Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Release: McAfee,LLC McAfee ePolicy Orchestrator (ePO) 5.10 CU 13 Clear all filters
TI-2022-00767 CVE-2022-0861 · GHSA-pc2g-2g3x-j4c9

ePO XML extended entity vulnerability

Priority LOW 18

A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality…

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00461 Published 2022-03-23 Fixed in 5.10 CU 13 CWE-611
TI-2022-00768 CVE-2022-0862 · GHSA-vmqf-73mx-mcw4

ePO password change vulnerability

Priority LOW 25

A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to change the password of a compromised session wit…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00671 Published 2022-03-23 Fixed in 5.10 CU 13 CWE-522
TI-2022-00764 CVE-2022-0858 · GHSA-crg3-773m-8xr8

Cross-site scripting vulnerability in ePO

Priority LOW 23

A cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the…

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00812 Published 2022-03-23 Fixed in 5.10 CU 13 CWE-79
TI-2022-00765 CVE-2022-0859 · GHSA-9533-g28x-xwf2

ePO database restoration vulnerability

Priority LOW 29

McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the restoration of the ePO server.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.0021 Published 2022-03-23 Fixed in 5.10 CU 13 CWE-522
TI-2022-00763 CVE-2022-0857 · GHSA-qpvw-vv3x-9vf4

ePO Reflected Cross-site scripting vulnerability

Priority LOW 28

A reflected cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by conv…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00722 Published 2022-03-23 Fixed in 5.10 CU 13 CWE-79
TI-2022-00749 CVE-2022-0842 · GHSA-gjcx-3wpq-4ph2

ePO blind SQL Injection vulnerability

Priority LOW 26

A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote authenticated attacker to potentially obtain information from the ePO database.

CVSS 3.1MEDIUM 5.4 Network High privileges User interaction EPSS 0.00773 Published 2022-03-23 Fixed in 5.10 CU 13 CWE-89