CVSS: 9.8EPSS: 0%CPEs: 21EXPL: 2CVE-2013-0140 – McAfee ePolicy Orchestrator 4.6.0 < 4.6.5 - 'ePowner' Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-0140
01 May 2013 — SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel. Vulnerabilidad de inyección SQL en el componente Agent-Handler de McAfee ePolicy Orchestrator (ePO) anterior a v4.5.7 y v4.6.x anterior a v4.6.6 permite a atacantes remotos ejecutar comandos SQL de su elección a través una petición manipulada sobre el can... • https://packetstorm.news/files/id/126364 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.1EPSS: 0%CPEs: 21EXPL: 1CVE-2013-0141 – McAfee ePolicy Owner (ePowner) 0.1
https://notcve.org/view.php?id=CVE-2013-0141
01 May 2013 — Directory traversal vulnerability in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to upload arbitrary files via a crafted request over the Agent-Server communication channel, as demonstrated by writing to the Software/ directory. Vulnerabilidad de salto de directorio en McAfee ePolicy Orchestrator (ePO) anterior a 4.5.7 y 4.6.x anterior a 4.6.6, permite a atacantes remotos la subida arbitraria de archivos a través de una petición manipulada sobre el canal de ... • https://packetstorm.news/files/id/126364 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2012-4594
https://notcve.org/view.php?id=CVE-2012-4594
22 Aug 2012 — McAfee ePolicy Orchestrator (ePO) 4.6.1 and earlier allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information from arbitrary reporting panels, via a modified ID value in a console URL. McAfee ePolicy Orchestrator (ePO) v4.6.1 y anteriores permite a los usuarios autentificados remotos a evitar las restricciones de acceso establecidas, y obtener información sensible de paneles de información, a través de valores ID modificados en una consola URL. • https://exchange.xforce.ibmcloud.com/vulnerabilities/78132 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.4EPSS: 78%CPEs: 9EXPL: 3CVE-2008-1357 – McAfee Framework ePolicy 3.x - Orchestrator '_naimcomn_Log' Remote Format String
https://notcve.org/view.php?id=CVE-2008-1357
17 Mar 2008 — Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082. NOTE: this issue only exists when the debug level is 8. Vulnerabilidad en el formato de cadena en la función logDetail de applib.dlld en McAfee... • https://www.exploit-db.com/exploits/31399 • CWE-134: Use of Externally-Controlled Format String •
CVSS: 9.8EPSS: 3%CPEs: 6EXPL: 0CVE-2006-5274
https://notcve.org/view.php?id=CVE-2006-5274
12 Jul 2007 — Integer overflow in McAfee ePolicy Orchestrator 3.5 through 3.6.1, ProtectionPilot 1.1.1 and 1.5, and Common Management Agent (CMA) 3.5.5.438 allows remote attackers to cause a denial of service (CMA Framework service crash) and possibly execute arbitrary code via unspecified vectors. Desbordamiento de entero en McAfee ePolicy Orchestrator 3.5 hasta 3.6.1, ProtectionPilot 1.1.1 y 1.5, y Common Management Agent (CMA) 3.5.5.438 permite a atacantes remotos provocar una denegación de servicio (caída del servici... • http://secunia.com/advisories/26029 •
CVSS: 9.8EPSS: 83%CPEs: 5EXPL: 0CVE-2007-1498
https://notcve.org/view.php?id=CVE-2007-1498
16 Mar 2007 — Multiple stack-based buffer overflows in the SiteManager.SiteMgr.1 ActiveX control (SiteManager.dll) in the ePO management console in McAfee ePolicy Orchestrator (ePO) before 3.6.1 Patch 1 and ProtectionPilot (PRP) before 1.5.0 HotFix allow remote attackers to execute arbitrary code via a long argument to the (1) ExportSiteList and (2) VerifyPackageCatalog functions, and (3) unspecified vectors involving a swprintf function call. Múltiples desbordamientos de búfer basados en pila en el control ActiveX Site ... • http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/052960.html •
CVSS: 10.0EPSS: 96%CPEs: 4EXPL: 4CVE-2006-5156 – McAfee ePo 3.5.0 / ProtectionPilot 1.1.0 - Source Remote
https://notcve.org/view.php?id=CVE-2006-5156
03 Oct 2006 — Buffer overflow in McAfee ePolicy Orchestrator before 3.5.0.720 and ProtectionPilot before 1.1.1.126 allows remote attackers to execute arbitrary code via a request to /spipe/pkg/ with a long source header. Desbordamiento de búfer en McAfee ePolicy Orchestrator anterior a 3.5.0.720 y ProtectionPilot anterior a 1.1.1.126 permite a atacantes remotos ejecutar código de su elección mediante una petición a /spipe/pkg/ con una cabecera fuente larga. • https://www.exploit-db.com/exploits/2467 •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2004-0038
https://notcve.org/view.php?id=CVE-2004-0038
30 Apr 2004 — McAfee ePolicy Orchestrator (ePO) 2.5.1 Patch 13 and 3.0 SP2a Patch 3 allows remote attackers to execute arbitrary commands via certain HTTP POST requests to the spipe/file handler on ePO TCP port 81. mcAfee ePolicy Orchestrator (ePO) 2.5.1 Patch 13 y 3.0 SP2a Patch 3 permite a atacantes remotos ejecutar órdenes arbitrarias mediante ciertas peticiones HTTP POST al manejador "spipe/file" de ePO en el puerto TCP 81. • http://download.nai.com/products/patches/ePO/v2.x/Patch14.txt •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 2CVE-2004-0095 – McAfee ePolicy Orchestrator 1.x/2.x/3.0 Agent - POST Buffer Mismanagement
https://notcve.org/view.php?id=CVE-2004-0095
17 Feb 2004 — McAfee ePolicy Orchestrator agent allows remote attackers to cause a denial of service (memory consumption and crash) and possibly execute arbitrary code via an HTTP POST request with an invalid Content-Length value, possibly triggering a buffer overflow. El agente de McAfee ePolicy Orchestrator permite a atacantes remotos causar una denegación de servicio (consumición de memoria y caída) y posiblemente ejecutar código arbitrario mediane una petícón HTTP POST con un valor Content-Length no válido, posibleme... • https://www.exploit-db.com/exploits/23584 •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2003-0148
https://notcve.org/view.php?id=CVE-2003-0148
01 Aug 2003 — The default installation of MSDE via McAfee ePolicy Orchestrator 2.0 through 3.0 allows attackers to execute arbitrary code via a series of steps that (1) obtain the database administrator username and encrypted password in a configuration file from the ePO server using a certain request, (2) crack the password due to weak cryptography, and (3) use the password to pass commands through xp_cmdshell. La instalación por defecto de MSDE mediante McAfee ePolicy Orchestrator 2.0 a 3.0 permite a atacantes ejecutar... • http://www.atstake.com/research/advisories/2003/a073103-1.txt •