EO
Product
Epolicy Orchestrator
86
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 2High 11Medium 34Low 18
Watch
Add Epolicy Orchestrator to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-8027 | 10.0 | Mar 14 | SQL injection vulnerability in core services in Intel Security McAfee ePolicy Orchestrator (ePO) 5.3.2 and earlier and 5.1.3 and earlier allows attackers to alter a SQL query,… Affected: 5.1.0 through 5.1.3; 5.3.0 through 5.3.2 |
| CVE-2017-3936 | 9.8 | Jun 13 | OS Command Injection vulnerability in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary OS commands with… Affected: 5.1.0; 5.1.1; 5.1.2; 5.1.3; 5.3.1; 5.3.2; +1 more |
| CVE-2019-3604 | 8.8 | Feb 1 | ePolicy Orchestrator Cloud update fixes multiple Cross-Site Request Forgery vulnerabilities Affected: All versions, or not specified |
| CVE-2015-8765 | 8.3 | Jan 8 | Intel McAfee ePolicy Orchestrator (ePO) 4.6.9 and earlier, 5.0.x, 5.1.x before 5.1.3 Hotfix 1106041, and 5.3.x before 5.3.1 Hotfix 1106041 allow remote attackers to execute… Affected: through 4.6.9; 5.0.0 through 5.0.1; 5.1.0 before 5.1.3; 5.3.0 before 5.3.1 |
| CVE-2020-2604 | 8.1 | Jan 15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization) Affected: 5.9.0; 5.9.1; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +3 more |
| CVE-2023-5444 | 8.0 | Nov 17 | A Cross Site Request Forgery vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2 allows a remote low privilege user to successfully add a new user with… Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +14 more |
| CVE-2021-30639 | 7.5 | Jul 12 | A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +6 more |
| CVE-2021-23840 | 7.5 | Feb 16 | Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable… Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +6 more |
| CVE-2020-13935 | 7.5 | Jul 14 | The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104 Affected: 5.9.0; 5.9.1; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +5 more |
| CVE-2019-2602 | 7.5 | Apr 23 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: 5.9.0; 5.9.1; 5.10.0 |
| CVE-2021-3712 | 7.4 | Aug 24 | ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +6 more |
| CVE-2017-3980 | 7.2 | May 18 | A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, and 5.1.3 and earlier allows remote authenticated users to execute a… Affected: through 5.1.3; 5.3.0 through 5.3.3; 5.9.0 through 5.9.1 |
| CVE-2020-9484 | 7.0 | May 20 | When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a… Affected: 5.9.0; 5.9.1; 5.10.0; 5.10.0; 5.10.0; 5.10.0 |
| CVE-2019-2949 | 6.8 | Oct 16 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Kerberos) Affected: 5.9.0; 5.9.1; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +3 more |
| CVE-2022-0859 | 6.7 | Mar 23 | McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the restoration of the ePO… Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +8 more |
| CVE-2021-23890 | 6.5 | Mar 26 | Information leak vulnerability in the Agent Handler of McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows an unauthenticated user to download McAfee product packages… Affected: before 5.9.1; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +5 more |
| CVE-2018-6672 | 6.5 | Jun 15 | Information disclosure vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows authenticated users to view sensitive information in… Affected: 5.3.0 through 5.3.3; 5.9.0 through 5.9.1 |
| CVE-2018-6671 | 6.5 | Jun 15 | Application Protection Bypass vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows remote authenticated users to bypass localhost… Affected: 5.3.0 through 5.3.3; 5.9.0 through 5.9.1 |
| CVE-2021-23888 | 6.3 | Mar 26 | Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 could cause an authenticated ePO user to load an untrusted site in… Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +5 more |
| CVE-2023-3946 | 6.1 | Jul 26 | A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to an ePO… Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +13 more |
| CVE-2022-3339 | 6.1 | Oct 18 | Reflected XSS in Trellix ePO server Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +9 more |
| CVE-2022-0857 | 6.1 | Mar 23 | A reflected cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access… Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +8 more |
| CVE-2021-2161 | 5.9 | Apr 22 | Vulnerability in the Java SE, Java SE Embedded, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries) Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +6 more |
| CVE-2020-13938 | 5.5 | Jun 10 | Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +8 more |
| CVE-2023-5445 | 5.4 | Nov 17 | An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL parameter for the purpose of redirecting… Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +14 more |
