mcafee threat intelligence exchange server vulnerabilities and exploits

(subscribe to this query)

5.9

CVSSv3

SSH host keys generation vulnerability in the server in McAfee Threat Intelligence Exchange Server (TIE Server) 1.3.0, 2.0.x, 2.1.x, 2.2.0 allows man-in-the-middle malicious users to spoof servers via acquiring keys from another environment.

Mcafee Threat Intelligence Exchange Server 1.3.0 Mcafee Threat Intelligence Exchange Server Mcafee Threat Intelligence Exchange Server 2.2.0

4.5

CVSSv3

Abuse of Authorization vulnerability in APIs exposed by TIE server in McAfee Threat Intelligence Exchange Server (TIE Server) 3.0.0 allows remote authenticated users to modify stored reputation data via specially crafted messages.

Mcafee Threat Intelligence Exchange Server 3.0.0

4.4

CVSSv3

Information Disclosure vulnerability in McAfee DXL Platform and TIE Server in DXL before 5.0.1 HF2 and TIE before 2.3.1 HF1 allows Authenticated users to view sensitive information in plain text via the GUI or command line.

Mcafee Data Exchange Layer Mcafee Threat Intelligence Exchange

9.8

CVSSv3

Code Injection vulnerability in the ePolicy Orchestrator (ePO) extension in McAfee Threat Intelligence Exchange (TIE) Server 2.1.0 and previous versions allows remote malicious users to execute arbitrary HTML code to be reflected in the response web page via unspecified vector.

Mcafee Mcafee Threat Intelligence Exchange 2.1.0

NA

The Secondary server in Threat Intelligence Exchange (TIE) prior to 1.2.0 uses weak permissions for unspecified (1) configuration files and (2) installation logs, which allows local users to obtain sensitive information by reading the files.

Mcafee Threat Intelligence Exchange

6.5

CVSSv3

RSA BSAFE Crypto-J versions before 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.

5.9

CVSSv3

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 by...

3 Github repositories

10

CVSSv3

Apache Log4j2 2.0-beta9 up to and including 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can contr...

2 Metasploit modules1151 Github repositories28 Articles

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook