Vulnerabilidades em McAfee

106 resultados
Análise Vexday

Com 104 CVEs catalogadas e nenhuma atividade registrada no CISA KEV, o perfil de risco ativo do McAfee situa-se abaixo da média geral do catálogo, o que indica pressão de exploração em produção relativamente contida no momento. Das vulnerabilidades existentes, 3 são de severidade crítica e 5 contam com prova de conceito pública disponível, o que ainda representa superfície de risco para ambientes sem patches atualizados. O maior EPSS observado é de 0,1168, associado a CVE-2017-3897, uma vulnerabilidade de idade considerável cuja probabilidade de exploração persiste e merece atenção em inventários legados. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão que sugere oportunidades de melhoria nos controles de sanitização de entrada ao longo da base de código histórica do vendor.

CVE-2017-3897—A Code Injection vulnerability in the non-certificate-based authentication mechanism in McAfee Live Safe versions prior to 16.0.3 and McAfeeEPSS 11.7%CVE-2018-6671MEDIUMSB10240 - ePolicy Orchestrator (ePO) - Application Protection Bypass vulnerabilityEPSS 4.7%CVE-2018-6667CRITICALMcAfee Web Gateway - Authentication Bypass vulnerabilityEPSS 3.5%CVE-2017-4053—Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticatEPSS 3.4%CVE-2017-4011—Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackeEPSS 3.3%CVE-2017-3898—A man-in-the-middle attack vulnerability in the non-certificate-based authentication mechanism in McAfee LiveSafe (MLS) versions prior to 16EPSS 3.2%CVE-2017-3980—A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, and 5.1.3 and earlier allows remEPSS 2.8%CVE-2017-4054—Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authenticatedEPSS 2.5%CVE-2019-3581HIGHMcAfee Web Gateway denial of service attack due to Improper Input ValidationEPSS 2.3%CVE-2018-6677HIGHMcAfee Web Gateway (MWG) - Directory Traversal vulnerabilityEPSS 2.1%CVE-2017-4052—Authentication Bypass vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthentEPSS 2.1%CVE-2019-3638HIGHWeb Gateway (MWG) - Reflected Cross Site Scripting vulnerabilityEPSS 1.9%CVE-2018-6660MEDIUMSB10228 ePO Directory Traversal vulnerabilityEPSS 1.7%CVE-2017-3907MEDIUMMcAfee Threat Intelligence Exchange (TIE) Server - Code Injection vulnerabilityEPSS 1.6%CVE-2017-3972HIGHSB10192 - Network Security Management (NSM) - Infrastructure-based foot printing vulnerabilityEPSS 1.5%CVE-2017-3968HIGHMcAfee Network Security Management (NSM) and Network Data Loss Prevention (NDLP)- Password recovery exploitation vulnerabilityEPSS 1.5%CVE-2019-3662MEDIUMAdvanced Threat Defense (ATD) - Path Traversal: '/absolute/pathname/here' vulnerabilityEPSS 1.4%CVE-2017-3936MEDIUMMcAfee ePolicy Orchestrator (ePO) - OS Command Injection vulnerabilityEPSS 1.4%CVE-2019-3587HIGHDLL Search Order Hijacking vulnerabilityEPSS 1.4%CVE-2017-4012—Privilege Escalation vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to viEPSS 1.3%