Mcafee Llc Mcafee Epolicy Orchestrator vulnerabilities

12 known vulnerabilities affecting mcafee_llc/mcafee_epolicy_orchestrator.

Total CVEs
12
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
MEDIUM11LOW1

Vulnerabilities

Page 1 of 1
CVE-2022-0842MEDIUMCVSS 4.9≥ unspecified, < 5.10 CU 132022-03-23
CVE-2022-0842 [MEDIUM] CWE-89 CVE-2022-0842: A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Up A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote authenticated attacker to potentially obtain information from the ePO database. The data obtained is dependent on the privileges the attacker has and to obtain sensitive data the attacker would require administrator privileges.
cvelistv5nvd
CVE-2022-0858MEDIUMCVSS 4.7≥ unspecified, < 5.10 CU 132022-03-23
CVE-2022-0858 [MEDIUM] CWE-79 CVE-2022-0858: A cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to A cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to limited ability to alter some information in ePO due to the area of
cvelistv5nvd
CVE-2022-0859MEDIUMCVSS 6.7≥ unspecified, < 5.10 CU 132022-03-23
CVE-2022-0859 [MEDIUM] CWE-522 CVE-2022-0859: McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to poin McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the restoration of the ePO server. To achieve this the attacker would have to be logged onto the server hosting the ePO server (restricted to administrators) and to know the SQL server password.
cvelistv5nvd
CVE-2022-0862MEDIUMCVSS 5.3≥ unspecified, < 5.10 CU 132022-03-23
CVE-2022-0862 [MEDIUM] CWE-522 CVE-2022-0862: A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to change the password of a compromised session without knowing the existing user's password. This functionality was removed from the User Interface in ePO 10 and the API has now been
cvelistv5nvd
CVE-2022-0857MEDIUMCVSS 6.1≥ unspecified, < 5.10 CU 132022-03-23
CVE-2022-0857 [MEDIUM] CWE-79 CVE-2022-0857: A reflected cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) A reflected cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to limited access to sensitive information and limited abili
cvelistv5nvd
CVE-2022-0861LOWCVSS 3.8≥ unspecified, < 5.10 CU 132022-03-23
CVE-2022-0861 [LOW] CWE-611 CVE-2022-0861: A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Up A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some ability to alter data.
cvelistv5nvd
CVE-2021-31834MEDIUMCVSS 5.4≥ unspecified, < 5.10 CU 112021-10-22
CVE-2021-31834 [MEDIUM] CWE-79 CVE-2021-31834: Stored Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update Stored Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized.
cvelistv5nvd
CVE-2021-31835MEDIUMCVSS 4.8≥ unspecified, < 5.10 CU 112021-10-22
CVE-2021-31835 [MEDIUM] CWE-79 CVE-2021-31835: Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allo Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script or HTML via a specific parameter where the administrator's entries were not correctly sanitized.
cvelistv5nvd
CVE-2021-23890MEDIUMCVSS 6.5≥ unspecified, < 5.10 CU 102021-03-26
CVE-2021-23890 [MEDIUM] CWE-200 CVE-2021-23890: Information leak vulnerability in the Agent Handler of McAfee ePolicy Orchestrator (ePO) prior to 5. Information leak vulnerability in the Agent Handler of McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows an unauthenticated user to download McAfee product packages (specifically McAfee Agent) available in ePO repository and install them on their own machines to have it managed and then in turn get policy details from the ePO server.
cvelistv5nvd
CVE-2021-23888MEDIUMCVSS 6.3≥ unspecified, < 5.10 CU 102021-03-26
CVE-2021-23888 [MEDIUM] CWE-601 CVE-2021-23888: Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.1 Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 could cause an authenticated ePO user to load an untrusted site in an ePO iframe which could steal information from the authenticated user.
cvelistv5nvd
CVE-2021-23889MEDIUMCVSS 4.8≥ unspecified, < 5.10 CU 102021-03-26
CVE-2021-23889 [MEDIUM] CWE-79 CVE-2021-23889: Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allo Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized.
cvelistv5nvd
CVE-2019-3619MEDIUMCVSS 4.9≥ 5.9.x and 5.10.0, < 5.10.0 Update 42019-07-03
CVE-2019-3619 [MEDIUM] CWE-319 CVE-2019-3619: Information Disclosure vulnerability in the Agent Handler in McAfee ePolicy Orchestrator (ePO) 5.9.x Information Disclosure vulnerability in the Agent Handler in McAfee ePolicy Orchestrator (ePO) 5.9.x and 5.10.0 prior to 5.10.0 update 4 allows remote unauthenticated attacker to view sensitive information in plain text via sniffing the traffic between the Agent Handler and the SQL server.
cvelistv5nvd