McAfee Security Software
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any McAfee product.
RSS Feeds for McAfee security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in McAfee products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by McAfee Sorted by Most Security Vulnerabilities since 2018
Known Exploited McAfee Vulnerabilities
The following McAfee vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| McAfee Total Protection MTP Arbitrary Process Execution |
Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP self-defense. CVE-2021-23874 Exploit Probability: 0.8% |
November 3, 2021 |
By the Year
In 2025 there have been 0 vulnerabilities in McAfee. Last year, in 2024 McAfee had 2 security vulnerabilities published. Right now, McAfee is on track to have less security vulnerabilities in 2025 than it did last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2025 | 0 | 0.00 |
| 2024 | 2 | 0.00 |
| 2023 | 10 | 6.10 |
| 2022 | 23 | 6.66 |
| 2021 | 63 | 6.39 |
| 2020 | 94 | 6.03 |
| 2019 | 65 | 6.61 |
| 2018 | 23 | 7.51 |
It may take a day or so for new McAfee vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent McAfee Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2024-25254 | Nov 11, 2024 |
SuperScan v4.1 Buffer Overflow Vulnerability in Hostname/IP ParameterSuperScan v4.1 was discovered to contain a buffer overflow via the Hostname/IP parameter. |
Superscan
|
| CVE-2024-4843 | May 16, 2024 |
ePO IDOR Enables Privilege EscalationePO doesn't allow a regular privileged user to delete tasks or assignments. Insecure direct object references that allow a least privileged user to manipulate the client task and client task assignments, hence escalating his/her privilege. |
Epolicy Orchestrator
|
| CVE-2023-5444 | Nov 17, 2023 |
ePO <5.10.0 CP1U2: CSRF Adds Admin UserA Cross Site Request Forgery vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2 allows a remote low privilege user to successfully add a new user with administrator privileges to the ePO server. This impacts the dashboard area of the user interface. To exploit this the attacker must change the HTTP payload post submission, prior to it reaching the ePO server. |
Epolicy Orchestrator
|
| CVE-2023-5445 | Nov 17, 2023 |
ePO 5.10.0 CP1 U2 Open Redirect VulnerabilityAn open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL parameter for the purpose of redirecting URL request(s) to a malicious site. This impacts the dashboard area of the user interface. A user would need to be logged into ePO to trigger this vulnerability. To exploit this the attacker must change the HTTP payload post submission, prior to it reaching the ePO server. |
Epolicy Orchestrator
|
| CVE-2023-40352 | Aug 21, 2023 |
McAfee Safe Connect before 2.16.1.126 mayMcAfee Safe Connect before 2.16.1.126 may allow an adversary with system privileges to achieve privilege escalation by loading arbitrary DLLs. |
Safe Connect
|
| CVE-2023-3946 | Jul 26, 2023 |
A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO. |
Epolicy Orchestrator
|
| CVE-2023-25134 | Mar 21, 2023 |
McAfee Total Protection prior to 16.0.50 mayMcAfee Total Protection prior to 16.0.50 may allow an adversary (with full administrative access) to modify a McAfee specific Component Object Model (COM) in the Windows Registry. This can result in the loading of a malicious payload. |
Total Protection
|
| CVE-2023-0978 | Mar 13, 2023 |
A command injection vulnerability in Trellix Intelligent Sandbox CLI for version 5.2 and earlierA command injection vulnerability in Trellix Intelligent Sandbox CLI for version 5.2 and earlier, allows a local user to inject and execute arbitrary operating system commands using specially crafted strings. This vulnerability is due to insufficient validation of arguments that are passed to specific CLI command. The vulnerability allows the attack |
Advanced Threat Defense
|
| CVE-2023-24577 | Mar 13, 2023 |
McAfee Total Protection prior to 16.0.50 allows attackers to elevate user privileges due to Improper Link Resolution via registry keysMcAfee Total Protection prior to 16.0.50 allows attackers to elevate user privileges due to Improper Link Resolution via registry keys. This could enable a user with lower privileges to execute unauthorized tasks. |
Total Protection
|
| CVE-2023-24578 | Mar 13, 2023 |
McAfee Total Protection prior to 16.0.49 allows attackers to elevate user privileges due to DLL sideloadingMcAfee Total Protection prior to 16.0.49 allows attackers to elevate user privileges due to DLL sideloading. This could enable a user with lower privileges to execute unauthorized tasks. |
Total Protection
|
| CVE-2023-24579 | Mar 13, 2023 |
McAfee Total Protection prior to 16.0.51McAfee Total Protection prior to 16.0.51 allows attackers to trick a victim into uninstalling the application via the command prompt. |
Total Protection
|
| CVE-2023-0221 | Jan 13, 2023 |
Product security bypass vulnerability in ACC prior to version 8.3.4Product security bypass vulnerability in ACC prior to version 8.3.4 allows a locally logged-in attacker with administrator privileges to bypass the execution controls provided by ACC using the utilman program. |
Application And Change Control
|
| CVE-2022-43751 | Nov 23, 2022 |
McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable pointing to a subdirectoryMcAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable pointing to a subdirectory that may be controllable by an unprivileged user. This may have allowed the unprivileged user to execute arbitrary code with system privileges. |
Total Protection
|
| CVE-2022-3338 | Oct 18, 2022 |
An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploited by mimicking the Agent Handler call to ePO and passing the carefully constructed XML file through the API. |
Epolicy Orchestrator
|
| CVE-2022-3339 | Oct 18, 2022 |
A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 Update 14A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 Update 14 allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO. |
Epolicy Orchestrator
|
| CVE-2022-37025 | Aug 18, 2022 |
An improper privilege management vulnerability in McAfee Security Scan Plus (MSS+) before 4.1.262.1 couldAn improper privilege management vulnerability in McAfee Security Scan Plus (MSS+) before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin (Living off the land) attack. This could result in the user gaining elevated permissions and being able to execute arbitrary code due to lack of an integrity check of the configuration file. |
Security Scan Plus
|
| CVE-2022-2313 | Jul 27, 2022 |
A DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, whichA DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL into the folder from where the Smart installer is being executed. |
Agent
|
| CVE-2022-1823 | Jun 20, 2022 |
Improper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 couldImproper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local user to modify a configuration file and perform a LOLBin (Living off the land) attack. This could result in the user gaining elevated permissions and being able to execute arbitrary code, through not correctly checking the integrity of the configuration file. |
Consumer Product Removal Tool
|
| CVE-2022-1824 | Jun 20, 2022 |
An uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 couldAn uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local attacker to perform a sideloading attack by using a specific file name. This could result in the user gaining elevated permissions and being able to execute arbitrary code as there were insufficient checks on the executable being signed by McAfee. |
Consumer Product Removal Tool
|
| CVE-2022-1254 | Apr 20, 2022 |
A URL redirection vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.9, 9.x prior to 9.2.20, 8.x prior to 8.2.27, and 7.x prior to 7.8.2.31, and controlled release 11.x prior to 11.1.3A URL redirection vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.9, 9.x prior to 9.2.20, 8.x prior to 8.2.27, and 7.x prior to 7.8.2.31, and controlled release 11.x prior to 11.1.3 allows a remote attacker to redirect a user to a malicious website controlled by the attacker. This is possible because SWG incorrectly creates a HTTP redirect response when a user clicks a carefully constructed URL. Following the redirect response, the new request is still filtered by the SWG policy. |
Web Gateway
|
| CVE-2022-1256 | Apr 14, 2022 |
A local privilege escalation vulnerability in MA for Windows prior to 5.7.6A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged user to gain system privileges through running the repair functionality. Temporary file actions were performed on the local user's %TEMP% directory with System privileges through manipulation of symbolic links. |
Agent
|
| CVE-2022-1257 | Apr 14, 2022 |
Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6Insecure storage of sensitive information vulnerability in MA for Linux, macOS, and Windows prior to 5.7.6 allows a local user to gain access to sensitive information through storage in ma.db. The sensitive information has been moved to encrypted database files. |
Agent
|
| CVE-2022-1258 | Apr 14, 2022 |
A blind SQL injection vulnerability in the ePolicy Orchestrator (ePO) extension of MA prior to 5.7.6A blind SQL injection vulnerability in the ePolicy Orchestrator (ePO) extension of MA prior to 5.7.6 can be exploited by an authenticated administrator on ePO to perform arbitrary SQL queries in the back-end database, potentially leading to command execution on the server. |
Agent
Epolicy Orchestrator
|
| CVE-2022-0858 | Mar 23, 2022 |
A cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13A cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to limited ability to alter some information in ePO due to the area of the User Interface the vulnerability is present in. |
Epolicy Orchestrator
|
| CVE-2022-0862 | Mar 23, 2022 |
A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to change the password of a compromised session without knowing the existing user's password. This functionality was removed from the User Interface in ePO 10 and the API has now been disabled. Other protection is in place to reduce the likelihood of this being successful through sending a link to a logged in user. |
Epolicy Orchestrator
