epolicy_orchestrator 漏洞

中危CVE-2020-7318跨站脚本攻击2020/10/15

McAfee ePolicy Orchestrator <5.10.9 Update 9 - Cross-Site Scripting

McAfee ePolicy Orchestrator before 5.10.9 Update 9 is vulnerable to a cross-site scripting vulnerability that allows administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized. reference: - https://swarm.ptsecurity.com/vulnerabilities-in-mcafee-epolicy-orchestrator/ - https://kc.mcafee.com/corporate/index?page=content&id=SB10332 - https://nvd.nist.gov/vuln/detail/CVE-2020-7318

PoC 已收录McAfee-ePolicy-Orchestrator epolicy_orchestrator

CVSS4.3EPSS 1.0%

严重CVE-2006-5156缓冲区溢出2006/10/05

CVE-2006-5156

Buffer overflow in McAfee ePolicy Orchestrator before 3.5.0.720 and ProtectionPilot before 1.1.1.126 allows remote attackers to execute arbitrary code via a request to /spipe/pkg/ with a long source header.

RCEepolicy_orchestrator

CVSS10.0EPSS 74.0%

epolicy_orchestrator

关联漏洞

McAfee ePolicy Orchestrator <5.10.9 Update 9 - Cross-Site Scripting

CVE-2006-5156