[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUkJDq2rrijjJo9l3gL2nst14CLytoFzulWFVJ6N5d7Y":3,"g5a-ex:mcafee\u002Fepolicy_orchestrator@*":224,"g5a-family:mcafee\u002Fepolicy_orchestrator":226},{"success":4,"data":5},true,{"product":6,"versions":103,"topVulnerabilitiesByEpss":142,"kevVulnerabilities":202,"seoMetadata":203,"meta":222},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":102},"mcafee","epolicy_orchestrator",38,86,0,"2023-11-17",[14,18,21,24,26,28,30,33,36,38,41,43,45,48,50,52,54,56,58,60,62,65,67,69,71,73,75,77,80,82,84,86,88,90,92,94,96,99],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},"2.0",6,false,{"version":19,"cve_count":20,"kev_count":11,"has_kev":17},"2.5",7,{"version":22,"cve_count":23,"kev_count":11,"has_kev":17},"2.5.1",8,{"version":25,"cve_count":20,"kev_count":11,"has_kev":17},"3.0",{"version":27,"cve_count":16,"kev_count":11,"has_kev":17},"3.5.0",{"version":29,"cve_count":16,"kev_count":11,"has_kev":17},"3.6.0",{"version":31,"cve_count":32,"kev_count":11,"has_kev":17},"3.6.1",4,{"version":34,"cve_count":35,"kev_count":11,"has_kev":17},"4.0",5,{"version":37,"cve_count":32,"kev_count":11,"has_kev":17},"4.5.0",{"version":39,"cve_count":40,"kev_count":11,"has_kev":17},"4.5.3",3,{"version":42,"cve_count":40,"kev_count":11,"has_kev":17},"4.5.4",{"version":44,"cve_count":40,"kev_count":11,"has_kev":17},"4.5.5",{"version":46,"cve_count":47,"kev_count":11,"has_kev":17},"4.5.6",1,{"version":49,"cve_count":47,"kev_count":11,"has_kev":17},"4.5.7",{"version":51,"cve_count":20,"kev_count":11,"has_kev":17},"4.6.0",{"version":53,"cve_count":16,"kev_count":11,"has_kev":17},"4.6.1",{"version":55,"cve_count":16,"kev_count":11,"has_kev":17},"4.6.2",{"version":57,"cve_count":16,"kev_count":11,"has_kev":17},"4.6.3",{"version":59,"cve_count":16,"kev_count":11,"has_kev":17},"4.6.4",{"version":61,"cve_count":16,"kev_count":11,"has_kev":17},"4.6.5",{"version":63,"cve_count":64,"kev_count":11,"has_kev":17},"4.6.6",2,{"version":66,"cve_count":47,"kev_count":11,"has_kev":17},"4.6.7",{"version":68,"cve_count":47,"kev_count":11,"has_kev":17},"4.6.8",{"version":70,"cve_count":47,"kev_count":11,"has_kev":17},"4.6.9",{"version":72,"cve_count":40,"kev_count":11,"has_kev":17},"5.0.0",{"version":74,"cve_count":40,"kev_count":11,"has_kev":17},"5.0.1",{"version":76,"cve_count":35,"kev_count":11,"has_kev":17},"5.1.0",{"version":78,"cve_count":79,"kev_count":11,"has_kev":17},"5.10.0",53,{"version":81,"cve_count":11,"kev_count":11,"has_kev":17},"5.10.9",{"version":83,"cve_count":35,"kev_count":11,"has_kev":17},"5.1.1",{"version":85,"cve_count":40,"kev_count":11,"has_kev":17},"5.1.2",{"version":87,"cve_count":64,"kev_count":11,"has_kev":17},"5.1.3",{"version":89,"cve_count":64,"kev_count":11,"has_kev":17},"5.3.0",{"version":91,"cve_count":40,"kev_count":11,"has_kev":17},"5.3.1",{"version":93,"cve_count":40,"kev_count":11,"has_kev":17},"5.3.2",{"version":95,"cve_count":11,"kev_count":11,"has_kev":17},"5.3.3",{"version":97,"cve_count":98,"kev_count":11,"has_kev":17},"5.9.0",31,{"version":100,"cve_count":101,"kev_count":11,"has_kev":17},"5.9.1",28,"Epolicy Orchestrator by Mcafee is a technology product with 38 tracked versions and 86 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141],{"version":15,"cve_count":16,"kev_count":11,"has_kev":17},{"version":19,"cve_count":20,"kev_count":11,"has_kev":17},{"version":22,"cve_count":23,"kev_count":11,"has_kev":17},{"version":25,"cve_count":20,"kev_count":11,"has_kev":17},{"version":27,"cve_count":16,"kev_count":11,"has_kev":17},{"version":29,"cve_count":16,"kev_count":11,"has_kev":17},{"version":31,"cve_count":32,"kev_count":11,"has_kev":17},{"version":34,"cve_count":35,"kev_count":11,"has_kev":17},{"version":37,"cve_count":32,"kev_count":11,"has_kev":17},{"version":39,"cve_count":40,"kev_count":11,"has_kev":17},{"version":42,"cve_count":40,"kev_count":11,"has_kev":17},{"version":44,"cve_count":40,"kev_count":11,"has_kev":17},{"version":46,"cve_count":47,"kev_count":11,"has_kev":17},{"version":49,"cve_count":47,"kev_count":11,"has_kev":17},{"version":51,"cve_count":20,"kev_count":11,"has_kev":17},{"version":53,"cve_count":16,"kev_count":11,"has_kev":17},{"version":55,"cve_count":16,"kev_count":11,"has_kev":17},{"version":57,"cve_count":16,"kev_count":11,"has_kev":17},{"version":59,"cve_count":16,"kev_count":11,"has_kev":17},{"version":61,"cve_count":16,"kev_count":11,"has_kev":17},{"version":63,"cve_count":64,"kev_count":11,"has_kev":17},{"version":66,"cve_count":47,"kev_count":11,"has_kev":17},{"version":68,"cve_count":47,"kev_count":11,"has_kev":17},{"version":70,"cve_count":47,"kev_count":11,"has_kev":17},{"version":72,"cve_count":40,"kev_count":11,"has_kev":17},{"version":74,"cve_count":40,"kev_count":11,"has_kev":17},{"version":76,"cve_count":35,"kev_count":11,"has_kev":17},{"version":78,"cve_count":79,"kev_count":11,"has_kev":17},{"version":81,"cve_count":11,"kev_count":