Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Vulnerabilities in McAfee ePolicy Orchestrator

swarm.ptsecurity.com | research | #rce | #vulnerability-research | #cve | #ssrf | #mcafee

Summary

Three McAfee ePolicy Orchestrator 5.10.0 vulnerabilities: a CSRF + SSRF + MITM chain enabling unauthenticated RCE by rewriting database test-connection traffic to reset the sa password, a ZipSlip RCE for logged-in users, and reflected XSS.
Published
Collected

original ↗

Related coverage

  1. Vulnerabilities in the Openfire Admin Console (swarm.ptsecurity.com)
  2. How to Chain Vulnerabilities for RCE: From Image Metadata to Complete System Compromise (hackenproof.com)
  3. Project Glasswing: What We Learned Running a Frontier Model on Our Own Codebase (hackerone.com)
  4. Blind trust: what is hidden behind the process of creating your PDF file? (swarm.ptsecurity.com)
  5. Cracking the lens: targeting HTTP's hidden attack-surface (portswigger.net)
  6. New crazy payloads in the URL Validation Bypass Cheat Sheet (portswigger.net)

back