Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2730▼ 551 respecto a la semana anterior
Críticas / altas1294▼ 234 respecto a la semana anterior
Nueva explotación activa (KEV)3▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)244▼ 258 respecto a la semana anterior
613 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Baja (2.6) | 0.42% | — | Mcafee Virusscan Enterprise | 16/12/2015 | 17/6/2026 | The Buffer Overflow Protection (BOP) feature in McAfee VirusScan Enterprise before 8.8 Patch 6 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses on 32-bit platforms when protecting another application, which allows attackers to bypass the DEP and ASLR protection mechanisms via… | |
| Modificada | Alta (9.3) | 3.4% | — | Mcafee Enterprise Security Manager | 2/12/2015 | 17/6/2026 | McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) 9.3.x before 9.3.2MR19, 9.4.x before 9.4.2MR9, and 9.5.x before 9.5.0MR8, when configured to use Active Directory or LDAP authentication sources, allow remote attackers to bypass… | |
| Modificada | Media (6.8) | 0.82% | — | Mcafee Vulnerability Manager | 1/10/2015 | 17/6/2026 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Organizations page in Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that have unspecified impact via unknown vectors. | |
| Modificada | Media (6.5) | 1.1% | — | Mcafee Enterprise Security ManagerMcafee Enterprise Security Manager/log ManagerMcafee Enterprise Security Manager/receiver | 22/9/2015 | 17/6/2026 | McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) before 9.3.2MR18, 9.4.x before 9.4.2MR8, and 9.5.x before 9.5.0MR7 allow remote authenticated users to execute arbitrary OS commands via a crafted filename, which is not properly… | |
| Modificada | Baja (2.1) | 0.32% | — | Mcafee Threat Intelligence Exchange | 18/9/2015 | 17/6/2026 | The Secondary server in Threat Intelligence Exchange (TIE) before 1.2.0 uses weak permissions for unspecified (1) configuration files and (2) installation logs, which allows local users to obtain sensitive information by reading the files. | |
| Modificada | Media (5) | 2.8% | — | Mcafee Agent | 18/9/2015 | 17/6/2026 | Directory traversal vulnerability in the remote log viewing functionality in McAfee Agent (MA) 5.x before 5.0.2 allows remote attackers to obtain sensitive information via unspecified vectors. | |
| Modificada | Media (5.8) | 1.0% | — | Mcafee Epolicy Orchestrator | 23/6/2015 | 17/6/2026 | Intel McAfee ePolicy Orchestrator (ePO) 4.x through 4.6.9 and 5.x through 5.1.2 does not validate server names and Certification Authority names in X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | |
| Modificada | Media (4.3) | 1.8% | — | Mcafee Epolicy Orchestrator | 15/6/2015 | 17/6/2026 | Cross-site scripting (XSS) vulnerability in the product deployment feature in the Java core web services in Intel McAfee ePolicy Orchestrator (ePO) before 5.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |
| Modificada | Alta (7.2) | 0.47% | — | Mcafee EPO Deep Command | 14/5/2015 | 17/6/2026 | Multiple unquoted Windows search path vulnerabilities in the (1) Client Management and (2) Gateway in McAfee ePO Deep Command 2.1 and 2.2 before HF 1058831 allow local users to gain privileges via unspecified vectors. | |
| Modificada | Media (4) | 0.95% | — | Mcafee Advanced Threat Defense | 8/4/2015 | 17/6/2026 | The web interface in McAfee Advanced Threat Defense (MATD) before 3.4.4.63 allows remote authenticated users to obtain sensitive configuration information via unspecified vectors. | |
| Modificada | Media (4) | 0.95% | — | Mcafee Advanced Threat Defense | 8/4/2015 | 17/6/2026 | The web interface in McAfee Advanced Threat Defense (MATD) before 3.4.4.63 does not properly restrict access, which allows remote authenticated users to obtain sensitive information via unspecified vectors. | |
| Modificada | Media (5.5) | 0.99% | — | Mcafee Advanced Threat Defense | 8/4/2015 | 17/6/2026 | McAfee Advanced Threat Defense (MATD) before 3.4.4.63 allows remote authenticated users to bypass intended restrictions and change or update configuration settings via crafted parameters. | |
| Modificada | Baja (3.5) | 1.1% | — | Mcafee Data Loss Prevention Endpoint | 27/3/2015 | 17/6/2026 | Cross-site scripting (XSS) vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. | |
| Modificada | Media (6.8) | 0.82% | — | Mcafee Data Loss Prevention Endpoint | 27/3/2015 | 17/6/2026 | Multiple cross-site request forgery (CSRF) vulnerabilities in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allow remote attackers to hijack the authentication of users for requests that (1) obtain sensitive information or (2) modify the database via… | |
| Modificada | Media (6.5) | 1.5% | — | Mcafee Data Loss Prevention Endpoint | 27/3/2015 | 17/6/2026 | The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated users to obtain sensitive information, modify the database, or possibly have other unspecified impact via a crafted URL. | |
| Modificada | Media (4) | 1.4% | — | Mcafee Data Loss Prevention Endpoint | 27/3/2015 | 17/6/2026 | The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated users to cause a denial of service (database lock or license corruption) via unspecified vectors. | |
| Modificada | Media (4.3) | 1.5% | — | Mcafee Agent | 23/2/2015 | 17/6/2026 | The log viewer in McAfee Agent (MA) before 4.8.0 Patch 3 and 5.0.0, when the "Accept connections only from the ePO server" option is disabled, allows remote attackers to conduct clickjacking attacks via a crafted web page, aka an "http-generic-click-jacking" vulnerability. | |
| Modificada | Baja (3.5) | 1.1% | — | Mcafee Email Gateway | 17/2/2015 | 17/6/2026 | Cross-site scripting (XSS) vulnerability in the Secure Web Mail Client user interface in McAfee Email Gateway (MEG) 7.6.x before 7.6.3.2, 7.5.x before 75.6, 7.0.x through 7.0.5, 5.6, and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified tokens in Digest messages. | |
| Modificada | Media (4) | 1.3% | — | Mcafee Data Loss Prevention Endpoint | 17/2/2015 | 17/6/2026 | The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated users to obtain sensitive password information via a crafted URL. | |
| Modificada | Baja (3.5) | 1.1% | — | Mcafee Data Loss Prevention Endpoint | 17/2/2015 | 17/6/2026 | Cross-site scripting (XSS) vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. | |
| Modificada | Media (6.5) | 1.4% | — | Mcafee Data Loss Prevention Endpoint | 17/2/2015 | 17/6/2026 | SQL injection vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated ePO users to execute arbitrary SQL commands via unspecified vectors. | |
| Modificada | Media (6.9) | 0.88% | 💥 Exploit | Mcafee Data Loss Prevention Endpoint | 6/2/2015 | 17/6/2026 | McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted (1) 0x00224014 or (2) 0x0022c018 IOCTL call. | |
| Modificada | Media (5) | 13% | — | Mcafee Epolicy Orchestrator | 9/1/2015 | 17/6/2026 | McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password. | |
| Modificada | Media (4) | 17% | — | Mcafee Epolicy Orchestrator | 9/1/2015 | 17/6/2026 | XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do. | |
| Modificada | Baja (2.1) | 0.33% | — | Mcafee Network Data Loss Prevention | 29/10/2014 | 17/6/2026 | McAfee Network Data Loss Prevention (NDLP) before 9.2.2 allows local users to obtain sensitive information by reading the logs. |