CVE-2017-4015

Clickjacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to inject arbitrary web script or HTML via HTTP response header.

• CWE-1021

• http://www.securitytracker.com/id/1038523Broken Link, Third Party Advisory, VDB Entry
• https://kc.mcafee.com/corporate/index?page=content&id=SB10198Broken Link, Vendor Advisory
• http://www.securitytracker.com/id/1038523Broken Link, Third Party Advisory, VDB Entry
• https://kc.mcafee.com/corporate/index?page=content&id=SB10198Broken Link, Vendor Advisory

Published

May 17, 2017

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-4009Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-4010Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-4011Embedding Script (XSS) in HTTP Headers vulnerability in the …
• CVE-2017-4012Privilege Escalation vulnerability in the server in McAfee N…
• CVE-2017-4013Banner Disclosure in the server in McAfee Network Data Loss …
• CVE-2017-4014Session Side jacking vulnerability in the server in McAfee N…
• CVE-2017-4016Web Server method disclosure in the server in McAfee Network…
• CVE-2017-4017User Name Disclosure in the server in McAfee Network Data Lo…
• CVE-2017-4018Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-4019Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-4020Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-4021Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…