prevention (NDLP) before 9.2.2 allows local users to bypass intended restri McAfee Network Data Loss Prevention (NDLP) before 9.2.2 allows local users to bypass intended restriction on unspecified functionality via unknown vectors.

nvd

CVE-2014-8525MEDIUMCVSS 5.0≤ 9.2.2v8.6+2 more2014-10-29

CVE-2014-8525 [MEDIUM] CWE-200 CVE-2014-8525: McAfee Network Data Loss Prevention (NDLP) before 9.3 does not include the HTTPOnly flag in a Set-Co McAfee Network Data Loss Prevention (NDLP) before 9.3 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

nvd

CVE-2014-8531MEDIUMCVSS 6.5≤ 9.2.2v8.6+2 more2014-10-29

CVE-2014-8531 [MEDIUM] CWE-310 CVE-2014-8531: The TLS/SSL Server in McAfee Network Data Loss Prevention (NDLP) before 9.3 uses weak cipher algorit The TLS/SSL Server in McAfee Network Data Loss Prevention (NDLP) before 9.3 uses weak cipher algorithms, which makes it easier for remote authenticated users to execute arbitrary code via unspecified vectors.

nvd

1 / 2Next →