CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-3962 – McAfee Network Security Management (NSM) - Password recovery exploitation vulnerability
https://notcve.org/view.php?id=CVE-2017-3962
Password recovery exploitation vulnerability in the non-certificate-based authentication mechanism in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to crack user passwords via unsalted hashes. Vulnerabilidad de explotación de recuperación de contraseña en el mecanismo de autenticación sin estar basado en certificados en McAfee Network Security Management (NSM) en versiones anteriores a la 8.2.7.42.2 permite que atacantes descifren contraseñas de usuario mediante hashes sin sal. • https://kc.mcafee.com/corporate/index?page=content&id=SB10192 • CWE-916: Use of Password Hash With Insufficient Computational Effort •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-3960 – McAfee Network Security Management (NSM) - Exploitation of Authorization vulnerability
https://notcve.org/view.php?id=CVE-2017-3960
Exploitation of Authorization vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows authenticated users to gain elevated privileges via a crafted HTTP request parameter. Vulnerabilidad de explotación de autorización en la interfaz web en McAfee Network Security Management (NSM) en versiones anteriores a la 8.2.7.42.2 permite que usuarios autenticados obtengan privilegios elevados mediante un parámetro HTTP request manipulado. • https://kc.mcafee.com/corporate/index?page=content&id=SB10192 •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-3961 – SB10192 - Network Security Management (NSM) - Cross-Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2017-3961
Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via crafted user input of attributes. Vulnerabilidad de Cross-Site Scripting (XSS) en la interfaz web en McAfee Network Security Management (NSM) en versiones anteriores a la 8.2.7.42.2 permite que usuarios autenticados puedan reflejar código HTML arbitrario en la página web de respuesta mediante entradas de atributos de usuarios que hayan sido manipuladas. • https://kc.mcafee.com/corporate/index?page=content&id=SB10192 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-3964 – SB10192 - Network Security Management (NSM) - Reflective Cross-Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2017-3964
Reflective Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to inject arbitrary web script or HTML via a URL parameter. Vulnerabilidad de Cross-Site Scripting (XSS) reflejado en la interfaz web en McAfee Network Security Management (NSM), en versiones anteriores a la 8.2.7.42.2, permite que atacantes inyecten scripts web o HTML arbitrarios mediante un parámetro URL. • https://kc.mcafee.com/corporate/index?page=content&id=SB10192 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-3966 – SB10192 - Network Security Management (NSM) - Exploitation of session variables, resource IDs and other trusted credentials vulnerability
https://notcve.org/view.php?id=CVE-2017-3966
Exploitation of session variables, resource IDs and other trusted credentials vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to exploit or harm a user's browser via reusing the exposed session token in the application URL. Vulnerabilidad de explotación de variables de sesión, ID de los recursos y otras credenciales de confianza en la interfaz web en McAfee Network Security Management (NSM), en versiones anteriores a la 8.2.7.42.2, permite que atacantes remotos exploten o dañen el navegador de un usuario reutilizando el token de sesión expuesto en la URL de la aplicación. • https://kc.mcafee.com/corporate/index?page=content&id=SB10192 • CWE-613: Insufficient Session Expiration •