CVE-2017-4015

MediumCVSS 4.5/10Last modified Jun 17, 2026

Description

Clickjacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to inject arbitrary web script or HTML via HTTP response header.

Metrics

CVSS 3.1 4.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-1021

Affected software

Vendor	Product	Versions
McAfee	Network Data Loss Prevention (NDLP)	9.3.x

References

http://www.securitytracker.com/id/1038523Broken Link, Third Party Advisory, VDB Entry
https://kc.mcafee.com/corporate/index?page=content&id=SB10198Broken Link, Vendor Advisory
http://www.securitytracker.com/id/1038523Broken Link, Third Party Advisory, VDB Entry
https://kc.mcafee.com/corporate/index?page=content&id=SB10198Broken Link, Vendor Advisory

Timeline

Published: May 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-40165.3Web Server method disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to exploit and find a CVE-2017-40175.3User Name Disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to view user information via CVE-2017-40284.4Maliciously misconfigured registry vulnerability in all Microsoft Windows products in McAfee consumer and corporate products allows an admin CVE-2017-40529.8Authentication Bypass vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthent CVE-2017-40539.8Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticat CVE-2017-40548.8Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authenticated CVE-2017-40557.5Exploitation of Authentication vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote CVE-2017-40578.8Privilege Escalation vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authentica CVE-2017-48958.8Airwatch Agent for Android contains a vulnerability that may allow a device to bypass root detection. Successful exploitation of this issue CVE-2017-48963.8Airwatch Inbox for Android contains a vulnerability that may allow a rooted device to decrypt the local data used by the application. Succes CVE-2017-48975.5VMware Horizon DaaS before 7.0.0 contains a vulnerability that exists due to insufficient validation of data. An attacker may exploit this i CVE-2017-48988.8VMware Workstation Pro/Player 12.x before 12.5.3 contains a DLL loading vulnerability that occurs due to the "vmware-vmx" process loading DL