CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-2330 – XXE vulnerability in DLP Endpoint for Windows
https://notcve.org/view.php?id=CVE-2022-2330
30 Aug 2022 — Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 allows a remote attacker to cause the DLP Agent to access a local service that the attacker wouldn't usually have access to via a carefully constructed XML file, which the DLP Agent doesn't parse correctly. La vulnerabilidad de restricción inadecuada de la referencia a entidades externas XML en DLP Endpoint para Windows anterior a la versión 11.9.100 permite a un atacante remoto hacer que el age... • https://kcm.trellix.com/corporate/index?page=content&id=SB10386 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 8.4EPSS: 0%CPEs: 2EXPL: 0CVE-2021-31848 – Data Loss Prevention (DLP) ePO extension - Cross site scripting (XSS)
https://notcve.org/view.php?id=CVE-2021-31848
01 Nov 2021 — Cross site scripting (XSS) vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.7.100 allows a remote attacker to highjack an active DLP ePO administrator session by convincing the logged in administrator to click on a carefully crafted link in the case management part of the DLP ePO extension. Una vulnerabilidad de tipo cross site scripting (XSS) en la extensión de McAfee Data Loss Prevention (DLP) ePO versiones anteriores a 11.7.100, permite a un atacante remoto secuestrar una sesi... • https://kc.mcafee.com/corporate/index?page=content&id=SB10371 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.4EPSS: 0%CPEs: 2EXPL: 0CVE-2021-31849 – Data Loss Prevention (DLP) ePO extension - SQL injection
https://notcve.org/view.php?id=CVE-2021-31849
01 Nov 2021 — SQL injection vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.7.100 allows a remote attacker logged into ePO as an administrator to inject arbitrary SQL into the ePO database through the user management section of the DLP ePO extension. Una vulnerabilidad de inyección SQL en la extensión de McAfee Data Loss Prevention (DLP) ePO versiones anteriores a 11.7.100, permite a un atacante remoto que haya iniciado sesión en ePO como administrador inyectar SQL arbitrario en la base de da... • https://kc.mcafee.com/corporate/index?page=content&id=SB10371 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •