Epolicy Orchestrator (Mcafee) - vulnerabilities (CVEs)

86 CVEs, 0 in the last 30 days, 61 known versions, newest CVE from 2023-11-17. Vendor: Mcafee.

CVEs of Epolicy Orchestrator

CVE-2023-5445 - CVSS 5.4 (medium), 2023-11-17: An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL parameter for the…
CVE-2023-5444 - CVSS 8 (high), 2023-11-17: A Cross Site Request Forgery vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2 allows a remote low privilege user to successfully add a new…
CVE-2023-3946 - CVSS 6.1 (medium), 2023-07-26: A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to…
CVE-2022-3339 - CVSS 6.1 (medium), 2022-10-18: A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 Update 14 allows a remote unauthenticated attacker to potentially obtain access to…
CVE-2022-3338 - CVSS 5.4 (medium), 2022-10-18: An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side…
CVE-2022-0859 - CVSS 6.7 (medium), 2022-03-23: McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the…
CVE-2022-0858 - CVSS 4.7 (medium), 2022-03-23: A cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially…
CVE-2022-0862 - CVSS 5.3 (medium), 2022-03-23: A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a…
CVE-2022-0857 - CVSS 6.1 (medium), 2022-03-23: A reflected cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to…
CVE-2022-0861 - CVSS 3.8 (low), 2022-03-23: A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a…
CVE-2022-0842 - CVSS 5.4 (medium), 2022-03-23: A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote authenticated attacker to…
CVE-2021-31835 - CVSS 4.8 (medium), 2021-10-22: Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script or…
CVE-2021-31834 - CVSS 5.4 (medium), 2021-10-22: Stored Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web…
CVE-2021-3712 - CVSS 7.4 (high), 2021-08-24: ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the…
CVE-2021-2432 - CVSS 3.7 (low), 2021-07-21: Vulnerability in the Java SE product of Oracle Java SE (component: JNDI). The supported version that is affected is Java SE: 7u301. Difficult to exploit…
CVE-2021-30639 - CVSS 7.5 (high), 2021-07-12: A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling…
CVE-2021-33037 - CVSS 5.3 (medium), 2021-07-12: Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some…
CVE-2020-13938 - CVSS 5.5 (medium), 2021-06-10: Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows
CVE-2021-2161 - CVSS 5.9 (medium), 2021-04-22: Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that…
CVE-2021-23890 - CVSS 6.5 (medium), 2021-03-26: Information leak vulnerability in the Agent Handler of McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows an unauthenticated user to download…
CVE-2021-23889 - CVSS 4.8 (medium), 2021-03-26: Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows ePO administrators to inject arbitrary web script or…
CVE-2021-23888 - CVSS 6.3 (medium), 2021-03-26: Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 could cause an authenticated ePO user to load…
CVE-2021-23840 - CVSS 7.5 (high), 2021-02-16: Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to…
CVE-2020-14792 - CVSS 4.2 (medium), 2020-10-21: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Java SE: 7u271, 8u261,…
CVE-2020-14782 - CVSS 3.7 (low), 2020-10-21: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u271,…
CVE-2020-7317 - CVSS 4.6 (medium), 2020-10-14: Cross-Site Scripting vulnerability in McAfee ePolicy Orchistrator (ePO) prior to 5.10.9 Update 9 allows administrators to inject arbitrary web script or HTML…
CVE-2020-7318 - CVSS 4.6 (medium), 2020-10-14: Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10.9 Update 9 allows administrators to inject arbitrary web script or HTML…
CVE-2020-14621 - CVSS 5.3 (medium), 2020-07-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP). Supported versions that are affected are Java SE: 7u261, 8u251,…
CVE-2020-14581 - CVSS 3.7 (low), 2020-07-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: 2D). Supported versions that are affected are Java SE: 8u251, 11.0.7 and…
CVE-2020-14579 - CVSS 3.7 (low), 2020-07-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and…
