Cross-site scripting in Intel McAfee Endpoint Security Web Control
Priority LOW 28CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
Cross-site scripting vulnerability in Intel Security McAfee Endpoint Security (ENS) Web Control before 10.2.0.408.10 allows attackers to inject arbitrary web script or HTML via a crafted web site.
Why it matters now
EPSS 0.00551 46th percentileScored 2026-11-07
Fix Fixed McAfee Endpoint Security (ENS) Web Control (Intel): 10.2.0.408.10
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Intel | McAfee Endpoint Security (ENS) Web Control | before 10.2.0.408.10 | 10.2.0.408.10 | Patch available | CNA |
- McAfee Endpoint Security (ENS) Web Control VendorIntel Affected before 10.2.0.408.10 Fixed in 10.2.0.408.10 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:intel_security_mcafee:endpoint_security_web_control:*:*:*:*:*:*:*:* | up to 10.2.0.408 | Vulnerable | Intel Security Mcafee |
- cpe:2.3:a:intel_security_mcafee:endpoint_security_web_control:*:*:*:*:*:*:*:* Versions up to 10.2.0.408 Vulnerable ·Intel Security Mcafee
Remediation
- Fix · CNA McAfee Endpoint Security (ENS) Web Control (Intel) Fixed in 10.2.0.408.10
Timeline
- 2026-10-02 Threatist record created from CVE-2016-8011
- 2026-10-03 Alias added: GHSA-g7xc-4c2r-qj7r
References
More Intel vulnerabilities
- TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
- TI-2017-03684 Improper privilege management in Intel Active Mangement Technology, Intel Small Business… KEVCVSS 3.1CRITICAL 9.8
- TI-2021-20393 Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack KEVCVSS 3.1CRITICAL 9.0
- TI-2015-02024 (1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet… KEVCVSS 3.1HIGH 7.8
- TI-2013-04197 The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP)… CVSS 3.0HIGH 7.5
- TI-2022-07265 An issue was discovered in the DNS proxy in Connman through 1.40. CVSS 3.1CRITICAL 9.1
Sources
- CVE-2016-8011 · CVE Program
- CVE-2016-8011 · NVD
- FIRST EPSS
- GHSA-g7xc-4c2r-qj7r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences