Known vulnerabilities in McAfee ePolicy Orchestrator

Vendor: McAfee
Software: McAfee ePolicy Orchestrator
Software CPE: cpe:2.3:a:mcafee:mcafee_epolicy_orchestrator:*:*:*:*:*:*:*:*
Website:
Total vulnerabilities: 8
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 7.2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting McAfee ePolicy Orchestrator McAfee ePolicy Orchestrator is affected by 8 known vulnerabilities: 2 medium, 6 low Critical High Medium Low

Vulnerabilities (8)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU68315 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2022-3338		 CWE-611 Medium
No
No
 5.10 Update 14 14.10.2022 SB2022101414
#VU68312 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-3339		 CWE-79 Low
No
No
 5.10 Update 14 14.10.2022 SB2022101414
#VU17400 - Cross-Site Request Forgery (CSRF)
CVE-2019-3604		 CWE-352 Low
No
No
 - 06.02.2019 SB2019013113
#VU13451 - Improper Access Control
CVE-2018-6671		 CWE-284 Low
Available
No
 5.3.3, 5.9.1 25.06.2018 SB2018062511
#VU13450 - Missing release of memory after effective lifetime
CVE-2018-6672		 CWE-401 Low
No
No
 5.3.3, 5.9.1 20.06.2018 SB2018062511
#VU12136 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2018-6660		 CWE-22 Low
No
No
 - 24.04.2018 SB2018042418
#VU12135 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-6659		 CWE-79 Low
No
No
 - 16.04.2018 SB2018042418
#VU5654 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2016-8027		 CWE-89 Medium
No
No
 - 03.02.2017 SB2017020801