McAfee,LLC vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2022-1824 An uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local attacker to perform a sideloadinHigh 7.9 · Jun 20, 2022
• CVE-2022-1823 Improper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local user to modify a configurationHigh 7.9 · Jun 20, 2022
• CVE-2022-1258 A blind SQL injection vulnerability in the ePolicy Orchestrator (ePO) extension of MA prior to 5.7.6 can be exploited by an authenticated administrator on ePO tHigh 8.4 · Apr 14, 2022
• CVE-2022-1256 A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged user to gain system privileges through running the repHigh 7.8 · Apr 14, 2022
• CVE-2021-4088 SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authentHigh 8.4 · Jan 24, 2022
• CVE-2022-0166 A privilege escalation vulnerability in the McAfee Agent prior to 5.7.5.High 7.8 · Jan 19, 2022
• CVE-2021-31854 A command Injection Vulnerability in McAfee Agent (MA) for Windows prior to 5.7.5 allows local users to inject arbitrary shell code into the file cleanup.exe.High 7.7 · Jan 19, 2022
• CVE-2022-0129 Uncontrolled search path element vulnerability in McAfee TechCheck prior to 4.0.0.2 allows a local administrator to load their own Dynamic Link Library (DLL) gaHigh 7.4 · Jan 11, 2022
• CVE-2021-31833 Potential product security bypass vulnerability in McAfee Application and Change Control (MACC) prior to version 8.3.4 allows a locally logged in attacker to ciHigh 7.1 · Jan 4, 2022
• CVE-2021-31853 DLL Search Order Hijacking Vulnerability in McAfee Drive Encryption (MDE) prior to 7.3.0 HF2 (7.3.0.183) allows local users to execute arbitrary code and escalaHigh 7.8 · Nov 10, 2021
• CVE-2021-23893 Privilege Escalation vulnerability in a Windows system driver of McAfee Drive Encryption (DE) prior to 7.3.0 could allow a local non-admin user to gain elevatedHigh 8.8 · Oct 1, 2021
• CVE-2021-31847 Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a local attacker to perform a DLL preloadingHigh 8.2 · Sep 22, 2021
• CVE-2021-31841 A DLL sideloading vulnerability in McAfee Agent for Windows prior to 5.7.4 could allow a local user to perform a DLL sideloading attack with an unsigned DLL witHigh 8.2 · Sep 22, 2021
• CVE-2021-31845 A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Discover prior to 11.6.100 allows an attacker in the same network as the DLP Discover to exHigh 8.4 · Sep 17, 2021
• CVE-2021-31844 A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a local attacker to execute arbitrary code wiHigh 8.2 · Sep 17, 2021
• CVE-2021-31843 Improper privileges management vulnerability in McAfee Endpoint Security (ENS) Windows prior to 10.7.0 September 2021 Update allows local users to access files High 7.3 · Sep 17, 2021
• CVE-2021-31838 A command injection vulnerability in MVISION EDR (MVEDR) prior to 3.4.0 allows an authenticated MVEDR administrator to trigger the EDR client to execute arbitraHigh 8.4 · Jun 29, 2021
• CVE-2021-31840 A vulnerability in the preloading mechanism of specific dynamic link libraries in McAfee Agent for Windows prior to 5.7.3 could allow an authenticated, local atHigh 7.3 · Jun 10, 2021
• CVE-2021-31837 Memory corruption vulnerability in the driver file component in McAfee GetSusp prior to 4.0.0 could allow a program being investigated on the local machine to tHigh 8.8 · Jun 9, 2021
• CVE-2021-23895 Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authenticated attacker to create a reverse shCritical 9 · Jun 2, 2021
• CVE-2021-23894 Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote unauthenticated attacker to create a reverse Critical 9.6 · Jun 2, 2021
• CVE-2021-23892 By exploiting a time of check to time of use (TOCTOU) race condition during the Endpoint Security for Linux Threat Prevention and Firewall (ENSL TP/FW) installaHigh 8.2 · May 12, 2021
• CVE-2021-23891 Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.32 allows a local user to gain elevated privileges by impersonating a client tHigh 7.8 · May 12, 2021
• CVE-2021-23872 Privilege Escalation vulnerability in the File Lock component of McAfee Total Protection (MTP) prior to 16.0.32 allows a local user to gain elevated privileges High 7.8 · May 12, 2021
• CVE-2021-23887 Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a local, low privileged, attacker to writeHigh 7.8 · Apr 15, 2021