McAfee Application And Change Control vulnerabilities

6 CVEs affecting McAfee Application And Change Control, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-0221, published 2023-01-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-3912, published 2018-09-18. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility.
CVE-2020-7260, published 2020-03-26. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. DLL Side Loading vulnerability in the installer for McAfee Application and Change Control (MACC) prior to 8.3 allows local users to execute arbitrary code via execution from a compromised folder.
CVE-2020-7309, published 2020-08-26. Medium severity, CVSS 4.8. EPSS: 0.4% chance of exploitation in the next 30 days. Cross Site Scripting vulnerability in ePO extension in McAfee Application Control (MAC) prior to 8.3.1 allows administrators to inject arbitrary web script or HTML via specially crafted input in the…
CVE-2020-7334, published 2020-10-15. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. Improper privilege assignment vulnerability in the installer McAfee Application and Change Control (MACC) prior to 8.3.2 allows local administrators to change or update the configuration settings via…
CVE-2021-31833, published 2022-01-04. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Potential product security bypass vulnerability in McAfee Application and Change Control (MACC) prior to version 8.3.4 allows a locally logged in attacker to circumvent the application solidification…
CVE-2023-0221, published 2023-01-13. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. Product security bypass vulnerability in ACC prior to version 8.3.4 allows a locally logged-in attacker with administrator privileges to bypass the execution controls provided by ACC using the…