McAfee 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
一般的な弱点パターンには バッファオーバーフロー、vendor risk csrf、vendor risk sql injection, and vendor risk input validation があり、vendor surface software deployment の利用場面で アプリケーションクラッシュ、vendor impact memory corruption, and vendor impact data exposure などのリスクが生じる可能性があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2016-20050 | NetSchedScan 1.0 contains a buffer overflow vulnerability in the scan Hostname/IP field that allows local attackers to crash the application by supplying an oversized input string. Attackers can paste a crafted payload containing 388 bytes of data followed by 4 bytes of EIP overwrite into the Hostname/IP field to trigger a denial of service condition. | [email protected] | 6.9 | 0.01% | 2026-04-04 | 2026-04-14 |
| CVE-2024-25254 | SuperScan v4.1 was discovered to contain a buffer overflow via the Hostname/IP parameter. | [email protected] | 9.8 | 0.24% | 2024-11-11 | 2025-06-24 |
| CVE-2023-5445 | An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL parameter for the purpose of redirecting URL request(s) to a malicious site. This impacts the dashboard area of the user interface. A user would need to be logged into ePO to trigger this vulnerability. To exploit this the attacker must change the HTTP payload post submission, prior to it reaching the ePO server. | [email protected] | 5.4 | 0.18% | 2023-11-17 | 2024-11-21 |
| CVE-2023-5444 | A Cross Site Request Forgery vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2 allows a remote low privilege user to successfully add a new user with administrator privileges to the ePO server. This impacts the dashboard area of the user interface. To exploit this the attacker must change the HTTP payload post submission, prior to it reaching the ePO server. | [email protected] | 8.0 | 0.34% | 2023-11-17 | 2024-11-21 |
| CVE-2023-40352 | McAfee Safe Connect before 2.16.1.126 may allow an adversary with system privileges to achieve privilege escalation by loading arbitrary DLLs. | [email protected] | 7.2 | 0.16% | 2023-08-21 | 2024-11-21 |
| CVE-2023-3946 | A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO. | [email protected] | 5.4 | 0.31% | 2023-07-26 | 2024-11-21 |
| CVE-2023-25134 | McAfee Total Protection prior to 16.0.50 may allow an adversary (with full administrative access) to modify a McAfee specific Component Object Model (COM) in the Windows Registry. This can result in the loading of a malicious payload. | [email protected] | 6.7 | 0.05% | 2023-03-21 | 2025-02-28 |
| CVE-2023-0978 | A command injection vulnerability in Trellix Intelligent Sandbox CLI for version 5.2 and earlier, allows a local user to inject and execute arbitrary operating system commands using specially crafted strings. This vulnerability is due to insufficient validation of arguments that are passed to specific CLI command. The vulnerability allows the attack | [email protected] | 6.4 | 0.35% | 2023-03-13 | 2024-11-21 |
| CVE-2023-24579 | McAfee Total Protection prior to 16.0.51 allows attackers to trick a victim into uninstalling the application via the command prompt. | [email protected] | 5.5 | 0.05% | 2023-03-13 | 2025-03-03 |
| CVE-2023-24578 | McAfee Total Protection prior to 16.0.49 allows attackers to elevate user privileges due to DLL sideloading. This could enable a user with lower privileges to execute unauthorized tasks. | [email protected] | 5.5 | 0.11% | 2023-03-13 | 2025-02-27 |
| CVE-2023-24577 | McAfee Total Protection prior to 16.0.50 allows attackers to elevate user privileges due to Improper Link Resolution via registry keys. This could enable a user with lower privileges to execute unauthorized tasks. | [email protected] | 5.5 | 0.10% | 2023-03-13 | 2025-03-03 |
| CVE-2023-0221 | Product security bypass vulnerability in ACC prior to version 8.3.4 allows a locally logged-in attacker with administrator privileges to bypass the execution controls provided by ACC using the utilman program. | [email protected] | 4.4 | 0.05% | 2023-01-13 | 2024-11-21 |
| CVE-2022-43751 | McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable pointing to a subdirectory that may be controllable by an unprivileged user. This may have allowed the unprivileged user to execute arbitrary code with system privileges. | [email protected] | 7.8 | 0.07% | 2022-11-23 | 2025-04-29 |
| CVE-2022-2188 | Privilege escalation vulnerability in DXL Broker for Windows prior to 6.0.0.280 allows local users to gain elevated privileges by exploiting weak directory controls in the logs directory. This can lead to a denial-of-service attack on the DXL Broker. | [email protected] | 6.5 | 0.04% | 2022-11-07 | 2024-11-21 |
| CVE-2022-3339 | A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 Update 14 allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO. | [email protected] | 5.4 | 0.64% | 2022-10-18 | 2024-11-21 |
| CVE-2022-3338 | An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploited by mimicking the Agent Handler call to ePO and passing the carefully constructed XML file through the API. | [email protected] | 5.4 | 0.35% | 2022-10-18 | 2024-11-21 |
| CVE-2022-2330 | Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 allows a remote attacker to cause the DLP Agent to access a local service that the attacker wouldn't usually have access to via a carefully constructed XML file, which the DLP Agent doesn't parse correctly. | [email protected] | 6.5 | 0.34% | 2022-08-30 | 2024-11-21 |
| CVE-2022-37025 | An improper privilege management vulnerability in McAfee Security Scan Plus (MSS+) before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin (Living off the land) attack. This could result in the user gaining elevated permissions and being able to execute arbitrary code due to lack of an integrity check of the configuration file. | [email protected] | 7.8 | 0.04% | 2022-08-18 | 2024-11-21 |
| CVE-2022-2313 | A DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL into the folder from where the Smart installer is being executed. | [email protected] | 8.2 | 0.03% | 2022-07-27 | 2024-11-21 |
| CVE-2022-1824 | An uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local attacker to perform a sideloading attack by using a specific file name. This could result in the user gaining elevated permissions and being able to execute arbitrary code as there were insufficient checks on the executable being signed by McAfee. | [email protected] | 7.9 | 0.06% | 2022-06-20 | 2024-11-21 |