| CVE-2022-3338 | 5.4 | Oct 18 | XXE in Trellix ePO server Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +9 more |
| CVE-2021-31834 | 5.4 | Oct 22 | Stored Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script or HTML via… Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +6 more |
| CVE-2018-6659 | 5.4 | Apr 2 | Reflected Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows remote authenticated users to exploit an XSS issue via not… Affected: 5.3.0; 5.3.1; 5.3.2; 5.9.0 |
| CVE-2017-3902 | 5.4 | Feb 13 | Cross-site scripting (XSS) vulnerability in the Web user interface (UI) in Intel Security ePO 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows authenticated users to inject malicious Java… Affected: 5.1.0; 5.1.1; 5.1.2; 5.1.3 |
| CVE-2022-0862 | 5.3 | Mar 23 | A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to change… Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +8 more |
| CVE-2021-33037 | 5.3 | Jul 12 | Incorrect Transfer-Encoding handling with HTTP/1.0 Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +6 more |
| CVE-2020-14621 | 5.3 | Jul 15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JAXP) Affected: 5.9.0; 5.9.1; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +5 more |
| CVE-2019-2769 | 5.3 | Jul 23 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities) Affected: 5.9.0; 5.9.1; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +1 more |
| CVE-2019-2762 | 5.3 | Jul 23 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities) Affected: 5.9.0; 5.9.1; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +1 more |
| CVE-2019-2745 | 5.1 | Jul 23 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security) Affected: 5.9.0; 5.9.1; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +1 more |
| CVE-2022-0842 | 4.9 | Mar 23 | A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote authenticated attacker to potentially obtain… Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +8 more |
| CVE-2019-3619 | 4.9 | Jul 3 | Information Disclosure vulnerability in the Agent Handler in McAfee ePolicy Orchestrator (ePO) 5.9.x and 5.10.0 prior to 5.10.0 update 4 allows remote unauthenticated attacker to… Affected: 5.9.0; 5.9.1; 5.10.0; 5.10.0; 5.10.0; 5.10.0 |
| CVE-2018-6660 | 4.9 | Apr 2 | Directory Traversal vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows administrators to use Windows alternate data streams, which could be… Affected: 5.3.0; 5.3.1; 5.3.2; 5.9.0 |
| CVE-2021-31835 | 4.8 | Oct 22 | Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script or HTML via a specific… Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +7 more |
| CVE-2021-23889 | 4.8 | Mar 26 | Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows ePO administrators to inject arbitrary web script or HTML via multiple… Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +5 more |
| CVE-2020-2593 | 4.8 | Jan 15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking) Affected: 5.9.0; 5.9.1; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +3 more |
| CVE-2019-2975 | 4.8 | Oct 16 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting) Affected: 5.9.0; 5.9.1; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +3 more |
| CVE-2019-2816 | 4.8 | Jul 23 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking) Affected: 5.9.0; 5.9.1; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +1 more |
| CVE-2022-0858 | 4.7 | Mar 23 | A cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO… Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +8 more |
| CVE-2020-7318 | 4.3 | Oct 14 | Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10.9 Update 9 allows administrators to inject arbitrary web script or HTML via multiple… Affected: 5.10.0 through 5.10.9 |
| CVE-2020-7317 | 4.3 | Oct 14 | Cross-Site Scripting vulnerability in McAfee ePolicy Orchistrator (ePO) prior to 5.10.9 Update 9 allows administrators to inject arbitrary web script or HTML via parameter values… Affected: through 5.9.1; 5.10.0 through 5.10.9 |
| CVE-2020-14792 | 4.2 | Oct 21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Hotspot) Affected: 5.9.0; 5.9.1; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +3 more |
| CVE-2022-0861 | 3.8 | Mar 23 | A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file… Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +8 more |
| CVE-2021-2432 | 3.7 | Jul 21 | Vulnerability in the Java SE product of Oracle Java SE (component: JNDI) Affected: before 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +6 more |
| CVE-2020-14782 | 3.7 | Oct 21 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries) Affected: 5.9.0; 5.9.1; 5.10.0; 5.10.0; 5.10.0; 5.10.0; +3 more |