McAfee Enterprise Mobility Manager vulnerabilities

6 CVEs affecting McAfee Enterprise Mobility Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-4592, published 2012-08-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2012-4592, published 2012-08-22. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. The Portal in McAfee Enterprise Mobility Manager (EMM) before 10.0 does not set the secure flag for the ASP.NET session cookie in an https session, which makes it easier for remote attackers to…
CVE-2012-4591, published 2012-08-22. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. About.aspx in the Portal in McAfee Enterprise Mobility Manager (EMM) before 10.0 discloses the name of the user account for an IIS worker process, which allows remote attackers to obtain potentially…
CVE-2012-4588, published 2012-08-22. Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days. McAfee Enterprise Mobility Manager (EMM) Agent before 4.8 and Server before 10.1 record all invalid usernames presented in failed login attempts, and place them on a list of accounts that an…
CVE-2012-4590, published 2012-08-22. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in About.aspx in the Portal in McAfee Enterprise Mobility Manager (EMM) before 10.0 might allow remote attackers to inject arbitrary web script or…
CVE-2012-4587, published 2012-08-22. Low severity, CVSS 3.5. EPSS: 0.9% chance of exploitation in the next 30 days. McAfee Enterprise Mobility Manager (EMM) Agent before 4.8 and Server before 10.1, when one-time provisioning (OTP) mode is enabled, have an improper dependency on DNS SRV records, which makes it…
CVE-2012-4589, published 2012-08-22. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. Login.aspx in the Portal in McAfee Enterprise Mobility Manager (EMM) before 10.0 does not have an off autocomplete attribute for unspecified form fields, which makes it easier for remote attackers to…