McAfee Policy Auditor vulnerabilities

9 CVEs affecting McAfee Policy Auditor, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-31852, published 2021-11-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-0718, published 2016-05-26. Critical severity, CVSS 9.8. EPSS: 13.3% chance of exploitation in the next 30 days. Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
CVE-2016-4472, published 2016-06-30. High severity, CVSS 8.1. EPSS: 11.9% chance of exploitation in the next 30 days. The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via…
CVE-2017-9287, published 2017-05-29. Medium severity, CVSS 6.5. EPSS: 7.2% chance of exploitation in the next 30 days. servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user with access to search the directory can crash slapd by issuing a search including the Paged…
CVE-2017-17740, published 2017-12-18. High severity, CVSS 7.5. EPSS: 7% chance of exploitation in the next 30 days. contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows…
CVE-2019-16168, published 2019-09-09. Medium severity, CVSS 6.5. EPSS: 4.3% chance of exploitation in the next 30 days. In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a "severe division by zero in the…
CVE-2019-13057, published 2019-07-26. Medium severity, CVSS 4.9. EPSS: 3.4% chance of exploitation in the next 30 days. An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation…
CVE-2020-15719, published 2020-07-14. Medium severity, CVSS 4.2. EPSS: 2.5% chance of exploitation in the next 30 days. libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching…
CVE-2021-31851, published 2021-11-23. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the profileNodeID request…
CVE-2021-31852, published 2021-11-23. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the UID request parameter.…