CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2017-3971 – SB10192 - Network Security Management (NSM) - Cryptanalysis vulnerability
https://notcve.org/view.php?id=CVE-2017-3971
Cryptanalysis vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to view confidential information via insecure use of RC4 encryption cyphers. Vulnerabilidad de criptoanálisis en la interfaz web en McAfee Network Security Management (NSM), en versiones anteriores a la 8.2.7.42.2, permite que atacantes vean información confidencial mediante el uso inseguro de un cypher de cifrado RC4. • https://kc.mcafee.com/corporate/index?page=content&id=SB10192 • CWE-326: Inadequate Encryption Strength •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-3965 – SB10192 - Network Security Management (NSM) - Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerability
https://notcve.org/view.php?id=CVE-2017-3965
Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to perform unauthorized tasks such as retrieving internal system information or manipulating the database via specially crafted URLs. Vulnerabilidad de Cross-Site Request Forgery (CSRF), también conocido como Session Riding, en la interfaz web de Session Riding en McAfee Network Security Management (NSM), en versiones anteriores a la 8.2.7.42.2, permite que atacantes remotos realicen tareas no autorizadas como la recuperación de información interna del sistema o la manipulación de la base de datos mediante URL especialmente manipuladas. • https://kc.mcafee.com/corporate/index?page=content&id=SB10192 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-3967 – SB10192 - Network Security Management (NSM) - Target influence via framing vulnerability
https://notcve.org/view.php?id=CVE-2017-3967
Target influence via framing vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to inject arbitrary web script or HTML via application pages inability to break out of 3rd party HTML frames. Vulnerabilidad de influencia de objetivo mediante framing en la interfaz web en McAfee Network Security Management (NSM), en versiones anteriores a la 8.2.7.42.2, permite que atacantes remotos inyecten scripts web o HTML arbitrarios aprovechándose de la incapacidad de las páginas de aplicación de liberarse de los frames HTML de terceros. • https://kc.mcafee.com/corporate/index?page=content&id=SB10192 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2017-3969 – SB10192 - Network Security Management (NSM) - Abuse of communication channels vulnerability
https://notcve.org/view.php?id=CVE-2017-3969
Abuse of communication channels vulnerability in the server in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows man-in-the-middle attackers to decrypt messages via an inadequate implementation of SSL. Vulnerabilidad de abuso de canales de comunicación en el servidor en McAfee Network Security Management (NSM), en versiones anteriores a la 8.2.7.42.2, permite que atacantes Man-in-the-Middle (MitM) descifren mensajes mediante la implementación inadecuada de SSL. • https://kc.mcafee.com/corporate/index?page=content&id=SB10192 • CWE-417: Communication Channel Errors •
CVSS: 5.0EPSS: 0%CPEs: 17EXPL: 0CVE-2017-4028 – SB10193 - consumer and corporate products - Maliciously misconfigured registry vulnerability
https://notcve.org/view.php?id=CVE-2017-4028
Maliciously misconfigured registry vulnerability in all Microsoft Windows products in McAfee consumer and corporate products allows an administrator to inject arbitrary code into a debugged McAfee process via manipulation of registry parameters. Vulnerabilidad de registro maliciosamente configurado en todos los productos Microsoft Windows en productos para consumidores y empresas de McAfee permite que un administrador inyecte código arbitrario en un proceso McAffee depurado mediante la manipulación de parámetros de registro. • http://www.securityfocus.com/bid/97958 https://kc.mcafee.com/corporate/index?page=content&id=SB10193 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •