CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-2330 – XXE vulnerability in DLP Endpoint for Windows
https://notcve.org/view.php?id=CVE-2022-2330
30 Aug 2022 — Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 allows a remote attacker to cause the DLP Agent to access a local service that the attacker wouldn't usually have access to via a carefully constructed XML file, which the DLP Agent doesn't parse correctly. La vulnerabilidad de restricción inadecuada de la referencia a entidades externas XML en DLP Endpoint para Windows anterior a la versión 11.9.100 permite a un atacante remoto hacer que el age... • https://kcm.trellix.com/corporate/index?page=content&id=SB10386 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 8.2EPSS: 0%CPEs: 2EXPL: 0CVE-2021-31844 – Local Privilege Escalation in McAfee DLP Endpoint for Windows
https://notcve.org/view.php?id=CVE-2021-31844
17 Sep 2021 — A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a local attacker to execute arbitrary code with elevated privileges through placing carefully constructed Ami Pro (.sam) files onto the local system and triggering a DLP Endpoint scan through accessing a file. This is caused by the destination buffer being of fixed size and incorrect checks being made on the source size. Una vulnerabilidad de desbordamiento del búfer en McAfee Data Loss Prevent... • https://kc.mcafee.com/corporate/index?page=content&id=SB10368 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23887 – Privilege escalation in McAfee DLP Endpoint for Windows
https://notcve.org/view.php?id=CVE-2021-23887
15 Apr 2021 — Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to write to arbitrary controlled kernel addresses. This is achieved by launching applications, suspending them, modifying the memory and restarting them when they are monitored by McAfee DLP through the hdlphook driver. Una vulnerabilidad de Escalada de Privilegios en McAfee Data Loss Prevention (DLP) Endpoint para Windows anterior a versión 11.6.100, permit... • https://kc.mcafee.com/corporate/index?page=content&id=SB10354 • CWE-269: Improper Privilege Management •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-23886 – Local Denial of Service in McAfee DLP Endpoint for Windows
https://notcve.org/view.php?id=CVE-2021-23886
15 Apr 2021 — Denial of Service vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to cause a BSoD through suspending a process, modifying the processes memory and restarting it. This is triggered by the hdlphook driver reading invalid memory. Una vulnerabilidad de Denegación de Servicio en McAfee Data Loss Prevention (DLP) Endpoint para Windows anterior a versión 11.6.100, permite a un atacante local, poco privilegiado, causar un BSoD al sus... • https://kc.mcafee.com/corporate/index?page=content&id=SB10354 • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-6689 – Data Loss Prevention Endpoint (DLPe) - Authentication Bypass vulnerability
https://notcve.org/view.php?id=CVE-2018-6689
03 Oct 2018 — Authentication Bypass vulnerability in McAfee Data Loss Prevention Endpoint (DLPe) 10.0.x earlier than 10.0.510, and 11.0.x earlier than 11.0.600 allows attackers to bypass local security protection via specific conditions. Vulnerabilidad de omisión de autenticación en McAfee Data Loss Prevention Endpoint (DLPe) en versiones 10.0.x anteriores a la 10.0.510 y versiones 11.0.x anteriores a la 11.0.600 permite que los atacantes omitan la protección local de seguridad mediante condiciones específicas. • http://www.securitytracker.com/id/1041908 • CWE-287: Improper Authentication •
CVSS: 7.4EPSS: 0%CPEs: 4EXPL: 0CVE-2018-6683 – - Data Loss Prevention (DLP) for Windows - Exploiting Incorrectly Configured Access Control Security Levels vulnerability
https://notcve.org/view.php?id=CVE-2018-6683
23 Jul 2018 — Exploiting Incorrectly Configured Access Control Security Levels vulnerability in McAfee Data Loss Prevention (DLP) for Windows versions prior to 10.0.505 and 11.0.405 allows local users to bypass DLP policy via editing of local policy files when offline. Vulnerabilidad de explotación de niveles de seguridad de control de acceso configurados incorrectamente en McAfee Data Loss Prevention (DLP) para Windows en versiones anteriores a la 10.0.505 y 11.0.405 permite que usuarios locales omitan la política DLP e... • https://kc.mcafee.com/corporate/index?page=content&id=SB10246 • CWE-276: Incorrect Default Permissions •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-6664 – SB10233 - Data Loss Prevention (DLP) Endpoint before 10.0.500 and DLP Endpoint before 11.0.400 - Application Protections Bypass vulnerability
https://notcve.org/view.php?id=CVE-2018-6664
25 May 2018 — Application Protections Bypass vulnerability in Microsoft Windows in McAfee Data Loss Prevention (DLP) Endpoint before 10.0.500 and DLP Endpoint before 11.0.400 allows authenticated users to bypass the product block action via a command-line utility. Vulnerabilidad de omisión de protecciones de aplicación en Microsoft Windows en McAfee Data Loss Prevention (DLP) Endpoint, en versiones anteriores a la 10.0.500, y DLP Endpoint en versiones anteriores a la 11.0.400 permite que usuarios autenticados omitan la a... • http://www.securityfocus.com/bid/104299 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2017-3948
https://notcve.org/view.php?id=CVE-2017-3948
23 Jun 2017 — Cross Site Scripting (XSS) in IMG Tags in the ePO extension in McAfee Data Loss Prevention Endpoint (DLP Endpoint) 10.0.x allows authenticated users to inject arbitrary web script or HTML via injecting malicious JavaScript into a user's browsing session. Cross Site Scripting (XSS) en IMG Tags en la extensión ePO en McAfee Data Loss Prevention Endpoint (DLP Endpoint) 10.0.x permite que usuarios autenticados inyecten scripts web o HTML arbitrarios mediante la inyección de código JavaScript malicioso en la ses... • https://kc.mcafee.com/corporate/index?page=content&id=SB10202 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •