486
CVEs
25
Critical
166
High
2
KEV
55
PoC
160
Unpatched C/H
16.0%
Patch Rate
4.3%
Avg EPSS
Severity Breakdown
CRITICAL
25
HIGH
166
MEDIUM
253
LOW
42
Monthly CVE Trend
Affected Products (30)
Epolicy Orchestrator
73
Debian Linux
60
Ubuntu Linux
52
Leap
46
Opensuse
46
Web Gateway
41
Java
38
Endpoint Security
35
Jdk
32
Jre
31
Network Data Loss Prevention
29
Fedora
28
Enterprise Linux Workstation
27
Enterprise Linux Server
26
Enterprise Linux Desktop
26
Data Loss Prevention Endpoint
26
Advanced Threat Defense
24
E Series Santricity Os Controller
23
Active Iq Unified Manager
23
Total Protection
23
Enterprise Linux
21
Agent
20
Oncommand Insight
20
Oncommand Workflow Automation
20
Enterprise Linux Server Aus
20
Virusscan Enterprise
19
Openjdk
19
Steelstore Cloud Integrated Storage
19
Enterprise Linux Server Tus
19
Santricity Unified Manager
18
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2012-4598 | An unspecified ActiveX control in McAfee Virtual Technician (MVT) before 6.4, and ePO-MVT, allows remote attackers to execute arbitrary code or cause a denial of service (Internet Explorer crash) via. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 67.9%. | CRITICAL | 9.3 | 67.9% | 149 |
PoC
No patch
|
| CVE-2020-13935 | The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. | HIGH | 7.5 | 87.6% | 145 |
PoC
|
| CVE-2020-9484 | When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server;. Rated high severity (CVSS 7.0). This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects. | HIGH | 7.0 | 56.6% | 112 |
PoC
|
| CVE-2012-1461 | The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, F-Secure Anti-Virus 9.0.16160.0, Fortinet Antivirus 4.2.254.0, Ikarus. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 83.9% and no vendor patch available. | MEDIUM | 4.3 | 83.9% | 105 |
No patch
|
| CVE-2021-33037 | Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers. | MEDIUM | 5.3 | 75.4% | 102 |
|
| CVE-2012-1459 | The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 79.5% and no vendor patch available. | MEDIUM | 4.3 | 79.5% | 101 |
No patch
|
| CVE-2012-1453 | The CAB file parser in Dr.Web 5.0.2.03300, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Sophos Anti-Virus 4.61.0, Trend Micro AntiVirus 9.120.0.1004, McAfee Gateway (formerly. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 78.5% and no vendor patch available. | MEDIUM | 4.3 | 78.5% | 100 |
No patch
|
| CVE-2015-0921 | XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 58.2%. | MEDIUM | 4.0 | 58.2% | 98 |
PoC
|
| CVE-2015-0922 | McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 45.7%. | MEDIUM | 5.0 | 45.7% | 91 |
PoC
|
| CVE-2017-9287 | servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 26.5%. | MEDIUM | 6.5 | 26.5% | 79 |
PoC
|
| CVE-2012-1425 | The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 54.2% and no vendor patch available. | MEDIUM | 4.3 | 54.2% | 76 |
No patch
|
| CVE-2021-3156 | Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available. | HIGH | 7.8 | 99.3% | 74 |
KEV
PoC
|
| CVE-2017-3897 | A Code Injection vulnerability in the non-certificate-based authentication mechanism in McAfee Live Safe versions prior to 16.0.3 and McAfee Security Scan Plus (MSS+) versions prior to 3.11.599.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 4.1% | 73 |
PoC
No patch
|
| CVE-2012-5879 | An ActiveX control in McHealthCheck.dll in McAfee Virtual Technician (MVT) and ePO-MVT 6.5.0.2101 and earlier allows remote attackers to modify or create arbitrary files via a full pathname argument. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 11.9%. | HIGH | 8.2 | 11.9% | 73 |
PoC
No patch
|
| CVE-2012-1457 | The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 50.8% and no vendor patch available. | MEDIUM | 4.3 | 50.8% | 72 |
No patch
|