CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-8012
https://notcve.org/view.php?id=CVE-2016-8012
Access control vulnerability in Intel Security Data Loss Prevention Endpoint (DLPe) 9.4.200 and 9.3.600 allows authenticated users with Read-Write-Execute permissions to inject hook DLLs into other processes via pages in the target process memory get. Vulnerabilidad de control de acceso en Intel Security Data Loss Prevention Endpoint (DLPe) 9.4.200 y 9.3.600 permite a usuarios autenticados con permisos de lectura-escritura-ejecución inyectar DLLs de gancho en otros procesos a través de páginas en la memoria de proceso de destino. • https://kc.mcafee.com/corporate/index?page=content&id=SB10185 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.1EPSS: 0%CPEs: 8EXPL: 2CVE-2016-3984 – McAfee VirusScan Enterprise 8.8 - Security Restrictions Bypass
https://notcve.org/view.php?id=CVE-2016-3984
The McAfee VirusScan Console (mcconsol.exe) in McAfee Active Response (MAR) before 1.1.0.161, Agent (MA) 5.x before 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exchange Layer 2.x (DXL) before 2.0.1.140.1, Data Loss Prevention Endpoint (DLPe) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Device Control (MDC) 9.3 before Patch 6 and 9.4 before Patch 1 HF3, Endpoint Security (ENS) 10.x before 10.1, Host Intrusion Prevention Service (IPS) 8.0 before 8.0.0.3624, and VirusScan Enterprise (VSE) 8.8 before P7 (8.8.0.1528) on Windows allows local administrators to bypass intended self-protection rules and disable the antivirus engine by modifying registry keys. El McAfee VirusScan Console (mcconsol.exe) en McAfee Active Response (MAR) en versiones anteriores a 1.1.0.161, Agent (MA) 5.x en versiones anteriores a 5.0.2 Hotfix 1110392 (5.0.2.333), Data Exchange Layer 2.x (DXL) en versiones anteriores a 2.0.1.140.1, Data Loss Prevention Endpoint (DLPe) 9.3 en versiones anteriores a Patch 6 y 9.4 en versiones anteriores a Patch 1 HF3, Device Control (MDC) 9.3 en versiones anteriores a Patch 6 y 9.4 en versiones anteriores a Patch 1 HF3, Endpoint Security (ENS) 10.x en versiones anteriores a 10.1, Host Intrusion Prevention Service (IPS) 8.0 en versiones anteriores a 8.0.0.3624 y VirusScan Enterprise (VSE) 8.8 en versiones anteriores a P7 (8.8.0.1528) en Windows permite a administradores locales eludir las reglas destinadas a la autoprotección y desactivar el motor del antivirus modificando claves de registro. • https://www.exploit-db.com/exploits/39531 http://lab.mediaservice.net/advisory/2016-01-mcafee.txt http://seclists.org/fulldisclosure/2016/Mar/13 http://www.securitytracker.com/id/1035130 https://kc.mcafee.com/corporate/index?page=content&id=SB10151 • CWE-284: Improper Access Control •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-2758
https://notcve.org/view.php?id=CVE-2015-2758
The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated users to obtain sensitive information, modify the database, or possibly have other unspecified impact via a crafted URL. La extensión ePO en McAfee Data Loss Prevention Endpoint (DLPe) anterior a 9.3 Patch 4 Hotfix 16 (9.3.416.4) permite a usuarios remotos autenticados obtener información sensible, modificar la base de datos o posiblemente tener otro impacto no especificados a través de una URL manipulada. • http://www.securityfocus.com/bid/73397 https://kc.mcafee.com/corporate/index?page=content&id=SB10111 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-2759
https://notcve.org/view.php?id=CVE-2015-2759
Multiple cross-site request forgery (CSRF) vulnerabilities in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allow remote attackers to hijack the authentication of users for requests that (1) obtain sensitive information or (2) modify the database via unspecified vectors. Múltiples vulnerabilidades de CSRF en la extensión ePO en McAfee Data Loss Prevention Endpoint (DLPe) anterior a 9.3 Patch 4 Hotfix 16 (9.3.416.4) permiten a atacantes remotos secuestrar la autenticación de usuarios para solicitudes que (1) obtienen información sensible o(2) modifican la base de datos a través de vectores no especificados. • http://www.securityfocus.com/bid/73403 https://kc.mcafee.com/corporate/index?page=content&id=SB10111 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.0EPSS: 0%CPEs: 1EXPL: 0CVE-2015-2757
https://notcve.org/view.php?id=CVE-2015-2757
The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated users to cause a denial of service (database lock or license corruption) via unspecified vectors. La extensión ePO en McAfee Data Loss Prevention Endpoint (DLPe) anterior a 9.3 Patch 4 Hotfix 16 (9.3.416.4) permite a usuarios remotos autenticados causar una denegación de servicio (cierre de la base de datos o corrupción de licencia) a través de vectores no especificados. • http://www.securityfocus.com/bid/73399 https://kc.mcafee.com/corporate/index?page=content&id=SB10111 • CWE-399: Resource Management Errors •