WG
Product
Web Gateway
On CISA KEVExploited in the wild
41
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 17Medium 16Low 0
Watch
Add Web Gateway to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-3156 In wildKEV | 7.8 | Jan 26 | Sudo Heap-Based Buffer Overflow Vulnerability Affected: 8.2.17; 9.2.8; 10.0.4 |
| CVE-2019-9169 | 9.8 | Feb 26 | In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression… Affected: 7.7.2.0 before 7.7.2.21; 7.8.2.0 before 7.8.2.8; 8.0.0 before 8.1.1 |
| CVE-2018-18311 | 9.8 | Dec 7 | Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations Affected: 7.7.2 before 7.7.2.21; 7.8.2 before 7.8.2.8; 8.0.0 before 8.1.1 |
| CVE-2016-4448 | 9.8 | Jun 9 | Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors Affected: through 7.5.2.10; 7.6.0.0 through 7.6.2.3 |
| CVE-2019-3638 | 9.6 | Sep 12 | Reflected Cross Site Scripting vulnerability in Administrators web console in McAfee Web Gateway (MWG) 7.8.x prior to 7.8.2.13 allows remote attackers to collect sensitive… Affected: 7.8.2 before 7.8.2.13; 8.0.0 before 8.2.0 |
| CVE-2020-7293 | 9.0 | Sep 15 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user with low permissions to change the system's root password… Affected: 7.8.0 before 7.8.2.23; 8.2.0 before 8.2.11; 9.0.0 before 9.2.3 |
| CVE-2021-23885 | 8.8 | Feb 17 | Privilege escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.8 allows an authenticated user to gain elevated privileges through the User Interface and execute… Affected: before 8.2.17; 9.2 before 9.2.8; 10.0 before 10.0.4 |
| CVE-2016-1762 | 8.1 | Mar 24 | The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document Affected: through 7.5.2.10; after 7.5.2.11 through 7.6.2.3 |
| CVE-2017-1000366 | 7.8 | Jun 19 | glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code… Affected: through 7.6.2.14; 7.7.0.0 through 7.7.2.2 |
| CVE-2016-1840 | 7.8 | May 20 | Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS… Affected: 7.5.0.0 through 7.5.2.10; 7.6.0.0 through 7.6.2.3 |
| CVE-2016-1834 | 7.8 | May 20 | Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1,… Affected: 7.5.0.0 through 7.5.2.10; 7.6.0.0 through 7.6.2.3 |
| CVE-2019-3644 | 7.5 | Sep 11 | McAfee Web Gateway (MWG) earlier than 7.8.2.13 is vulnerable to a remote attacker exploiting CVE-2019-9517, potentially leading to a denial of service Affected: 7.7.2.0 before 7.7.2.24; 7.8.2 before 7.8.2.13; 8.0.0 before 8.2.0 |
| CVE-2019-3643 | 7.5 | Sep 11 | McAfee Web Gateway (MWG) earlier than 7.8.2.13 is vulnerable to a remote attacker exploiting CVE-2019-9511, potentially leading to a denial of service Affected: 7.7.2.0 before 7.7.2.24; 7.8.2 before 7.8.2.13; 8.0.0 before 8.2.0 |
| CVE-2019-9518 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service Affected: 7.7.2.0 before 7.7.2.24; 7.8.2.0 before 7.8.2.13; 8.1.0 before 8.2.0 |
| CVE-2019-9517 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service Affected: 7.7.2.0 before 7.7.2.24; 7.8.2.0 before 7.8.2.13; 8.1.0 before 8.2.0 |
| CVE-2019-9515 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service Affected: 7.7.2.0 before 7.7.2.24; 7.8.2.0 before 7.8.2.13; 8.1.0 before 8.2.0 |
| CVE-2019-9514 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service Affected: 7.7.2.0 before 7.7.2.24; 7.8.2.0 before 7.8.2.13; 8.1.0 before 8.2.0 |
| CVE-2019-9513 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service Affected: 7.7.2.0 before 7.7.2.24; 7.8.2.0 before 7.8.2.13; 8.1.0 before 8.2.0 |
| CVE-2019-9511 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service Affected: 7.7.2.0 before 7.7.2.24; 7.8.2.0 before 7.8.2.13; 8.1.0 before 8.2.0 |
| CVE-2016-4447 | 7.5 | Jun 9 | The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application… Affected: 7.5.0.0 through 7.5.2.10; 7.6.0.0 through 7.6.2.3 |
| CVE-2021-3450 | 7.4 | Mar 25 | CA certificate check bypass with X509_V_FLAG_X509_STRICT Affected: 8.2.19; 9.2.10; 10.1.1 |