11,"has_kev":17},{"version":83,"cve_count":35,"kev_count":11,"has_kev":17},{"version":85,"cve_count":40,"kev_count":11,"has_kev":17},{"version":87,"cve_count":64,"kev_count":11,"has_kev":17},{"version":89,"cve_count":64,"kev_count":11,"has_kev":17},{"version":91,"cve_count":40,"kev_count":11,"has_kev":17},{"version":93,"cve_count":40,"kev_count":11,"has_kev":17},{"version":95,"cve_count":11,"kev_count":11,"has_kev":17},{"version":97,"cve_count":98,"kev_count":11,"has_kev":17},{"version":100,"cve_count":101,"kev_count":11,"has_kev":17},[143,151,158,166,171,176,182,187,192,196],{"cveId":144,"description":145,"publishedDate":146,"cvssScore":147,"cvssVersion":148,"severity":149,"isKev":17,"epssScore":150},"CVE-2020-13935","The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.","2020-07-14",7.5,"v3.1","High",0.86608,{"cveId":152,"description":153,"publishedDate":154,"cvssScore":155,"cvssVersion":148,"severity":156,"isKev":17,"epssScore":157},"CVE-2021-33037","Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP\u002F1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.","2021-07-12",5.3,"Medium",0.74667,{"cveId":159,"description":160,"publishedDate":161,"cvssScore":162,"cvssVersion":163,"severity":164,"isKev":17,"epssScore":165},"CVE-2006-5156","Buffer overflow in McAfee ePolicy Orchestrator before 3.5.0.720 and ProtectionPilot before 1.1.1.126 allows remote attackers to execute arbitrary code via a request to \u002Fspipe\u002Fpkg\u002F with a long source header.","2006-10-05",10,"v2","Critical",0.74009,{"cveId":167,"description":168,"publishedDate":169,"cvssScore":20,"cvssVersion":148,"severity":149,"isKev":17,"epssScore":170},"CVE-2020-9484","When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.","2020-05-20",0.5552,{"cveId":172,"description":173,"publishedDate":174,"cvssScore":147,"cvssVersion":148,"severity":149,"isKev":17,"epssScore":175},"CVE-2021-23840","Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).","2021-02-16",0.50732,{"cveId":177,"description":178,"publishedDate":179,"cvssScore":180,"cvssVersion":148,"severity":149,"isKev":17,"epssScore":181},"CVE-2021-3712","ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own \"d2i\" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the \"data\" and \"length\" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the \"data\" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y).","2021-08-24",7.4,0.50445,{"cveId":183,"description":184,"publishedDate":185,"cvssScore":35,"cvssVersion":163,"severity":156,"isKev":17,"epssScore":186},"CVE-2004-0095","McAfee ePolicy Orchestrator agent allows remote attackers to cause a denial of service (memory consumption and crash) and possibly execute arbitrary code via an HTTP POST request with an invalid Content-Length value, possibly triggering a buffer overflow.","2004-02-17",0.37199,{"cveId":188,"description":189,"publishedDate":190,"cvssScore":32,"cvssVersion":163,"severity":156,"isKev":17,"epssScore":191},"CVE-2015-0921","XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do.","2015-01-09",0.17355,{"cveId":193,"description":194,"publishedDate":190,"cvssScore":35,"cvssVersion":163,"severity":156,"isKev":17,"epssScore":195},"CVE-2015-0922","McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password.",0.13346,{"cveId":197,"description":198,"publishedDate":199,"cvssScore":200,"cvssVersion":148,"severity":156,"isKev":17,"epssScore":201},"CVE-2020-13938","Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows","2021-06-10",5.5,0.11867,[],{"title":204,"metaDescription":205,"keywords":206,"structuredData":207},"Epolicy Orchestrator by Mcafee - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Epolicy Orchestrator by Mcafee covering 38 versions with 86 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Epolicy Orchestrator vulnerabilities, Epolicy Orchestrator security, Epolicy Orchestrator CVE, Mcafee Epolicy Orchestrator, Epolicy Orchestrator threat intelligence, Mcafee security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":208,"@type":209,"name":210,"description":205,"url":211,"manufacturer":212,"applicationCategory":216,"softwareVersion":217,"mainEntity":218},"https:\u002F\u002Fschema.org","SoftwareApplication","Epolicy Orchestrator","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fmcafee\u002Fepolicy_orchestrator",{"@type":213,"name":214,"url":215},"Organization","Mcafee","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fmcafee","Security Software","38 versions tracked",{"@type":219,"name":220,"description":221,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Epolicy Orchestrator Security Vulnerabilities","Security vulnerabilities affecting Epolicy Orchestrator by Mcafee",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":223,"apiVersion":25},"2026-10-17T14:25:26.210Z",{"rows":225,"total":11,"capped":17,"failed":11},[],[227],{"product":228,"cves":40},"epolicy_orchestrator_agent"]