McAfee Data Loss Prevention vulnerabilities

12 CVEs affecting McAfee Data Loss Prevention, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-4088, published 2022-01-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-4088, published 2022-01-24. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authenticated attacker to inject unfiltered…
CVE-2020-7305, published 2020-08-13. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. Privilege escalation vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows a low privileged remote attacker to create new rule sets via incorrect validation of user…
CVE-2020-7302, published 2020-08-13. Medium severity, CVSS 6.4. EPSS: 0.7% chance of exploitation in the next 30 days. Unrestricted Upload of File with Dangerous Type in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated attackers to upload malicious files to the DLP case management…
CVE-2020-7300, published 2020-08-12. Medium severity, CVSS 6.3. EPSS: 0.6% chance of exploitation in the next 30 days. Improper Authorization vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated remote attackers to change the configuration when logged in with view only…
CVE-2019-3640, published 2019-11-14. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Unprotected Transport of Credentials in ePO extension in McAfee Data Loss Prevention 11.x prior to 11.4.0 allows remote attackers with access to the network to collect login details to the LDAP…
CVE-2020-7301, published 2020-08-12. Medium severity, CVSS 4.6. EPSS: 0.5% chance of exploitation in the next 30 days. Cross Site scripting vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated attackers to trigger alerts via the file upload tab in the DLP case…
CVE-2021-31832, published 2021-06-09. Medium severity, CVSS 4.8. EPSS: 0.5% chance of exploitation in the next 30 days. Improper Neutralization of Input in the ePO administrator extension for McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a remote ePO DLP administrator to inject…
CVE-2020-7304, published 2020-08-13. High severity, CVSS 7.6. EPSS: 0.5% chance of exploitation in the next 30 days. Cross site request forgery vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated remote attacker to embed a CRSF script via adding a new label.
CVE-2020-7303, published 2020-08-13. Medium severity, CVSS 4.1. EPSS: 0.4% chance of exploitation in the next 30 days. Cross Site scripting vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated remote user to trigger scripts to run in a user's browser via adding a new…
CVE-2020-7346, published 2021-03-23. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) for Windows prior to 11.6.100 allows a local, low privileged, attacker through the use of junctions to cause the product to…

Latest

CVE-2020-7307, published 2020-08-13. Medium severity, CVSS 5.2. EPSS: 0.3% chance of exploitation in the next 30 days. Unprotected Storage of Credentials vulnerability in McAfee Data Loss Prevention (DLP) for Mac prior to 11.5.2 allows local users to gain access to the RiskDB username and password via unprotected log…
CVE-2020-7306, published 2020-08-13. Medium severity, CVSS 5.2. EPSS: 0.2% chance of exploitation in the next 30 days. Unprotected Storage of Credentials vulnerability in McAfee Data Loss Prevention (DLP) for Mac prior to 11.5.2 allows local users to gain access to the ADRMS username and password via unprotected log…