| CVE-2019-3639 | 7.1 | Aug 14 | Clickjack vulnerability in Adminstrator web console in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows remote attackers to conduct clickjacking attacks via a crafted web… Affected: 7.8.2.0 before 7.8.2.12 |
| CVE-2019-3635 | 6.5 | Aug 14 | Exfiltration of Data in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows attackers to obtain sensitive data via crafting a complex webpage that will trigger the Web… Affected: 7.8.2.0 before 7.8.2.12 |
| CVE-2019-9516 | 6.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service Affected: 7.7.2.0 before 7.7.2.24; 7.8.2.0 before 7.8.2.13; 8.1.0 before 8.2.0 |
| CVE-2022-1254 | 6.1 | Apr 20 | A URL redirection vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.9, 9.x prior to 9.2.20, 8.x prior to 8.2.27, and 7.x prior to 7.8.2.31, and controlled release… Affected: 7.0.0 before 7.8.2.31; 8.0.0 before 8.2.27; 9.0.0 before 9.2.20; 10.0.0 before 10.2.9; 11.0.0 before 11.1.3 |
| CVE-2021-3449 | 5.9 | Mar 25 | NULL pointer deref in signature_algorithms processing Affected: 8.2.19; 9.2.10; 10.1.1 |
| CVE-2019-1559 | 5.9 | Feb 27 | 0-byte record padding oracle Affected: 7.0.0 before 9.0.0 |
| CVE-2020-7297 | 5.7 | Sep 16 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected dashboard data via improper access… Affected: 7.8.0 before 7.8.2.22; 8.2.0 before 8.2.9; 9.0.0 before 9.2.1 |
| CVE-2020-7296 | 5.7 | Sep 15 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected configuration files via improper access… Affected: 7.8.0 before 7.8.2.23; 8.2.0 before 8.2.11; 9.0.0 before 9.2.3 |
| CVE-2019-6454 | 5.5 | Mar 17 | An issue was discovered in sd-bus in systemd 239 Affected: before 7.7.2.21; 7.8.0 before 7.8.2.8; 8.0.0 before 8.1.1 |
| CVE-2016-1839 | 5.5 | May 20 | The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers… Affected: 7.5.0.0 through 7.5.2.10; 7.6.0.0 through 7.6.2.3 |
| CVE-2016-1838 | 5.5 | May 20 | The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows… Affected: 7.5.0.0 through 7.5.2.10; 7.6.0.0 through 7.6.2.3 |
| CVE-2016-1837 | 5.5 | May 20 | Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X… Affected: 7.5.0.0 through 7.5.2.10; 7.6.0.0 through 7.6.2.3 |
| CVE-2016-1836 | 5.5 | May 20 | Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS… Affected: 7.5.0.0 through 7.5.2.10; 7.6.0.0 through 7.6.2.3 |
| CVE-2016-1833 | 5.5 | May 20 | The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers… Affected: 7.5.0.0 through 7.5.2.10; after 7.6.0.0 through 7.6.2.3 |
| CVE-2020-7295 | 4.6 | Sep 15 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected log data via improper access… Affected: 7.8.0 before 7.8.2.23; 8.2.0 before 8.2.11; 9.0.0 before 9.2.3 |
| CVE-2020-7294 | 4.6 | Sep 15 | Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected files via improper access… Affected: 7.8.0 before 7.8.2.23; 8.2.0 before 8.2.11; 9.0.0 before 9.2.3 |
| CVE-2020-7292 | 4.3 | Jul 15 | Inappropriate Encoding for output context vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows a remote attacker to cause MWG to return an ambiguous redirect response… Affected: 7.8.0 before 7.8.2.22; 8.2.0 before 8.2.9; 9.0.0 before 9.2.1 |
| CVE-2014-6064 | – | Sep 2 | The Accounts tab in the administrative user interface in McAfee Web Gateway (MWG) before 7.3.2.9 and 7.4.x before 7.4.2 allows remote authenticated users to obtain the hashed user… Affected: 7.3.0 before 7.3.2.9; 7.4.0 before 7.4.2 |
| CVE-2014-2535 | – | Mar 18 | Directory traversal vulnerability in McAfee Web Gateway (MWG) 7.4.x before 7.4.1, 7.3.x before 7.3.2.6, and 7.2.0.9 and earlier allows remote authenticated users to read arbitrary… Affected: 7.2.0 through 7.2.0.9; 7.3.2 before 7.3.2.6; 7.4.0 before 7.4.1 |
| CVE-2012-2212 | – | Apr 28 | McAfee Web Gateway 7.0 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header Affected: 7.0.0 |
Showing 41