|
| CVE-2022-0861 | Mar 23, 2022 |
A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some ability to alter data. |
Epolicy Orchestrator
|
| CVE-2022-0859 | Mar 23, 2022 |
McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the restoration of the ePO server. To achieve this the attacker would have to be logged onto the server hosting the ePO server (restricted to administrators) and to know the SQL server password. |
Epolicy Orchestrator
|
| CVE-2022-0857 | Mar 23, 2022 |
A reflected cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13A reflected cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO due to the area of the User Interface the vulnerability is present in. |
Epolicy Orchestrator
|
| CVE-2022-0842 | Mar 23, 2022 |
A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote authenticated attacker to potentially obtain information from the ePO database. The data obtained is dependent on the privileges the attacker has and to obtain sensitive data the attacker would require administrator privileges. |
Epolicy Orchestrator
|
| CVE-2022-0815 | Mar 10, 2022 |
Improper access control vulnerability in McAfee WebAdvisor Chrome and Edge browser extensions up to 8.1.0.1895Improper access control vulnerability in McAfee WebAdvisor Chrome and Edge browser extensions up to 8.1.0.1895 allows a remote attacker to gain access to McAfee WebAdvisor settings and other details about the users system. This could lead to unexpected behaviors including; settings being changed, fingerprinting of the system leading to targeted scams, and not triggering the malicious software if McAfee software is detected. |
Webadvisor
|
| CVE-2021-4088 | Jan 24, 2022 |
SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database. This could lead to remote code execution on the ePO server with privilege escalation. |
Data Loss Prevention
|
| CVE-2021-31854 | Jan 19, 2022 |
A command Injection Vulnerability in McAfee Agent (MA) for Windows prior to 5.7.5A command Injection Vulnerability in McAfee Agent (MA) for Windows prior to 5.7.5 allows local users to inject arbitrary shell code into the file cleanup.exe. The malicious clean.exe file is placed into the relevant folder and executed by running the McAfee Agent deployment feature located in the System Tree. An attacker may exploit the vulnerability to obtain a reverse shell which can lead to privilege escalation to obtain root privileges. |
Agent
|
| CVE-2022-0166 | Jan 19, 2022 |
A privilege escalation vulnerability in the McAfee Agent prior to 5.7.5A privilege escalation vulnerability in the McAfee Agent prior to 5.7.5. McAfee Agent uses openssl.cnf during the build process to specify the OPENSSLDIR variable as a subdirectory within the installation directory. A low privilege user could have created subdirectories and executed arbitrary code with SYSTEM privileges by creating the appropriate pathway to the specifically created malicious openssl.cnf file. |
Agent
|
| CVE-2022-0129 | Jan 11, 2022 |
Uncontrolled search path element vulnerability in McAfee TechCheck prior to 4.0.0.2Uncontrolled search path element vulnerability in McAfee TechCheck prior to 4.0.0.2 allows a local administrator to load their own Dynamic Link Library (DLL) gaining elevation of privileges to system user. This was achieved through placing the malicious DLL in the same directory that the process was run from. |
Techcheck
|
| CVE-2021-31833 | Jan 04, 2022 |
Potential product security bypass vulnerability in McAfee Application and Change Control (MACC) prior to version 8.3.4 allows a locally logged in attacker to circumvent the application solidification protection provided by MACC, permitting them to run applicationsPotential product security bypass vulnerability in McAfee Application and Change Control (MACC) prior to version 8.3.4 allows a locally logged in attacker to circumvent the application solidification protection provided by MACC, permitting them to run applications that would usually be prevented by MACC. This would require the attacker to rename the specified binary to match name of any configured updater and perform a specific set of steps, resulting in the renamed binary to be to run. |
Application And Change Control
|
| CVE-2021-4038 | Dec 09, 2021 |
Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) prior to 10.1 Minor 7Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) prior to 10.1 Minor 7 allows a remote authenticated administrator to embed a XSS in the administrator interface via specially crafted custom rules containing HTML. NSM did not correctly sanitize custom rule content in all scenarios. |
Network Security Manager
|
| CVE-2021-31851 | Nov 23, 2021 |
A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the profileNodeID request parameters. The malicious script is reflected unmodified into the Policy Auditor web-based interface which could lead to the extraction of end user session token or login credentials. These may be used to access additional security-critical applications or conduct arbitrary cross-domain requests. |
Policy Auditor
|
| CVE-2021-31852 | Nov 23, 2021 |
