CVSS: 6.3EPSS: 0%CPEs: 11EXPL: 0CVE-2021-23888 – McAfee ePO unvalidated URL redirect vulnerability
https://notcve.org/view.php?id=CVE-2021-23888
Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 could cause an authenticated ePO user to load an untrusted site in an ePO iframe which could steal information from the authenticated user. Una vulnerabilidad de redireccionamiento de la URL del lado del cliente no comprobada en McAfee ePolicy Orchestrator (ePO) versiones anteriores a 5.10 Update 10, podría causar a un usuario de ePO autenticado cargar un sitio no confiable en un iframe de ePO que podría robar información del usuario autenticado. • https://kc.mcafee.com/corporate/index?page=content&id=SB10352 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 4.8EPSS: 0%CPEs: 11EXPL: 0CVE-2021-23889 – McAfee ePO Cross-site Scripting vulnerability
https://notcve.org/view.php?id=CVE-2021-23889
Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized. Una vulnerabilidad de tipo Cross-Site Scripting en McAfee ePolicy Orchestrator (ePO) versiones anteriores a 5.10 Update 10, permite a administradores de ePO inyectar script web o HTML arbitrario por medio de múltiples parámetros donde las entradas del administrador no son saneadas correctamente. • https://kc.mcafee.com/corporate/index?page=content&id=SB10352 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 67EXPL: 0CVE-2021-23840 – Integer overflow in CipherUpdate
https://notcve.org/view.php?id=CVE-2021-23840
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. • https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1 https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2 https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846 https://kc.mcafee.com/corporate/index?page=content&id=SB10366 https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E https:/ • CWE-190: Integer Overflow or Wraparound •
CVSS: 4.6EPSS: 0%CPEs: 2EXPL: 0CVE-2020-7317 – ePolicy Orchistrator (ePO) - Cross-Site Scripting vulnerability
https://notcve.org/view.php?id=CVE-2020-7317
Cross-Site Scripting vulnerability in McAfee ePolicy Orchistrator (ePO) prior to 5.10.9 Update 9 allows administrators to inject arbitrary web script or HTML via parameter values for "syncPointList" not being correctly sanitsed. Una vulnerabilidad de tipo Cross-Site Scripting en McAfee ePolicy Orchistrator (ePO) versiones anteriores a 5.10.9 Update 9, permite a administradores inyectar script web o HTML arbitrario por medio de valores de parámetros para "syncPointList" no ha sido saneado correctamente • https://kc.mcafee.com/corporate/index?page=content&id=SB10332 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-6672 – SB10240 - ePolicy Orchestrator (ePO) - Information disclosure vulnerablity
https://notcve.org/view.php?id=CVE-2018-6672
Information disclosure vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows authenticated users to view sensitive information in plain text format via unspecified vectors. Vulnerabilidad de divulgación de información en McAfee ePolicy Orchestrator (ePO) desde la versión 5.3.0 hasta la 5.3.3 y de la versión 5.9.0 a la 5.9.1 permite que usuarios autenticados vean información sensible en formato de texto plano mediante vectores sin especificar. • http://www.securityfocus.com/bid/104485 http://www.securitytracker.com/id/1041155 https://kc.mcafee.com/corporate/index?page=content&id=SB10240 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •