McAfee Network Security Manager vulnerabilities

19 CVEs affecting McAfee Network Security Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-4038, published 2021-12-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-3968, published 2018-06-13. Critical severity, CVSS 9.1. EPSS: 1.5% chance of exploitation in the next 30 days. Session fixation vulnerability in the web interface in McAfee Network Security Manager (NSM) before 8.2.7.42.2 and McAfee Network Data Loss Prevention (NDLP) before 9.3.4.1.5 allows remote attackers…
CVE-2017-3972, published 2018-04-03. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. Infrastructure-based foot printing vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to execute arbitrary code via the server banner…
CVE-2019-3597, published 2019-03-26. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Authentication Bypass vulnerability in McAfee Network Security Manager (NSM) 9.1 < 9.1.7.75.2 and 9.2 < 9.2.7.31 (9.2 Update 2) allows unauthenticated users to gain administrator rights via incorrect…
CVE-2017-3960, published 2018-06-12. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. Exploitation of Authorization vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows authenticated users to gain elevated privileges via a crafted…
CVE-2017-3969, published 2018-04-04. Medium severity, CVSS 5.9. EPSS: 0.8% chance of exploitation in the next 30 days. Abuse of communication channels vulnerability in the server in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows man-in-the-middle attackers to decrypt messages via an inadequate…
CVE-2017-3967, published 2018-04-04. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. Target influence via framing vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to inject arbitrary web script or HTML via…
CVE-2014-2390, published 2014-08-29. Medium severity, CVSS 6.8. EPSS: 0.7% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in the User Management module in McAfee Network Security Manager (NSM) before 6.1.15.39 7.1.5.x before 7.1.5.15, 7.1.15.x before 7.1.15.7, 7.5.x before…
CVE-2017-3966, published 2018-04-04. Medium severity, CVSS 6.3. EPSS: 0.7% chance of exploitation in the next 30 days. Exploitation of session variables, resource IDs and other trusted credentials vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers…
CVE-2019-3602, published 2019-05-15. Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days. Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) Prior to 9.1 Update 5 allows an authenticated administrator to embed an XSS in the administrator interface via a…
CVE-2017-3961, published 2018-05-25. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows authenticated users to allow arbitrary HTML code to be reflected in…

Latest

CVE-2021-4038, published 2021-12-09. Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days. Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) prior to 10.1 Minor 7 allows a remote authenticated administrator to embed a XSS in the administrator interface via…
CVE-2020-7258, published 2020-03-18. Medium severity, CVSS 4.8. EPSS: 0.5% chance of exploitation in the next 30 days. Cross site scripting vulnerability in McAfee Network Security Management (NSM) Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecified vectors.
CVE-2020-7256, published 2020-03-18. Medium severity, CVSS 4.8. EPSS: 0.5% chance of exploitation in the next 30 days. Cross site scripting vulnerability in McAfee Network Security Management (NSM) Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecified vectors.
CVE-2019-3606, published 2019-03-26. Medium severity, CVSS 4.1. EPSS: 0.2% chance of exploitation in the next 30 days. Data Leakage Attacks vulnerability in the web portal component when in an MDR pair in McAfee Network Security Management (NSM) 9.1 < 9.1.7.75 (Update 4) and 9.2 < 9.2.7.31 Update2 allows…
CVE-2018-6681, published 2018-07-17. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Abuse of Functionality vulnerability in the web interface in McAfee Network Security Management (NSM) 9.1.7.11 and earlier allows authenticated users to allow arbitrary HTML code to be reflected in…
CVE-2017-3962, published 2018-06-12. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. Password recovery exploitation vulnerability in the non-certificate-based authentication mechanism in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to crack user…