CVE-2020-14578 - CVSS 3.7 (low), 2020-07-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u261 and…
CVE-2020-13935 - CVSS 7.5 (high), 2020-07-14: The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to…
CVE-2020-9484 - CVSS 7 (high), 2020-05-20: When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the…
CVE-2020-2773 - CVSS 3.7 (low), 2020-04-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u251,…
CVE-2020-2756 - CVSS 3.7 (low), 2020-04-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251,…
CVE-2020-2755 - CVSS 3.7 (low), 2020-04-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241,…
CVE-2020-2754 - CVSS 3.7 (low), 2020-04-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u241,…
CVE-2020-2757 - CVSS 3.7 (low), 2020-04-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u251,…
CVE-2020-2654 - CVSS 3.7 (low), 2020-01-15: Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and…
CVE-2020-2604 - CVSS 8.1 (high), 2020-01-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241,…
CVE-2020-2583 - CVSS 3.7 (low), 2020-01-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241,…
CVE-2020-2593 - CVSS 4.8 (medium), 2020-01-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241,…
CVE-2020-2590 - CVSS 3.7 (low), 2020-01-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241,…
CVE-2019-2975 - CVSS 4.8 (medium), 2019-10-16: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that are affected are Java SE: 8u221,…
CVE-2019-2949 - CVSS 6.8 (medium), 2019-10-16: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Kerberos). Supported versions that are affected are Java SE: 7u231,…
CVE-2019-2933 - CVSS 3.1 (low), 2019-10-16: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u231,…
CVE-2019-2894 - CVSS 3.7 (low), 2019-10-16: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u231,…
CVE-2019-2842 - CVSS 3.7 (low), 2019-07-23: Vulnerability in the Java SE component of Oracle Java SE (subcomponent: JCE). The supported version that is affected is Java SE: 8u212. Difficult to exploit…
CVE-2019-2816 - CVSS 4.8 (medium), 2019-07-23: Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE:…
CVE-2019-2769 - CVSS 5.3 (medium), 2019-07-23: Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221,…
CVE-2019-2766 - CVSS 3.1 (low), 2019-07-23: Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE:…
CVE-2019-2762 - CVSS 5.3 (medium), 2019-07-23: Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221,…
CVE-2019-2745 - CVSS 5.1 (medium), 2019-07-23: Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 7u221, 8u212 and 11.0.3.…
CVE-2019-3619 - CVSS 6.8 (medium), 2019-07-03: Information Disclosure vulnerability in the Agent Handler in McAfee ePolicy Orchestrator (ePO) 5.9.x and 5.10.0 prior to 5.10.0 update 4 allows remote…
CVE-2019-2602 - CVSS 7.5 (high), 2019-04-23: Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u211,…
CVE-2019-3604 - CVSS 8.8 (high), 2019-02-01: Cross-Site Request Forgery (CSRF) vulnerability in McAfee ePO (legacy) Cloud allows unauthenticated users to perform unintended ePO actions using an…
CVE-2018-6672 - CVSS 6.5 (medium), 2018-06-15: Information disclosure vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows authenticated users to view…
CVE-2018-6671 - CVSS 6.5 (medium), 2018-06-15: Application Protection Bypass vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows remote authenticated users…
CVE-2017-3936 - CVSS 9.8 (critical), 2018-06-13: OS Command Injection vulnerability in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary…
CVE-2018-6659 - CVSS 5.4 (medium), 2018-04-02: Reflected Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows remote authenticated users to exploit…
CVE-2018-6660 - CVSS 6.2 (medium), 2018-04-02: Directory Traversal vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows administrators to use Windows alternate data…
CVE-2017-3980 - CVSS 7.2 (high), 2017-05-18: A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, and 5.1.3 and earlier allows remote authenticated…
CVE-2016-8027 - CVSS 10 (critical), 2017-03-14: SQL injection vulnerability in core services in Intel Security McAfee ePolicy Orchestrator (ePO) 5.3.2 and earlier and 5.1.3 and earlier allows attackers to…
