Vulnerabilities > Mcafee > Email Gateway
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2012-08-22 | CVE-2012-4595 | Improper Authentication vulnerability in Mcafee Email and web Security and Email Gateway McAfee Email and Web Security (EWS) 5.5 through Patch 6 and 5.6 through Patch 3, and McAfee Email Gateway (MEG) 7.0.0 and 7.0.1, allows remote attackers to bypass authentication and obtain an admin session ID via unspecified vectors. | 7.5 |
| 2012-08-22 | CVE-2012-4586 | Permissions, Privileges, and Access Controls vulnerability in Mcafee Email and web Security and Email Gateway McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, accesses files with the privileges of the root user, which allows remote authenticated users to bypass intended permission settings by requesting a file. | 3.5 |
| 2012-08-22 | CVE-2012-4585 | Permissions, Privileges, and Access Controls vulnerability in Mcafee Email and web Security and Email Gateway McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows remote authenticated users to read arbitrary files via a crafted URL. | 4.0 |
| 2012-08-22 | CVE-2012-4584 | Cryptographic Issues vulnerability in Mcafee Email and web Security and Email Gateway McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, does not properly encrypt system-backup data, which makes it easier for remote authenticated users to obtain sensitive information by reading a backup file, as demonstrated by obtaining password hashes. | 3.5 |
| 2012-08-22 | CVE-2012-4583 | Information Exposure vulnerability in Mcafee Email and web Security and Email Gateway McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows remote authenticated users to obtain the session tokens of arbitrary users by navigating within the Dashboard. | 4.0 |
| 2012-08-22 | CVE-2012-4582 | Permissions, Privileges, and Access Controls vulnerability in Mcafee Email and web Security and Email Gateway McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows remote authenticated users to reset the passwords of arbitrary administrative accounts via unspecified vectors. | 4.9 |
| 2012-08-22 | CVE-2012-4581 | Improper Authentication vulnerability in Mcafee Email and web Security and Email Gateway McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, does not disable the server-side session token upon the closing of the Management Console/Dashboard, which makes it easier for remote attackers to hijack sessions by capturing a session cookie and then modifying the response to a login attempt, related to a "Logout Failure" issue. | 6.8 |
| 2012-08-22 | CVE-2012-4580 | Cross-Site Scripting vulnerability in Mcafee Email and web Security and Email Gateway Cross-site scripting (XSS) vulnerability in McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows remote attackers to inject arbitrary web script or HTML via vectors related to the McAfee Security Appliance Management Console/Dashboard. | 4.3 |
| 2010-05-28 | CVE-2010-2116 | Incorrect Permission Assignment FOR Critical Resource vulnerability in Mcafee Email Gateway and Secure Mail The web interface in McAfee Email Gateway (formerly IronMail) 6.7.1 allows remote authenticated users, with only Read privileges, to gain Write privileges to modify configuration via the save action in a direct request to admin/systemWebAdminConfig.do. | 6.5 |
| 2009-04-30 | CVE-2009-1348 | Improper Input Validation vulnerability in Mcafee products The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via (1) an invalid Headflags field in a malformed RAR archive, (2) an invalid Packsize field in a malformed RAR archive, or (3) an invalid Filelength field in a malformed ZIP archive. | 7.6 |