CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-7251 – ESConfig Tool able to edit configuration for newer version
https://notcve.org/view.php?id=CVE-2020-7251
14 Feb 2020 — Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS. Una vulnerabilidad de control de acceso inapropiada en Configuration Tool en Mcafee Endpoint Security (ENS) versiones anteriores a 10.6.1. La Actualización de febrero de 2020, permite a usuarios locales deshabilitar las características de seguridad, p... • https://kc.mcafee.com/corporate/index?page=content&id=SB10299 • CWE-358: Improperly Implemented Security Check for Standard CWE-863: Incorrect Authorization •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3653 – ESConfig Tool access not controlled
https://notcve.org/view.php?id=CVE-2019-3653
09 Oct 2019 — Improper access control vulnerability in Configuration tool in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to gain access to security configuration via unauthorized use of the configuration tool. Una vulnerabilidad de control de acceso inapropiada en la herramienta de Configuración en McAfee Endpoint Security (ENS) versiones anteriores a 10.6.1 Update de octubre 2019, permite al usuario local conseguir acceso a la configuración de seguridad mediante el uso no autoriz... • https://kc.mcafee.com/corporate/index?page=content&id=SB10299 • CWE-284: Improper Access Control •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2019-3652 – ENS code injection in EPSetup.exe
https://notcve.org/view.php?id=CVE-2019-3652
09 Oct 2019 — Code Injection vulnerability in EPSetup.exe in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to get their malicious code installed by the ENS installer via code injection into EPSetup.exe by an attacker with access to the installer. Una vulnerabilidad de inyección de código en el archivo EPSetup.exe en McAfee Endpoint Security (ENS) versiones anteriores a 10.6.1 Update de octubre 2019, permite al usuario local obtener su código malicioso instalado mediante el instalado... • https://kc.mcafee.com/corporate/index?page=content&id=SB10299 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-3586 – McAfee Endpoint Security firewall not always acting on GTI lookup results
https://notcve.org/view.php?id=CVE-2019-3586
15 May 2019 — Protection Mechanism Failure in the Firewall in McAfee Endpoint Security (ENS) 10.x prior to 10.6.1 May 2019 update allows context-dependent attackers to circumvent ENS protection where GTI flagged IP addresses are not blocked by the ENS Firewall via specially crafted malicious sites where the GTI reputation is carefully manipulated and does not correctly trigger the ENS Firewall to block the connection. Una falla del mecanismo de protección en el Firewall en McAfee Endpoint Security (ENS) 10.x anterior a 1... • http://www.securityfocus.com/bid/108416 • CWE-693: Protection Mechanism Failure •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2019-3582 – McAfee Endpoint Security updates fix a privilege escalation vulnerability
https://notcve.org/view.php?id=CVE-2019-3582
28 Feb 2019 — Privilege Escalation vulnerability in Microsoft Windows client in McAfee Endpoint Security (ENS) 10.6.1 and earlier allows local users to gain elevated privileges via a specific set of circumstances. Una vulnerabilidad de escalado de privilegios en el cliente de Microsoft Windows en McAfee Endpoint Security (ENS), en versiones 10.6.1 y anteriores, permite a los usuarios locales ganar privilegios elevados gracias a unas circunstancias específicas. • https://kc.mcafee.com/corporate/index?page=content&id=SB10254 •
CVSS: 5.6EPSS: 0%CPEs: 4EXPL: 0CVE-2018-6693 – Endpoint Security for Linux Threat Prevention (ENSLTP) privilege escalation vulnerability
https://notcve.org/view.php?id=CVE-2018-6693
18 Sep 2018 — An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escalation to delete arbitrary files. Un usuario sin privilegios puede eliminar archivos arbitrarios en un sistema Linux que ejecuta ENSLTP 10.5.1, 10.5.0 y 10.2.3 Hotfix 1246778 y anteriores. Mediante la explotación ... • https://kc.mcafee.com/corporate/index?page=content&id=SB10248 • CWE-274: Improper Handling of Insufficient Privileges CWE-363: Race Condition Enabling Link Following CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 5.0EPSS: 0%CPEs: 17EXPL: 0CVE-2017-4028 – SB10193 - consumer and corporate products - Maliciously misconfigured registry vulnerability
https://notcve.org/view.php?id=CVE-2017-4028
03 Apr 2018 — Maliciously misconfigured registry vulnerability in all Microsoft Windows products in McAfee consumer and corporate products allows an administrator to inject arbitrary code into a debugged McAfee process via manipulation of registry parameters. Vulnerabilidad de registro maliciosamente configurado en todos los productos Microsoft Windows en productos para consumidores y empresas de McAfee permite que un administrador inyecte código arbitrario en un proceso McAffee depurado mediante la manipulación de parám... • http://www.securityfocus.com/bid/97958 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-8010
https://notcve.org/view.php?id=CVE-2016-8010
14 Mar 2017 — Application protections bypass vulnerability in Intel Security McAfee Application Control (MAC) 7.0 and earlier and Endpoint Security (ENS) 10.2 and earlier allows local users to bypass local security protection via a command-line utility. Vulnerabilidad de elusión de protecciones de aplicaciones en Intel Security McAfee Application Control (MAC) 7.0 y versiones anteriores y Endpoint Security (ENS) 10.2 y versiones anteriores permite a usuarios locales eludir la protección de seguridad local a través de una... • http://www.securityfocus.com/bid/94661 • CWE-284: Improper Access Control •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-8011
https://notcve.org/view.php?id=CVE-2016-8011
14 Mar 2017 — Cross-site scripting vulnerability in Intel Security McAfee Endpoint Security (ENS) Web Control before 10.2.0.408.10 allows attackers to inject arbitrary web script or HTML via a crafted web site. Vulnerabilidad de secuencias de comandos en sitios cruzados en Intel Security McAfee Endpoint Security (ENS) Web Control en versiones anteriores a 10.2.0.408.10 permite a atacantes inyectar secuencias de comandos web o HTML arbitrarios a través de un sitio web manipulado. • https://kc.mcafee.com/corporate/index?page=content&id=SB10180 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.1EPSS: 0%CPEs: 8EXPL: 2CVE-2016-3984 – McAfee VirusScan Enterprise 8.8 - Security Restrictions Bypass
https://notcve.org/view.php?id=CVE-2016-3984
08 Apr 2016 — The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exchange Layer 2.x (DXL) before 2.0.1.140.1, Data Loss Prevention Endpoint (DLPe) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Device Control (MDC) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Endpoint Security (ENS) 10.x before 10.1, Host Intrusion Prevention Service (IPS) 8.0 before 8.0.0.3624, and VirusScan Enterprise (VSE) 8.8 before P7 (8.8.0.152... • https://www.exploit-db.com/exploits/39531 • CWE-284: Improper Access Control •