Vulnerabilities > Mcafee > Email Gateway > Medium

DATE CVE VULNERABILITY TITLE RISK
2020-09-16 CVE-2020-7268 Path Traversal vulnerability in Mcafee Email Gateway
Path Traversal vulnerability in McAfee McAfee Email Gateway (MEG) prior to 7.6.406 allows remote attackers to traverse the file system to access files or directories that are outside of the restricted directory via external input to construct a path name that should be within a restricted directory.
network
low complexity
mcafee CWE-22
4.3
2017-03-14 CVE-2016-8005 Permissions, Privileges, and Access Controls vulnerability in Mcafee Email Gateway
File extension filtering vulnerability in Intel Security McAfee Email Gateway (MEG) before 7.6.404h1128596 allows attackers to fail to identify the file name properly via scanning an email with a forged attached filename that uses a null byte within the filename extension.
network
low complexity
mcafee CWE-264
4.0
2016-04-06 CVE-2016-3969 Cross-site Scripting vulnerability in Mcafee Email Gateway
Cross-site scripting (XSS) vulnerability in McAfee Email Gateway (MEG) 7.6.x before 7.6.404, when File Filtering is enabled with the action set to ESERVICES:REPLACE, allows remote attackers to inject arbitrary web script or HTML via an attachment in a blocked email.
network
mcafee CWE-79
4.3
2013-12-13 CVE-2013-7092 SQL Injection vulnerability in Mcafee Email Gateway 7.6
Multiple SQL injection vulnerabilities in /admin/cgi-bin/rpc/doReport/18 in McAfee Email Gateway 7.6 allow remote authenticated users to execute arbitrary SQL commands via the (1) events_col, (2) event_id, (3) reason, (4) events_order, (5) emailstatus_order, or (6) emailstatus_col JSON keys.
network
low complexity
mcafee CWE-89
6.5
2012-08-22 CVE-2012-4597 Cross-Site Scripting vulnerability in Mcafee Email and web Security and Email Gateway
Cross-site scripting (XSS) vulnerability in McAfee Email and Web Security (EWS) 5.5 through Patch 6 and 5.6 through Patch 3, and McAfee Email Gateway (MEG) 7.0.0 and 7.0.1, allows remote attackers to inject arbitrary web script or HTML via vectors related to the McAfee Security Appliance Management Console/Dashboard.
network
mcafee CWE-79
4.3
2012-08-22 CVE-2012-4596 Path Traversal vulnerability in Mcafee Email Gateway 7.0.0/7.0.1
Directory traversal vulnerability in McAfee Email Gateway (MEG) 7.0.0 and 7.0.1 allows remote authenticated users to bypass intended access restrictions and download arbitrary files via a crafted URL.
network
mcafee CWE-22
4.3
2012-08-22 CVE-2012-4585 Permissions, Privileges, and Access Controls vulnerability in Mcafee Email and web Security and Email Gateway
McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows remote authenticated users to read arbitrary files via a crafted URL.
network
low complexity
mcafee CWE-264
4.0
2012-08-22 CVE-2012-4583 Information Exposure vulnerability in Mcafee Email and web Security and Email Gateway
McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows remote authenticated users to obtain the session tokens of arbitrary users by navigating within the Dashboard.
network
low complexity
mcafee CWE-200
4.0
2012-08-22 CVE-2012-4582 Permissions, Privileges, and Access Controls vulnerability in Mcafee Email and web Security and Email Gateway
McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows remote authenticated users to reset the passwords of arbitrary administrative accounts via unspecified vectors.
network
mcafee CWE-264
4.9
2012-08-22 CVE-2012-4581 Improper Authentication vulnerability in Mcafee Email and web Security and Email Gateway
McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, does not disable the server-side session token upon the closing of the Management Console/Dashboard, which makes it easier for remote attackers to hijack sessions by capturing a session cookie and then modifying the response to a login attempt, related to a "Logout Failure" issue.
network
mcafee CWE-287
6.8