McAfee Enterprise Security Manager vulnerabilities

9 CVEs affecting McAfee Enterprise Security Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-3644, published 2019-09-11.

More from McAfee.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2015-7704, published 2017-08-07. High severity, CVSS 7.5. EPSS: 10.7% chance of exploitation in the next 30 days. The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages.
• CVE-2019-3644, published 2019-09-11. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. McAfee Web Gateway (MWG) earlier than 7.8.2.13 is vulnerable to a remote attacker exploiting CVE-2019-9517, potentially leading to a denial of service. This affects the scanning proxies.
• CVE-2019-3643, published 2019-09-11. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. McAfee Web Gateway (MWG) earlier than 7.8.2.13 is vulnerable to a remote attacker exploiting CVE-2019-9511, potentially leading to a denial of service. This affects the scanning proxies.
• CVE-2019-3631, published 2019-06-27. High severity, CVSS 7.2. EPSS: 2% chance of exploitation in the next 30 days. Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary code via specially crafted parameters.
• CVE-2019-3630, published 2019-06-27. High severity, CVSS 7.2. EPSS: 2% chance of exploitation in the next 30 days. Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary code via specially crafted parameters.
• CVE-2019-3632, published 2019-06-27. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. Directory Traversal vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to gain elevated privileges via specially crafted input.
• CVE-2019-3629, published 2019-06-27. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. Application protection bypass vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows unauthenticated user to impersonate system users via specially…
• CVE-2015-7310, published 2015-09-22. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) before 9.3.2MR18, 9.4.x before 9.4.2MR8, and 9.5.x before…
• CVE-2019-3628, published 2019-06-27. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. Privilege escalation in McAfee Enterprise Security Manager (ESM) 11.x prior to 11.2.0 allows authenticated user to gain access to a core system component via incorrect access control.