Search
Search Results (5 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-115738 | 1 Trellix | 1 Dlp On-prem Extensions | 2026-11-06 | 6.5 Medium |
| SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries. | ||||
| CVE-2026-115739 | 1 Trellix | 1 Dlp On-prem Extensions | 2026-11-06 | 6.5 Medium |
| Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to decrypt credentials and evidence files. | ||||
| CVE-2026-115740 | 1 Trellix | 1 Dlp On-prem Extensions | 2026-11-06 | 4.3 Medium |
| Server side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows the file Prefix parameter in the OpenEventEvidenceFile.do endpoint accepts arbitrary UNC paths without validation. The server-side code attempts to open the specified file path, causing Windows to resolve the hostname and initiate SMB authentication to the attacker-controlled host. | ||||
| CVE-2022-3859 | 1 Trellix | 1 Agent | 2025-04-23 | 6.7 Medium |
| An uncontrolled search path vulnerability exists in Trellix Agent (TA) for Windows in versions prior to 5.7.8. This allows an attacker with admin access, which is required to place the DLL in the restricted Windows System folder, to elevate their privileges to System by placing a malicious DLL there. | ||||
| CVE-2023-3313 | 1 Trellix | 1 Enterprise Security Manager | 2024-11-22 | 7.8 High |
| An OS common injection vulnerability exists in the ESM certificate API, whereby incorrectly neutralized special elements may have allowed an unauthorized user to execute system command injection for the purpose of privilege escalation or to execute arbitrary commands. | ||||
Page 1 of 1.