Mcafee vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Mcafee flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2021-23874 McAfee Total Protection (MTP) Improper Privilege ManagementExploited since Nov 3, 2021 · CVSS 8.2

Latest high and critical flaws

• CVE-2024-34405 Improper deep link validation in McAfee Security: Antivirus VPN for Android before 8.3.0 could allow an attacker to launch an arbitrary URL within the app.Critical 9.1 · Jun 11, 2024
• CVE-2023-40352 McAfee Safe Connect before 2.16.1.126 may allow an adversary with system privileges to achieve privilege escalation by loading arbitrary DLLs.High 7.2 · Aug 21, 2023
• CVE-2022-43751 McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable pointing to a subdirectHigh 7.8 · Nov 22, 2022
• CVE-2022-37025 An improper privilege management vulnerability in McAfee Security Scan Plus (MSS+) before 4.1.262.1 could allow a local user to modify a configuration file and High 7.8 · Aug 18, 2022
• CVE-2022-0280 A race condition vulnerability exists in the QuickClean feature of McAfee Total Protection for Windows prior to 16.0.43 that allows a local user to gain privileHigh 7.5 · Mar 10, 2022
• CVE-2021-31849 SQL injection vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.7.100 allows a remote attacker logged into ePO as an administrator toHigh 8.4 · Nov 1, 2021
• CVE-2021-31848 Cross site scripting (XSS) vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.7.100 allows a remote attacker to highjack an active DLPHigh 8.4 · Nov 1, 2021
• CVE-2021-23874 McAfee Total Protection (MTP) Improper Privilege ManagementExploited · High 8.2 · Feb 10, 2021
• CVE-2021-23882 Improper Access Control vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows local administrators to prevent High 8.2 · Feb 10, 2021
• CVE-2021-23878 Clear text storage of sensitive Information in memory vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows a High 7.3 · Feb 10, 2021
• CVE-2020-7332 Cross Site Request Forgery vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows an attackerHigh 7 · Nov 12, 2020
• CVE-2020-7331 Unquoted service executable path in McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows local users to cause a denial of service and maliHigh 7.8 · Nov 12, 2020
• CVE-2020-7329 Server-side request forgery vulnerability in the ePO extension in McAfee MVISION Endpoint prior to 20.11 allows remote attackers trigger server-side DNS requestHigh 7.2 · Nov 11, 2020
• CVE-2020-7328 External entity attack vulnerability in the ePO extension in McAfee MVISION Endpoint prior to 20.11 allows remote attackers to gain control of a resource or triHigh 7.2 · Nov 11, 2020
• CVE-2020-7293 Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user with low permissions to change the systemCritical 9 · Sep 15, 2020
• CVE-2020-7314 Privilege Escalation Vulnerability in the installer in McAfee Data Exchange Layer (DXL) Client for Mac shipped with McAfee Agent (MA) for Mac prior to MA 5.6.6 High 8.2 · Sep 10, 2020
• CVE-2020-7312 DLL Search Order Hijacking Vulnerability in the installer in McAfee Agent (MA) for Windows prior to 5.6.6 allows local users to execute arbitrary code and escalHigh 7.8 · Sep 10, 2020
• CVE-2020-7311 Privilege Escalation vulnerability in the installer in McAfee Agent (MA) for Windows prior to 5.6.6 allows local users to assume SYSTEM rights during the instalHigh 7.8 · Sep 10, 2020
• CVE-2020-7319 Improper Access Control vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2020 Update allows local users to access files whiHigh 8.8 · Sep 9, 2020
• CVE-2020-7304 Cross site request forgery vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated remote attacker to embed a CRSFHigh 7.6 · Aug 12, 2020
• CVE-2020-7298 Unexpected behavior violation in McAfee Total Protection (MTP) prior to 16.0.R26 allows local users to turn off real time scanning via a specially crafted objecHigh 7.5 · Aug 5, 2020
• CVE-2020-7284 Exposure of Sensitive Information in McAfee Network Security Management (NSM) prior to 10.1.7.7 allows local users to gain unauthorised access to the root accouHigh 8.6 · Jul 3, 2020
• CVE-2020-7280 Privilege Escalation vulnerability during daily DAT updates when using McAfee Virus Scan Enterprise (VSE) prior to 8.8 Patch 15 allows local users to cause the High 7.8 · Jun 10, 2020
• CVE-2019-3585 Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 14 may allow local users to High 7 · Jun 10, 2020
• CVE-2019-3617 Privilege escalation vulnerability in McAfee Total Protection (ToPS) for Mac OS prior to 4.6 allows local users to gain root privileges via incorrect protectionHigh 7.5 · Jun 10, 2020