A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the UID request parameter. The malicious script is reflected unmodified into the Policy Auditor web-based interface which could lead to the extract of end user session token or login credentials. These may be used to access additional security-critical applications or conduct arbitrary cross-domain requests. |
Policy Auditor
|
| CVE-2021-31853 | Nov 10, 2021 |
DLL Search Order Hijacking Vulnerability in McAfee Drive Encryption (MDE) prior to 7.3.0 HF2 (7.3.0.183)DLL Search Order Hijacking Vulnerability in McAfee Drive Encryption (MDE) prior to 7.3.0 HF2 (7.3.0.183) allows local users to execute arbitrary code and escalate privileges via execution from a compromised folder. |
Drive Encryption
|
| CVE-2021-31849 | Nov 01, 2021 |
SQL injection vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.7.100SQL injection vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.7.100 allows a remote attacker logged into ePO as an administrator to inject arbitrary SQL into the ePO database through the user management section of the DLP ePO extension. |
Data Loss Prevention Endpoint
|
| CVE-2021-31848 | Nov 01, 2021 |
Cross site scripting (XSS) vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.7.100Cross site scripting (XSS) vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.7.100 allows a remote attacker to highjack an active DLP ePO administrator session by convincing the logged in administrator to click on a carefully crafted link in the case management part of the DLP ePO extension. |
Data Loss Prevention Endpoint
|
| CVE-2021-23877 | Oct 26, 2021 |
Privilege escalation vulnerability in the Windows trial installer of McAfee Total Protection (MTP) prior to 16.0.34_x mayPrivilege escalation vulnerability in the Windows trial installer of McAfee Total Protection (MTP) prior to 16.0.34_x may allow a local user to run arbitrary code as the admin user by replacing a specific temporary file created during the installation of the trial version of MTP. |
Total Protection
|
| CVE-2021-31835 | Oct 22, 2021 |
Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script or HTML via a specific parameter where the administrator's entries were not correctly sanitized. |
Epolicy Orchestrator
|
| CVE-2021-31834 | Oct 22, 2021 |
Stored Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11Stored Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized. |
Epolicy Orchestrator
|
| CVE-2021-23893 | Oct 01, 2021 |
Privilege Escalation vulnerability in a Windows system driver of McAfee Drive Encryption (DE) prior to 7.3.0 couldPrivilege Escalation vulnerability in a Windows system driver of McAfee Drive Encryption (DE) prior to 7.3.0 could allow a local non-admin user to gain elevated system privileges via exploiting an unutilized memory buffer. |
Drive Encryption
|
| CVE-2021-31847 | Sep 22, 2021 |
Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 couldImproper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a local attacker to perform a DLL preloading attack using unsigned DLLs. This would result in elevation of privileges and the ability to execute arbitrary code as the system user, through not correctly protecting a temporary directory used in the repair process and not checking the DLL signature. |
Mcafee Agent
Agent
|
| CVE-2021-31836 | Sep 22, 2021 |
Improper privilege management vulnerability in maconfig for McAfee Agent for Windows prior to 5.7.4Improper privilege management vulnerability in maconfig for McAfee Agent for Windows prior to 5.7.4 allows a local user to gain access to sensitive information. The utility was able to be run from any location on the file system and by a low privileged user. |
Mcafee Agent
|
| CVE-2021-31841 | Sep 22, 2021 |
A DLL sideloading vulnerability in McAfee Agent for Windows prior to 5.7.4 couldA DLL sideloading vulnerability in McAfee Agent for Windows prior to 5.7.4 could allow a local user to perform a DLL sideloading attack with an unsigned DLL with a specific name and in a specific location. This would result in the user gaining elevated permissions and the ability to execute arbitrary code as the system user, through not checking the DLL signature. |
Mcafee Agent
|
| CVE-2021-31845 | Sep 17, 2021 |
A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Discover prior to 11.6.100A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Discover prior to 11.6.100 allows an attacker in the same network as the DLP Discover to execute arbitrary code through placing carefully constructed Ami Pro (.sam) files onto a machine and having DLP Discover scan it, leading to remote code execution with elevated privileges. This is caused by the destination buffer being of fixed size and incorrect checks being made on the source size. |
Data Loss Prevention Discover
|
| CVE-2021-31842 | Sep 17, 2021 |
XML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2021 UpdateXML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2021 Update allows a local user to initiate high CPU and memory consumption resulting in a Denial of Service attack through carefully editing the EPDeploy.xml file and then executing the setup process. |
Endpoint Security
|