CVE-2017-3902 - CVSS 5.4 (medium), 2017-02-13: Cross-site scripting (XSS) vulnerability in the Web user interface (UI) in Intel Security ePO 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows authenticated users to…
CVE-2015-8765 - CVSS 8.3 (high), 2016-01-08: Intel McAfee ePolicy Orchestrator (ePO) 4.6.9 and earlier, 5.0.x, 5.1.x before 5.1.3 Hotfix 1106041, and 5.3.x before 5.3.1 Hotfix 1106041 allow remote…
CVE-2015-2859 - CVSS 5.8 (medium), 2015-06-23: Intel McAfee ePolicy Orchestrator (ePO) 4.x through 4.6.9 and 5.x through 5.1.2 does not validate server names and Certification Authority names in X.509…
CVE-2015-4559 - CVSS 4.3 (medium), 2015-06-15: Cross-site scripting (XSS) vulnerability in the product deployment feature in the Java core web services in Intel McAfee ePolicy Orchestrator (ePO) before…
CVE-2015-0922 - CVSS 5 (medium), 2015-01-09: McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers…
CVE-2015-0921 - CVSS 4 (medium), 2015-01-09: XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote…
CVE-2014-2205 - CVSS 6.3 (medium), 2014-02-26: The Import and Export Framework in McAfee ePolicy Orchestrator (ePO) before 4.6.7 Hotfix 940148 allows remote authenticated users with permissions to add…
CVE-2013-4882 - CVSS 6.5 (medium), 2013-07-22: Multiple SQL injection vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePolicy Orchestrator (ePO) extension for McAfee Agent (MA)…
CVE-2013-4883 - CVSS 4.3 (medium), 2013-07-22: Multiple cross-site scripting (XSS) vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePO Extension for the McAfee Agent (MA) 4.5…
CVE-2013-0141 - CVSS 4.3 (medium), 2013-05-01: Directory traversal vulnerability in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to upload arbitrary files…
CVE-2013-0140 - CVSS 7.9 (high), 2013-05-01: SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to…
CVE-2012-4594 - CVSS 4 (medium), 2012-08-22: McAfee ePolicy Orchestrator (ePO) 4.6.1 and earlier allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information…
CVE-2008-1357 - CVSS 5.4 (medium), 2008-03-17: Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in…
CVE-2006-5274 - CVSS 7.6 (high), 2007-07-12: Integer overflow in McAfee ePolicy Orchestrator 3.5 through 3.6.1, ProtectionPilot 1.1.1 and 1.5, and Common Management Agent (CMA) 3.5.5.438 allows remote…
CVE-2007-1498 - CVSS 9.3 (critical), 2007-03-16: Multiple stack-based buffer overflows in the SiteManager.SiteMgr.1 ActiveX control (SiteManager.dll) in the ePO management console in McAfee ePolicy…
CVE-2006-5156 - CVSS 10 (critical), 2006-10-05: Buffer overflow in McAfee ePolicy Orchestrator before 3.5.0.720 and ProtectionPilot before 1.1.1.126 allows remote attackers to execute arbitrary code via a…
CVE-2004-0038 - CVSS 7.5 (high), 2004-06-14: McAfee ePolicy Orchestrator (ePO) 2.5.1 Patch 13 and 3.0 SP2a Patch 3 allows remote attackers to execute arbitrary commands via certain HTTP POST requests to…
CVE-2004-0095 - CVSS 5 (medium), 2004-02-17: McAfee ePolicy Orchestrator agent allows remote attackers to cause a denial of service (memory consumption and crash) and possibly execute arbitrary code via…
CVE-2003-0149 - CVSS 7.5 (high), 2003-08-27: Heap-based buffer overflow in ePO agent for McAfee ePolicy Orchestrator 2.0, 2.5, and 2.5.1 allows remote attackers to execute arbitrary code via a POST…
CVE-2003-0148 - CVSS 7.2 (high), 2003-08-27: The default installation of MSDE via McAfee ePolicy Orchestrator 2.0 through 3.0 allows attackers to execute arbitrary code via a series of steps that (1)…
CVE-2003-0616 - CVSS 7.5 (high), 2003-08-27: Format string vulnerability in ePO service for McAfee ePolicy Orchestrator 2.0, 2.5, and 2.5.1 allows remote attackers to execute arbitrary code via a POST…
CVE-2003-0610 - CVSS 5 (medium), 2003-08-27: Directory traversal vulnerability in ePO agent for McAfee ePolicy Orchestrator 3.0 allows remote attackers to read arbitrary files via a certain HTTP request.
CVE-2002-0690 - CVSS 10 (critical), 2003-04-11: Format string vulnerability in McAfee Security ePolicy Orchestrator (ePO) 2.5.1 allows remote attackers to execute arbitrary code via an HTTP GET request with…