TTrellix

Products

Exploited and recent CVEs

• CVE-2026-115740 Medium 4.3 Server side request forgery vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows the file Prefix parameter in the OpenEventEvidenceFile.do endpoint accepts arbitrary U 0.3%
• CVE-2026-115739 Medium 6.5 Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a remote attacker to decrypt credentials and evidence files. 0.3%
• CVE-2026-115738 Medium 6.5 SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries. 0.4%
• CVE-2026-107171 Medium 6.9 An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users. 0.1%
• CVE-2026-12588 Medium 6.0 An attacker with access to an HX 10.0.0  and previous versions, may send specially-crafted data to the HX console. The malicious detection would then trigger decompression of a large file that consume 0.3%
• CVE-2025-7958 High 7.1 A Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally authenticated admin user can execute arbitrary code using the web interface and Alert artifact details. 0.3%
• CVE-2025-14963 Medium 6.2 A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevated system privileges. Utilization of a Bring Your Own Vulnerab 0.1%
• CVE-2025-0664 Medium 6.7 A locally authenticated, privileged user can craft a malicious OpenSSL configuration file, potentially leading the agent to load an arbitrary local library. This may impair endpoint defenses and allow 0.2%
• CVE-2025-5967 Medium 5.3 A stored cross-site scripting vulnerability in ENS HX 10.0.4 allows a malicious user to inject arbitrary HTML into the ENS HX Malware Scan Name field, resulting in the exposure of sensitive data. 0.2%
• CVE-2025-3773 None 0.0 A sensitive information exposure vulnerability in System Information Reporter (SIR) 1.0.3 and prior allows an authenticated non-admin local user to extract sensitive information stored in a registry 0.1%
• CVE-2025-3722 None 0.0 A path traversal vulnerability in System Information Reporter (SIR) 1.0.3 and prior allowed an authenticated high privileged user to issue malicious ePO post requests to System Information Reporter, 0.2%
• CVE-2025-3771 High 7.2 A path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an authenticated non-admin local user to overwrite system files with SIR backup files, which can potentially c 0.2%
• CVE-2025-0618 Medium 6.5 A malicious third party could invoke a persistent denial of service vulnerability in FireEye EDR agent by sending a specially-crafted tamper protection event to the HX service to trigger an exception. 0.7%
• CVE-2025-0617 Medium 5.9 An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection would then trigger file parsing containing exponential entit 0.4%
• CVE-2024-5955 Medium 5.4 Cross-site scripting vulnerability in Trellix ePolicy Orchestrator prior to ePO 5.10 Service Pack 1 Update 3 allows a remote authenticated attacker to craft requests causing arbitrary content to be in 0.4%
• CVE-2024-9679 Medium 5.3 A Hardcoded Cryptographic key vulnerability existed in DLP Extension 11.11.1.3 which allowed the decryption of previously encrypted user credentials. 0.4%
• CVE-2024-9678 Medium 4.9 An SQL Injection vulnerability existed in DLP Extension 11.11.1.3. The vulnerability allowed an attacker to perform arbitrary SQL queries potentially leading to command execution. 0.8%
• CVE-2024-11482 Critical 9.8 A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, executed as the root user. 2.5%
• CVE-2024-11481 High 8.2 A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate 0.4%
• CVE-2024-5957 Medium 6.3 This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager. 0.4%
• CVE-2024-5956 Medium 6.5 This vulnerability allows unauthenticated remote attackers to bypass authentication and gain partial data access to the vulnerable Trellix IPS Manager with garbage data in response mostly 0.4%
• CVE-2024-7608 Medium 5.9 An authenticated user can access the restricted files from NX, EX, FX, AX, IVX and CMS using path traversal. 0.3%
• CVE-2024-5731 Medium 6.8 A vulnerability in the IPS Manager, Central Manager, and Local Manager communication workflow allows an attacker to control the destination of a request by manipulating the parameter, thereby leveragi 0.3%
• CVE-2024-5671 Critical 9.8 Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vulnerable Trellix IPS Manager. 0.9%
• CVE-2024-4176 Medium 4.1 An Cross site scripting vulnerability in the EDR XConsole before this release allowed an attacker to potentially leverage an XSS/HTML-Injection using command line variables. A malicious threat actor c 0.3%
• CVE-2024-4844 High 7.5 Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privileges on the ePO server to read the conten 0.2%
• CVE-2024-4843 Medium 4.3 ePO doesn't allow a regular privileged user to delete tasks or assignments. Insecure direct object references that allow a least privileged user to manipulate the client task and client task assignmen 0.3%
• CVE-2023-6072 Medium 4.6 A cross-site scripting vulnerability in Trellix Central Management (CM) prior to 9.1.3.97129 allows a remote authenticated attacker to craft CM dashboard internal requests causing arbitrary content t 0.3%
• CVE-2024-0310 Medium 6.1 A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content securi 0.4%
• CVE-2024-0213 High 8.2 A buffer overflow vulnerability in TA for Linux and TA for MacOS prior to 5.8.1 allows a local user to gain elevated permissions, or cause a Denial of Service (DoS), through exploiting a memory corru 0.2%